Creating standard operating procedures for QM

In a standard operating procedure (SOP), companies define their processes, for example how they develop medical devices or provide services.

Standards such as ISO 9001 and ISO 13485 require standard operating procedures. Companies can define these specifications in their quality management manual directly or in independent documents.

1. Standard operating procedures, introduction, definitions

a) Definition

ISO 9000 defines a procedure as follows:

Definition: Procedure

“Specified way to carry out an activity or a process”

Source: ISO 9000:2015 3.4.5

ISO 9000 defines a process as follows:

Definition: Process

"Set of interrelated or interacting activities that uses inputs to achieve an intended output."

Source: ISO 9000:2015 3.4.1

A standard operating procedure thus documents how a company (e.g., a manufacturer) intends to carry out an individual activity or a process (set of activities). The terms standard operating procedure and process description are to be understood synonymously.

b) Process description versus standard operating procedure

Based on the above definitions, a standard operating procedure is equivalent to a process description when describing several interrelated or mutually influencing activities

A process description includes the description of the entire process, e.g., software development process. It defines phases, roles and activities. For example, it requires a software system test at the end of development. How, i.e., with which methods, these tests are carried out (e.g., with equivalence classes) can be part of a referenced work instruction or standard operating procedure.

c) Differences between work instructions and standard operating procedures

Work instructions and standard operating procedures differ concerning several aspects:



Standard operating procedure

Work instruction

Affected roles

Usually several

Usually one


Many work steps. The standard operating procedure refers to the work instruction for the individual work step. You mention the tools to be used without describing their operation.

Fine-grained description of a work step, including precise instructions on how to use tools.

Duration of the activity

The procedure often cannot be completed in one step and without interruption.

A work instruction describes an activity that can usually be completed without interruptions or dependencies.


Process owner

Persons performing the activities.

Training and use

Standard operating procedures are trained. They serve as a reference for understanding processes.

Work instructions are available at the location of the activity.

Table 1: Difference between work instructions and standard operating procedures

2. What should a standard operating procedure contain?

a) Content

The standard operating procedure should describe:

  • role(s),
  • actions,
  • methods,
  • aids and tools,
  • order (e.g., sequentially, in parallel),
  • inputs and
  • outputs.


If the description of the activity and method is more comprehensive, we recommend moving this to a work instruction.

In contrast to a work instruction, a standard operating procedure generally describes a required sequence of activities that are often performed by several people.



b) Meta information

A good standard operating procedure should describe the following at the meta level:

  • Clear identification of the standard operating procedure, e.g., document ID
  • Standard operating procedure version
  • Author(s)
  • Responsible people
  • Scope
  • Objective
  • Change history

3. Content standard operating procedures

a) Chapter structure

Johner Institute consultants and auditors generally use the following chapter structure

  1. Meta information
    • Purpose
    • Scope
    • Responsibilities
    • Adressees
    • Distribution list
    • Process owner
    • Training
    • Performance indicators
  2. General information (optional)
  3. Process description
    • Overview (e.g., flow chart)
    • Step 1
      • Input
      • Description of the activity
      • Output
    • Step 2 – n (same)
  4. Annex
    1. Referenced documents
    2. Version history


Use flow charts. They give you a quick overview.

b) Description of the procedures

Graphical description

Various modeling languages such as UML activity diagrams, BPMN and classical flow charts can be used. Numerous tools, including free tools (e.g.,, are available.

Fig. 1: Example of Flowchart in a SOP

Tabular description

Tables are an alternative way of showing the information. These are only suitable for sequential processes.








Use scenarios
Stakeholder requirements

Specification of the software requirements

Software requirements specification.

User interface designer


Table 1: Example of section of a tabular description of a procedure

4. List of standard operating procedures

a) Overview of the regulatory requirements

The requirements which SOPs manufacturers have to define and follow can be found in these regulations, among others:

  • ISO 13485
  • MDR and IVDR
  • FDA 21 CFR part 820 (which again refers to ISO 13485)

b) ISO 13485

Standards, such as ISO 13485, requires companies to [have] procedures, such as document control, design and development planning, procurement and corrective actions.

Fig. 2: Standard operating procedures required by ISO 13485. Our free starter kit contains this mind map as an enlargeable PDF.

A more general list of the procedures required in given in English below:

  • Validation of the application of computer software used in the quality management system
  • Control of documents
  • Control of records
  • Management review
  • Design and development including transfer of design and development and control design and development changes
  • Purchasing
  • Procedures and methods for the control of production
  • Servicing (if applicable)
  • Validation of processes for production and service provision including validation of the application of computer software
  • Validation of sterilization and sterile barrier systems (if applicable)
  • Product identification
  • Traceability.
  • Preserving the conformity of product
  • Control of monitoring and measuring equipment including validation of the application of computer software
  • Feedback
  • Complaint handling
  • Reporting to regulatory authorities
  • Internal Audits
  • Monitoring and measurement of product
  • Control of Non-Conforming Products
  • Analysis of data
  • Corrective Actions
  • Preventive Actions

Further information

The free starter kit includes the above mind map and an infographic that tells you the standard operating procedures that you have to complete or revise to fulfill the requirements of ISO 13485:2016.

Strictly speaking, these standards (e.g., ISO 13485) require that the manufacturers

  • define,
  • document (in writing!), This is then the standard operating procedure),
  • implement,
  • provide training on and
  • maintain

all the above procedures.


Note that ISO 13485 requires many other activities, but they do not necessarily have to be described by a standard operating procedure.

b) MDR and IVDR versus ISO 13485

MDR resp. IVDR requires fewer standard operating procedures than ISO 13485.  On the other hand, there are procedures that manufacturers must define according to MDR and IVDR, which ISO 13485 does not mention explicitly, for example, risk management.

It should be noted that ISO 13485 does require risk management as an activity.

Conclusion: If you act in accordance with the current edition of ISO 13485, you fulfill the essential quality management requirements of MDR and IVDR, Article 10 and Annex IX.

5. Other

a) Standard operating procedures as part of the QM manual?

There are arguments in favor of integrating these standard operating procedures directly into the  QM manual, and there are arguments against it. Arguments against the integration of standard operating procedures into the quality management manual are:

  1. Separation of confidential and non-confidential content
    A lot of manufacturers want to proudly present their QM manual to the outside world. If this manual contains in-house know-how, this is not possible. The problem does not occur if there are separate standard operating procedures.
  2. Interchangeability of standard operating procedures
    Development service providers, in particular, are often forced to develop according to their customers' specifications. This is easier for them if they use the customer's SOPs rather than their own. Not having their SOPs in their QM manual means that the QM manual is not affected by this.
  3. Quicker approval
    It is easier to make changes to standard operating procedures because not every change requires a new release of the  QM manual, which can be time-consuming, especially for large companies. Component separation sometimes also makes sense in the document landscape.

But separating the QM manual and SOPs is not always the best solution. Small companies with only one or a few products are sometimes better served by an integrated document set.

Are you unsure which option is best for you? Please feel free to contact us. We're happy to help.

Contact us now

b) Abbreviations in the standard operating procedure

Common abbreviations are often used in the standard operating procedure to clarify the document. All abbreviations used should be noted separately in a document. Examples:

  • Mgmt: Management
  • EO: Environmental Officer [Dt: UB: Umweltbeauftragter]
  • EM: Environmental Management [Dt: UM: Umweltmanagement]
  • SOP: standard operating procedure
  • WI: Work instruction [Dt: AA: Arbeitsanweisung]
  • QM: Quality management


Prof. Dr. Christian Johner

Find out what Johner Institute can do for you

A quick overview: Our


Learn More Pfeil_weiß

Always up to date: Our


Learn More Pfeil_grau

Privacy settings

We use cookies on our website. Some of them are essential, while others help us improve this website and your experience.