Standard Operating Procedures

A standard operating procedure (SOP) is a documented set of step-by-step instructions for carrying out a routine task the same way each time. A complete SOP usually states its purpose and scope, identifies the roles responsible for each step, lists the numbered steps in sequence, notes the controls or checks at key points, and records a version number and review date. The aim is that any trained person can follow it and reach the same result.

A policy is the rule or principle that sets out what the organisation requires and why. A process is the high-level sequence that shows what happens from start to finish. A procedure, which is what an SOP documents, gives the detailed how: the exact steps a person follows to carry out one part of that process. The policy sets the rule, the process maps the workflow, and the SOP tells the individual how to do the task. An SOP sits at the procedure level rather than the policy level.

Without documented procedures, knowledge sits with individuals and leaves when they do, quality varies with whoever performs the task, and training relies on memory. Documented SOPs capture that knowledge, hold quality steady across people and locations, shorten the time it takes to bring new staff up to speed, and give auditors and regulators evidence that operations follow a defined method. They also make it easier to spot where a process breaks, because the expected steps are written down.

The useful moments are usually before growth, before a key person leaves, and before an audit or certification. A business that is hiring, opening a second location, preparing for due diligence, or relying heavily on one or two experienced staff gains the most from documenting early, while the knowledge is still in the building. Waiting until after a departure or a failed audit means reconstructing procedures from memory, which is slower and less reliable.

Start with the processes that carry the most risk or repeat the most often: the ones where an error is expensive, where compliance is involved, or where the same task is performed daily by several people. Common first candidates are the order-to-cash and procure-to-pay cycles, payroll and statutory filing, customer onboarding, and any process tied to a regulatory obligation. Documenting these first protects the areas where consistency matters most, before moving to lower-risk routines.

Three formats cover most needs. A step-by-step format suits short, routine tasks with few decisions. A hierarchical format suits longer tasks, breaking main steps into detailed sub-steps so that both new and experienced staff can use the same document. A flowchart format suits processes with several decision points, where the next step depends on the outcome of the last. The choice follows the task: the number of steps and the number of decisions decide the format.

Process mapping is the act of drawing how work actually flows, showing each step, who performs it, the decision points, and the handoffs between people or teams. BPMN, which stands for Business Process Model and Notation, is a widely used standard set of symbols for these maps, so a diagram means the same thing to everyone who reads it. Mapping a process before writing the SOP surfaces gaps, duplicated effort, and unclear ownership that plain text would hide.

RACI stands for Responsible, Accountable, Consulted, and Informed. A RACI chart lists each step or task and marks who does the work, who is answerable for the outcome, who must be consulted, and who needs to be kept informed. Including it in a procedure removes the common problem of a step that everyone assumes someone else owns. It makes accountability explicit, which matters most at handoffs between departments.

ISO 9001 is the international standard for quality management systems, built on seven principles including customer focus, leadership, a process approach, and evidence-based decision making. Aligning documentation to ISO 9001 means structuring SOPs with the elements the standard expects, such as defined scope, controlled versions, and assigned ownership, so the documents would stand up in a quality audit. This does not require you to hold ISO 9001 certification; many businesses adopt the structure for its discipline alone, and aligned documentation gives a head start if you pursue the certificate later. The current standard is ISO 9001:2015, and a revision, ISO 9001:2026, is expected to be published in September 2026 on the same underlying structure.

SOPs turn compliance from a scramble into a routine. By building the required checks into everyday steps and mapping procedures to the obligations that apply, such as the Companies Act, GST, and applicable labour laws, the documentation itself becomes the evidence an auditor or inspector asks for. When a process is written, version-controlled, and followed, you can show not only that a rule exists but that the organisation applies it consistently, which is what most audits test.

You can, and many businesses draft their own. The difficulty is rarely the writing; it is observing what actually happens, reconciling the version in someone's head with the version in practice, and building in the right controls. AI tools can produce a clean first draft from a description, but they cannot watch your operation, judge which steps carry risk, or map a procedure to a specific regulatory requirement. They work best as a drafting aid on top of a properly mapped process, with the judgement about risk and compliance still coming from people who know the operation.

It depends on scope. A single, well-understood process can be mapped, drafted, and validated in a short cycle, while a full set of procedures across an organisation runs over several weeks, because each one has to be observed, drafted, reviewed by the people who do the work, and tested against actual practice. The validation step, checking that a procedure can be followed exactly as written, is what protects against documents that look complete but fail in use.

Documents that sit unread change nothing. Adoption depends on involving the people who do the work while the procedure is being written, providing role-specific training rather than a single long manual, and keeping each SOP short and easy to find. Assigning an owner to every procedure and building simple checks into the workflow keeps the steps in use rather than filed away. Procedures written without the frontline team are the ones most often ignored.

A procedure is only useful while it matches reality. Keeping SOPs current relies on a defined review cycle, a change-control method that records what changed and why, and version control so everyone works from the latest copy. When a process changes, the linked SOP is updated and re-issued before it drifts out of date. Without this, documentation slowly diverges from practice until staff stop trusting it.

Ownership should rest with your organisation, with a named person responsible for each procedure or group of procedures. A good handover includes the editable source files, a register of documents with their review dates, and a simple change-control method your team can run without outside help. The aim is documentation you control and can keep current internally, supported by us when a larger revision or a new process calls for it.