SOPStandard Operating Procedure

A Standard Operating Procedure (SOP) is a controlled, version-managed written instruction that defines exactly how a regulated organisation performs a critical task — making a batch, calibrating an instrument, releasing a lot, handling a deviation, training a new hire, responding to a complaint, recalling a product. It is the operational text that turns a quality policy into something a person can execute consistently.

SOPs are the largest single category of controlled documents in any regulated manufacturer. A small pharma site typically maintains 200–500 active SOPs; a large multi-site organisation runs into the thousands. Every one of them is inspectable. Every one of them has to be at the right version, trained against, followed in practice, and retired when superseded.

Every regulated industry mandates SOPs under slightly different language. The substance is identical.

These rules do not all use the word "SOP". 21 CFR 211 says "written procedures". ISO 9001 says "documented information". ICH Q10 says "documents and records". The work product is the same: a controlled written instruction with versioning, approval, training and audit trail.

1. Document control header — title, unique document number, current version, effective date, supersedes, next review date, owner department.
2. Approval signatures — author, technical reviewer, QA approver, with date. For critical SOPs (formula approval, batch release), two independent signatures.
3. Purpose / scope — what this SOP covers, what it does not. The boundary matters in audits.
4. References — controlled regulations, standards, parent / child SOPs, specifications, forms.
5. Definitions / abbreviations — every term that has a precise operational meaning.
6. Responsibilities — by role, not by name. Operator does this; Supervisor does this; QA does this.
7. Materials and equipment — what to use, including SAP / ERP codes if applicable.
8. Safety / PPE — required PPE, hazards, MSDS / SDS references.
9. Procedure — numbered, atomic steps. One action per step. Acceptance criteria embedded. Decision points explicit.
10. Records — what gets written down, on what form, retained where, for how long.
11. Deviation handling — what to do if a step cannot be followed. Reference to deviation SOP.
12. Revision history — every previous version with date, change summary, change owner, justification.
13. Distribution and obsolete-copy control — who held the previous version, how it was retrieved.

The single most common SOP failure mode in inspections is not absence — almost every site has SOPs — but ambiguity. A step that says "mix for an appropriate time" leaves the operator to guess and the inspector to write a finding. A step that says "mix at 60 rpm for 15 minutes ±30 seconds, verify by visual homogeneity" leaves no room.

1. Draft. Subject-matter expert authors against a controlled template, often through an authoring wizard or QMS interface.
2. Technical review. Functional reviewer checks accuracy, completeness, step ambiguity, alignment with parent SOPs and regulations.
3. QA review. Quality reviewer checks compliance, training impact, change-control linkage, document numbering, format.
4. Approval. E-signature by designated approver (and second approver for critical SOPs). 21 CFR 11.100 / 11.200 binding.
5. Effective date. Scheduled in the future to allow training rollout.
6. Training rollout. Affected roles assigned, training material prepared, training completion tracked. 21 CFR 211.25, 820.25.
7. Effective. Becomes the version of record. Previous version moves to obsolete. Kiosk / MES picks up the new version.
8. In use. Followed in production. Deviations from the SOP become formal deviations (211.192).
9. Periodic review. Every 1–3 years depending on criticality. Even unchanged SOPs need formal review and re-effective entry.
10. Revision triggered. Change control opens new draft, full cycle repeats.
11. Retirement. SOP fully superseded or no longer applicable. Marked obsolete, retention copy held per record-retention schedule.

Most regulated organisations run SOP review cycles of 24 or 36 months for general procedures and 12 months for critical ones. The cycle is not optional — an SOP last reviewed five years ago is a routine 483 finding. Modern QMS platforms automate the reminder, but the formal review still needs a qualified human.

An SOP that becomes effective before staff are trained on it is worse than the previous version. Every regulated framework — 21 CFR 211.25, 820.25, ISO 13485 §6.2, ICH Q10 §2.7 — requires that personnel be qualified by training, experience or both before they perform the work. The mechanism is almost always training records: operator acknowledges they have read and understood the SOP, signed and dated; training matrix shows the role / SOP / current version intersection.

The hard test is whether the system enforces it at the moment of work. A paper-based system relies on the supervisor to check the matrix; a kiosk-based MES can hard-block: the operator with overdue assigned training on the current effective version simply cannot start the task. That is the difference between an SOP system that produces paper and one that produces compliance.

21 CFR 820.40(b) and ISO 13485 §4.2.4 explicitly require that obsolete documents be "promptly removed from all points of use, or otherwise prevented from unintended use". This is one of the oldest sources of 483s and audit findings: the laminated SOP page taped to the wall is two versions out of date, and the operator was following it.

Paper-based document control fights this constantly — controlled-copy stamps, controlled distribution lists, periodic floor walks, retrieval logs. Electronic SOPs solve most of it structurally: the system serves only the current version, obsolete versions are flagged and locked, and printing is either disabled or watermarked with "uncontrolled copy" plus the print timestamp.

The remaining failure mode in electronic systems is the gap between the document being electronic and the operator executing on paper. The operator who prints "because the kiosk wasn't working" is the operator following last week's version. Modern MES / kiosk integration eliminates that gap by making the kiosk the authoritative execution surface, not just a viewer.

• Procedure not followed — operator action diverges from the controlled SOP, no deviation raised.
• Procedure inadequate — SOP exists but is too vague to be followed consistently ("mix for appropriate time").
• Training not current — operator performing a task without acknowledgement of the current version.
• Obsolete version in use — superseded SOP still in circulation.
• SOP not approved — change made to the document without going through the full approval cycle.
• Annual review not performed — SOP past the documented review cycle without formal action.
• No SOP for a critical operation — the activity is performed without any written procedure.
• Procedure conflicts with parent SOP or regulation.
• Forms referenced in the SOP not under document control.
• Revision history incomplete — change made but not summarised in the revision log.

FDA publishes 483 observations and warning letters publicly. A quick scan of any year's pharma warning letters will show 30 to 50 % include at least one SOP finding. Devices and food show similar rates. The fixes are not technical; they are operational discipline that the document-control system enforces.

• Write for the person who will execute it, not the regulator who will audit it. Both will read it.
• One action per numbered step. Multi-action steps are where operators drift.
• Use imperative voice: "Weigh", not "the operator should weigh".
• Embed acceptance criteria in the step: "Mix at 60 ± 5 rpm for 15 minutes ± 30 seconds."
• Decision points explicit: "If the result is outside spec, go to step 8.3 (OOS handling). If within spec, proceed to step 8."
• Reference forms by document number — not by descriptive name only.
• Cross-reference parent and child SOPs by number and version. "See SOP QC-014 (current version)" beats "see the OOS SOP".
• Define every term that has a specific operational meaning. "Approved" means signed by QA — say so.
• Walk the procedure with the operator who will execute it before approving. If they cannot follow it as written, fix it.
• Avoid the words "appropriate", "adequate", "sufficient", "reasonable" — they leave room the regulator will exploit.
• Show, not tell, where possible. Photo, diagram, table beats paragraph.
• Keep the SOP as short as the work allows. A 40-page SOP that nobody reads is worse than a 4-page one that everybody does.

The architectural shift over the last decade is that the SOP is no longer just a document people read before starting work. In a modern execution stack, the SOP becomes the kiosk script: each numbered procedural step is a kiosk screen, each acceptance criterion is enforced at the input field, each decision point is a branch, each record is a captured field on the BMR / DHR, each deviation is a structured event linked back to the SOP version in force.

This integration eliminates the perennial gap between procedure and execution. The operator cannot accidentally skip step 5; cannot enter a weight outside acceptance without raising a deviation; cannot proceed if the equipment is out of calibration; cannot sign off if their training is overdue. The SOP becomes the program the MES runs, not a paper reference the operator may or may not follow.

V5 Ultimate ships SOP authoring, approval, training, distribution and execution as one closed loop. The authoring wizard enforces structural completeness per industry profile; technical and QA reviewers route through a controlled cycle with Part-11 / Annex-11 e-signatures; the approval establishes the effective date; training rollout assigns the affected roles automatically; the kiosk picks up the new version on the effective date and hard-blocks any operator without current acknowledgement. The controlled procedure becomes the operator's execution surface, not a separate paper reference.

Periodic review reminders fire ahead of the next-review date; revisions open a controlled change-control with impact assessment on in-flight work; obsolete versions are flagged and locked. The full audit trail of every authoring change, every approval, every training acknowledgement, every operator execution against each SOP version is one query away — the inspector asks "who was trained on SOP QC-014 v3 at any point in 2025?" and the answer is in the system without preparation.