How to write a GMP SOP people actually follow

To write a GMP SOP people actually follow, describe one process as it is really performed, in numbered imperative steps of one action each, with clear owners, explicit decision points and the records each step produces. Then route it through review and approval, train the people who use it before its effective date, and review it periodically so it never drifts away from practice. The regulations say surprisingly little about format, but they are firm that procedures must be approved, controlled, unambiguous, current and followed. A well-structured SOP is simply the easiest way to meet all five.

This guide covers what the main GMP texts require, a section-by-section structure with a copyable skeleton, how to write steps for the people on the floor, and the pitfalls that make inspectors look harder.

What GMP requires of a procedure

EU GMP Chapter 4

EudraLex Volume 4, Part I, Chapter 4 (Documentation, in force since 30 June 2011) is the most specific source. Its introductory section defines procedures, "otherwise known as Standard Operating Procedures, or SOPs", as documents that give directions for performing certain operations, and distinguishes instructions from records. The key clauses for SOP authors:

• Section 4.2: documents are designed, prepared, reviewed and distributed with care.
• Section 4.3: instructions are approved, signed and dated by authorised persons, have unambiguous content, are uniquely identifiable and have a defined effective date.
• Section 4.4: instructions are laid out in an orderly fashion and easy to check, and SOPs are written in an "imperative mandatory style".
• Section 4.5: documents are regularly reviewed and kept up to date.
• Section 4.29: lists areas that need written procedures, including validation, calibration, cleaning, training, complaints, recalls, change control, deviation investigations, internal audits and supplier audits.
• Section 4.32: an inventory of documents within the quality management system is maintained.

A revised Chapter 4 was published for public consultation, together with a revised Annex 11 and a new Annex 22, from 7 July to 7 October 2025. Until a final version is adopted, the 2011 text remains the reference, but the draft's emphasis on data governance across all document formats is worth reading.

FDA 21 CFR Part 211

For US drug manufacturing, 21 CFR 211.100(a) requires written procedures for production and process control, and requires that they and any changes be drafted, reviewed and approved by the appropriate organisational units and reviewed and approved by the quality control unit. Section 211.100(b) requires those procedures to be followed, documented at the time of performance, and any deviation recorded and justified. Section 211.22(d) applies the same rule (in writing, and followed) to the quality unit's own procedures, and 211.25(a) requires that staff be trained in the written procedures that relate to their functions.

ISO 13485 for medical devices

ISO 13485:2016 clause 4.2 sets the documentation requirements for device manufacturers, and the control of documents clause (4.2.4) expects documents to be reviewed and approved before issue, reviewed and re-approved when updated, to show their current revision status, to be available at points of use, to remain legible and identifiable, and to be protected against unintended use when obsolete. Since 2 February 2026, the FDA's Quality Management System Regulation (21 CFR Part 820) incorporates ISO 13485 by reference.

Notice what none of these texts prescribe: a specific template, a maximum length or a fixed list of headings. The structure below is common practice, not a legal requirement, but it maps neatly to the obligations above.

Before you write: settle the scope

Many unusable SOPs fail before the first step is written. Settle three things first.

• One process, one owner. An SOP called "Warehouse operations" will be either too vague or eighty pages long. "Receipt and quarantine of starting materials" is a process with a clear start, end and owner.
• The right document type. Many systems use a policy for the why, an SOP for the who and what across a process, a work instruction for detailed how-to at one workstation, and a form or template for the record. Putting all four into one document is a common reason SOPs become unreadable.
• The actual users. Write for the least experienced trained person who will perform the task, not for the author or the auditor. Involve at least one of them in drafting.

A section-by-section SOP structure

Header and document control block

Document number, title, version, effective date, author, reviewers and approvers with dates (or a reference to the electronic approval record), and the page "x of y" on every page. This is what makes the document "uniquely identifiable" with a "defined effective date" as Chapter 4 section 4.3 requires.

Purpose

One or two sentences on why the procedure exists. If you cannot write it in two sentences, the scope is probably too wide.

Scope

What the procedure covers and, just as important, what it does not. Name the site, area, products, equipment or systems. Exclusions prevent the classic inspection exchange: "Does this SOP apply to the second packaging line?" "Well..."

Responsibilities

Roles, not names, and what each role does in this procedure. Every responsibility listed should appear in the steps, and every role in the steps should appear here. Include who is accountable for the procedure itself.

Definitions and abbreviations

Only terms a trained user might misread. Link to a glossary for everything else.

Procedure

The numbered steps, grouped under short subheadings that follow the order of the work. This is the section operators read; the rest of the document exists to support it. Writing guidance follows below.

Records

Every form, log or electronic record the procedure generates, where it is kept and who reviews it. Records are how you prove the SOP was followed, so they deserve their own section.

References

Related SOPs, forms, regulations and standards, by document number. Keep regulatory references specific (for example "EU GMP Chapter 4, section 4.29") so reviewers can check them.

Revision history

Version, date, a meaningful summary of what changed and why, and the change control reference. "Updated" is not a summary. "Step 6.3: hold time reduced from 72 h to 48 h following CC-2026-031" is. This is the link that lets an inspector move from the SOP to its justification; our guide to change control traceability covers the other end of that link.

A copyable SOP skeleton

Use this as a starting point and adapt the headings to your own document procedure:

• Header: document number, title, version, effective date, owner, page x of y
• Approval block: author, reviewers, QA approver, each with signature and date
• 1. Purpose: why the procedure exists, in one or two sentences
• 2. Scope: what is covered, what is excluded, where it applies
• 3. Responsibilities: each role and what it does in this procedure
• 4. Definitions and abbreviations: only terms users could misread
• 5. Safety and precautions: hazards, PPE and critical warnings that apply throughout
• 6. Materials and equipment: what must be ready before starting
• 7. Procedure: numbered imperative steps grouped by stage, with decision points
• 8. Records: forms and logs produced, storage location, reviewer
• 9. References: related SOPs, forms, regulations and standards
• 10. Revision history: version, date, summary of change, change control reference

Sections 5 and 6 are optional, but they keep warnings and preparation out of the procedure steps.

Write steps for the people doing the work

Chapter 4 asks for an imperative mandatory style, and that is also the style that works on the floor. Some practical rules:

• Start each step with a verb. "Record the batch number on Form F-112." Not "The batch number should be recorded."
• One action per step. If a step contains "and then", split it. Operators sign or tick steps, and one step with three actions creates three chances to miss one.
• Make decision points explicit. "If the seal is damaged, quarantine the container and raise a deviation. If the seal is intact, continue to step 7.4." Never leave a branch implied.
• Give numbers, units and tolerances. "Mix for 10 min ± 1 min at 200 rpm", not "mix thoroughly".
• Put warnings before the step they apply to, not after it.
• Avoid "as appropriate", "if necessary" and "regularly" unless the SOP defines who decides and on what basis. Otherwise the decision falls to whoever is on shift.
• Use the same name for the same thing. If the equipment label says "Mixer M-03", do not call it "the blender" in step 4.
• Reference, do not repeat. If another SOP covers line clearance, refer to it by number instead of copying its steps, which will drift out of date.

An illustrative before-and-after for a single instruction. Before:

Equipment should be cleaned appropriately prior to use and this should be documented.

After:

• 7.1 Check the status label on Mixer M-03.
• 7.2 If the label shows CLEAN and the clean hold time has not expired, record the label number on Form F-112 and go to step 7.4.
• 7.3 If not, clean the mixer according to SOP-CLN-004, then go to step 7.1.

Length matters too. There is no regulatory limit, but if a trained operator cannot find the step they need within a few seconds, move detail into work instructions or forms.

Review, approval, training and the effective date

A GMP SOP goes through a defined path before anyone uses it:

1. Draft with input from the people who perform the task.
2. Review by subject matter experts and affected departments, with comments recorded and resolved.
3. Approve by authorised persons, including the quality unit, with signatures and dates as 21 CFR 211.100(a) and Chapter 4 section 4.3 require.
4. Train everyone affected on the new or revised version. Set the effective date far enough after approval that training can be completed first. A read-and-understood acknowledgement may suffice for a minor clarification; a new method usually needs practical training and an assessment. A role-based GxP training matrix makes it clear who must be trained on which SOP.
5. Make effective, and at the same moment withdraw the previous version from every point of use.

Training before the effective date is not spelled out word for word in every regulation, but the logic is unavoidable: 211.25(a) requires training in the written procedures relevant to each person's work, and an operator following a procedure they have not been trained on is an easy finding.

Periodic review, version control and obsolete copies

Chapter 4 section 4.5 requires documents to be regularly reviewed. Set a fixed interval in your document control procedure (for example every two or three years) and consider a shorter one for high-risk procedures. The interval is your choice; meeting it is not. A periodic review should check that the SOP still reflects how the work is done, takes account of deviations, CAPAs and changes since the last version, and still references current documents. The review itself should be recorded, even when the outcome is "no change".

Version control is where paper systems tend to struggle. An inspector who finds a superseded SOP in a binder at a workstation has found a document control failure, whether or not anyone used it. Practical controls:

• Keep a master list of every controlled document with its current version (Chapter 4 section 4.32).
• Control printed copies: number them, record where each one is, and retrieve them when a new version becomes effective. Many sites mark uncontrolled prints with a short validity, such as "valid on date of printing only".
• Retain superseded versions in an archive, clearly marked as obsolete, so you can show which version was in force on any past date.

If your SOPs live in shared folders, our comparison of an eQMS and SharePoint for GMP looks at where those controls tend to break down.

Common pitfalls

• Describing the ideal instead of the actual process. If operators have found a better way, either adopt it through change control or retrain. An SOP that nobody follows produces unrecorded deviations, which 21 CFR 211.100(b) requires you to record and justify. See our guide to GMP deviation management.
• Writing for the auditor. Pages of regulatory background push the steps operators need further down. Keep background in the purpose section or a policy.
• Too long, too broad. One SOP per process; detail in work instructions.
• Unclear owners. "Production will ensure..." does not say who. Name the role.
• Copy-and-paste from another site or a template without adapting equipment names, forms and responsibilities.
• Training as an afterthought. Effective dates set to the approval date leave no time to train.
• Revision history that says nothing. "Periodic review update" tells an inspector nothing about what changed or why.

What inspectors check

When an inspector picks up an SOP, these are the questions to be ready for:

• Is this the current approved version, and is it the one in use at the workstation?
• Who approved it, when, and was the quality unit involved?
• Were the people performing the task trained on this version before its effective date?
• Do the records show the procedure is followed as written?
• Do deviations reveal steps that are routinely not followed?
• When was it last reviewed, and what changed?
• Where is the change control record for the last revision?

Making SOPs easier to maintain

A good SOP is short, specific, owned and current, and its history can be traced. The writing is the author's job; the control around it is a system's job. An eQMS such as QFacts supports that control with SOP templates, multi-level review and approval with electronic signatures, version history and audit trail, periodic review reminders and controlled distribution with read acknowledgements in document management, with training assigned automatically when a document is published through training management. You can try it on one of your own procedures with the 14-day free trial on the pricing page.