Writing a standard operating procedure means turning a recurring task into numbered steps clear enough that a trained employee can perform it the same way every time. The work has three parts: pick a template with the right sections, sit with the people who actually do the task and record what they do, then draft each step as a direct instruction tied to a specific role. Route the draft through approval, store it where only authorized editors can change it, and train everyone it covers.
The Sections Every SOP Needs
Most templates share the same skeleton. Knowing what each section does before you draft saves revision cycles later.
- Title. Short and specific. “Processing Customer Refunds” beats “Refund Policy” because it signals action.
- Document ID and version number. A unique identifier, often a department code plus a sequential number, paired with a version suffix such as v1.0 or v2.3. This prevents anyone from following a retired draft.
- Purpose. One or two sentences on why the procedure exists and what outcome it produces.
- Scope. Which teams, roles, or locations the SOP covers. A line like “Applies to all warehouse staff at the Chicago distribution center” removes guesswork about ownership.
- Definitions. Acronyms and technical terms the reader might not know. Skip everyday words.
- Roles and responsibilities. Who performs each step, who approves results, who to contact when something goes wrong.
- Procedure steps. The core of the document: numbered instructions in the order they happen.
- References. Related SOPs, regulations, safety data sheets, or software manuals the reader may need alongside this one.
- Revision history. A table logging the date, author, and summary of every change since the original version.
- Approval signature. Sign-off by a manager or quality officer confirming the SOP is accurate and authorized for use.
Some templates add fields for flowcharts, risk ratings, or required equipment. Useful but optional. The sections above are the non-negotiable framework.
Gather Information Before You Draft
The people who do the work every day are your primary source. Interview them, watch them perform the task in real time, and ask what goes wrong most often. You will almost always discover steps that exist in practice but have never been written down: workarounds, judgment calls, and informal quality checks that keep the process running.
Pull in anyone whose domain touches the procedure. Subject-matter experts validate technical accuracy and confirm the steps reflect current practice rather than outdated habits. Financial controllers supply budget limits, approval thresholds, and cost codes the procedure needs. IT or equipment managers confirm software versions, hardware specifications, and system access requirements. Safety officers flag regulatory obligations, which matters most when the task involves chemicals, heavy machinery, or confined spaces.
While observing, document the inputs and outputs of each step. Inputs are the materials, data, or approvals needed to begin; outputs are what the step produces. Mapping these reveals bottlenecks, where work piles up waiting for an input, and handoff points, where responsibility shifts from one person to another. Both are common failure points a good SOP addresses explicitly.
Write Steps People Can Actually Follow
The biggest mistake in SOP writing is passive voice for action steps. “The sample should be placed in the centrifuge” leaves the reader wondering who is supposed to do it. “Place the sample in the centrifuge” removes the ambiguity. Use the imperative mood for every step the reader performs. Save passive voice for cases where the actor genuinely doesn’t matter, such as “The report is generated automatically by the system overnight.”
Each step should describe one action. If you find yourself writing “and” in the middle of a step, split it. Numbering every step also gives people a way to reference a specific point during training or troubleshooting. “I got stuck at step 14” is more useful than a vague description of where someone is in the process.
Avoid jargon your audience doesn’t share. An SOP written for lab technicians can use technical chemistry terms, but an incident-reporting procedure used by both IT and facilities needs plain language throughout. When a technical term is unavoidable, define it in the definitions section and use it consistently afterward.
Fill the Template in Order
Start at the top. Write the title and document ID first, then the purpose and scope. Nailing these down early keeps you from drifting into instructions that belong in a different SOP. If you catch yourself writing steps for a process that falls outside your defined scope, stop. That content belongs in its own document.
Transfer your observed step sequence into the procedure section. Number each step, and after each one, ask whether a new employee could perform it using only what’s written on the page. If a step requires a judgment call like “use an appropriate amount,” replace the vague language with a measurable standard like “add 50 mL.” Where a step branches, say “if the customer’s account is past due, do X; otherwise, do Y,” format the branch clearly with indented sub-steps or a simple decision table.
Fill the roles-and-responsibilities section by matching each step or group of steps to a specific job title, not a person’s name. People leave; titles persist. If the procedure involves financial transactions, specify the dollar threshold that triggers a higher level of approval, and cite the internal policy setting that threshold so the reader can verify it.
Complete the references section last, once you know which external documents, regulations, or companion SOPs you actually cited in the body. A references list padded with tangentially related documents creates noise that discourages people from consulting the ones that matter.
Plan for Deviations
No procedure survives contact with reality without the occasional exception. The question is whether your organization documents those exceptions or pretends they don’t happen. A formal deviation process protects you during audits and gives quality teams data they can use to improve the SOP.
When someone cannot follow the SOP as written, the deviation record should capture a few essentials: which SOP is being deviated from, why, what the expected impact is, what corrective steps were taken, and who authorized the exception. This can be a standalone form or a module inside your document management system.
Planned deviations, approved in advance because of a temporary equipment shortage or a known process limitation, are routine. Unplanned deviations signal something broke. They warrant a root-cause investigation and, if the same deviation keeps recurring, a revision to the SOP. In regulated industries such as pharmaceuticals, the FDA requires that any deviation from written production procedures be recorded and justified.1eCFR. 21 CFR 211.100 – Written Procedures; Deviations
Approve, Store, and Review
A draft SOP isn’t official until someone with authority signs off. Approval typically involves the process owner, usually a department manager, and a quality or compliance officer. Many organizations route the draft through a document management system that logs the reviewer’s identity, timestamp, and comments, creating an audit trail that regulators expect to see.
Once approved, the SOP goes into a centralized repository everyone can access but only authorized editors can change. This single-source-of-truth model prevents the “which version is current?” problem that plagues organizations relying on shared drives full of competing Word documents. For publicly traded companies, controlled document repositories also support compliance with the Sarbanes-Oxley Act, which requires management to establish and maintain adequate internal controls for financial reporting.2GovInfo. Sarbanes-Oxley Act of 2002
Schedule periodic reviews. The right interval depends on how fast the underlying process changes. A procedure tied to software that updates quarterly needs more frequent review than one describing how to calibrate hardware that hasn’t changed in years. During each review, verify the steps still match what people actually do, update any regulatory references, and increment the version number. Log every change in the revision history table.
Change Control
Revisions to a live SOP should follow a change-control process that mirrors the original approval workflow. The person requesting the change submits a description of what needs to change and why. A reviewer, often the process owner or a quality team member, assesses the impact on related procedures, training materials, and compliance obligations. After approval, the revised SOP replaces the old version in the repository, and the old version is archived rather than deleted. Keeping superseded versions matters for audits, litigation holds, and understanding why a process evolved the way it did.
Retention of Retired Versions
How long you keep retired SOPs depends on your industry and the records they touch. OSHA requires employers to preserve employee exposure records for at least 30 years.3eCFR. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records Tax-related records generally need to survive at least seven years, and employment and payroll records carry retention windows of three to seven years after an employee’s departure. When in doubt, keep the document. Storage is cheap; failing to produce a record during litigation is not.
Train Everyone the SOP Covers
An SOP that nobody reads is a filing exercise. Every person covered by the procedure should receive training on it, ideally a walkthrough with hands-on practice, and sign or electronically acknowledge they’ve reviewed and understood the document. The acknowledgment shows the organization didn’t just write the rules but made sure people knew about them.
Electronic signatures are legally valid for these acknowledgments under the federal ESIGN Act, which provides that a signature or record cannot be denied legal effect solely because it is in electronic form.4Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity For the signature to hold up, the system should capture the signer’s intent, associate the signature with the specific document version, and retain the record in a format that can be accurately reproduced later.
Retrain whenever a significant revision is made. A minor formatting change probably doesn’t warrant pulling everyone off the floor, but a revised safety step or a new regulatory requirement does. Track training completion dates alongside the SOP’s revision history so you can quickly show an auditor which version each employee was trained on.
When the Law Requires an SOP
Some industries don’t just recommend SOPs; they legally require them. If your organization operates in one of these spaces, your procedures need to meet specific regulatory standards on top of the general practices above.
Pharmaceutical and medical device manufacturers must follow FDA current Good Manufacturing Practice regulations, which require written production and process control procedures reviewed and approved by both the responsible organizational unit and the quality control unit.1eCFR. 21 CFR 211.100 – Written Procedures; Deviations
Broker-dealers registered with FINRA must establish, maintain, and enforce written supervisory procedures reasonably designed to achieve compliance with securities laws and FINRA rules, covering transaction review, correspondence, and customer complaints. A copy must be kept at each office of supervisory jurisdiction, and the firm must amend the procedures promptly when laws or internal systems change.5FINRA. 3110. Supervision
Organizations performing environmental information operations under EPA oversight must follow the agency’s Quality Program directives, which include standards for Quality Management Plans and Quality Assurance Project Plans.6US EPA. Quality Program Directives
OSHA doesn’t mandate SOPs by name for every workplace, but its recordkeeping and hazard-communication standards effectively require documented procedures for tasks involving hazardous materials, confined spaces, lockout/tagout, and other high-risk operations.7Occupational Safety and Health Administration. Recordkeeping If any of these regimes apply to you, confirm your template captures the specific elements the regulator expects before you start drafting.