RunnyBabbit
I now understand more - I'm not sure where you're getting your info on doc control from, but you appear to be laboring undr a few misapprehensions. You don't NEED a document control schedule/log/what have you for example! (I haven't ever even created one for any of my clients.)
The clause is quite general, it talks of the controls 'needed'. Interesting choice of word - I read it as meaning the controls that you decide you need in your organisation and your environment in order to control your documents suitably.
All you need to do - ALL - is to meet the requirements of clause 4.2.3. That's it, game, set and match. I suggest that you read what's there closely and then start thinking about what you already do, before making any major changes.
You probably need some kind of ID on SAP docs, although even that is arguable to some extent. (If there's only ever one current version... then that's the current version.) Just because many people mistakenly believe there 'must' be a doc control sheet/log/whatever doesn't mean they're correct. And they're certainly operating or thinking in a pre-computerised environment and have almost certainly never used or come across SAP or something similar.
As GM, why not delegate the actual doing of it (updates) to someone else, and maintain the authorising of it yourself?
As you say, SAP records all the changes and when/who made them. So... combined with who sets/gives the permissions, there's your control. And you can use some internal audit to satisfy yourself it's working OK.
