Standard Operating Procedure

« Back to Glossary Index

What it is

Standard Operating Procedure (SOP) is a controlled document that defines the steps, roles, records, and acceptance criteria to execute a process consistently and compliantly. In medical devices, SOPs underpin the Quality Management System and show how the company meets regulatory and standards requirements (EU MDR Art. 10(9); ISO 13485:2016 §4.2, §5–§8; FDA 21 CFR 820/QMSR).

Controlled documentConsistent executionAudit-ready evidence

Regulatory framework

  • EU (MDR): Manufacturers must maintain a QMS with documented procedures covering processes such as risk, PMS, and vigilance (MDR Art. 10(9); Annex I; Chapter VII).
  • US (FDA): QMSR/21 CFR 820 requires procedures for document control (§820.40), training/qualification (§820.25), production/process control (§820.70), purchasing (§820.50), CAPA (§820.100), complaint handling (§820.198), and more.
  • Standards: ISO 13485:2016 requires documented processes and records across design, purchasing, production, servicing, and improvement (e.g., §4.2.1–§4.2.5, §6.2, §7, §8). Risk procedures align with ISO 14971.

Key elements

  • Scope & purpose: What the SOP covers and why it exists; references to laws/standards.
  • Roles & responsibilities: Process owner, doer, reviewer, approver, and QA.
  • Procedure steps: Clear, sequenced actions with decision points and acceptance criteria.
  • Records & forms: What to complete, where stored, and retention time.
  • Interfaces: Inputs/outputs and links to related SOPs, WIs, and templates.
  • Controls: Change control, training requirements, and effectiveness checks.

Process — lifecycle

  • Author: Draft the SOP using the corporate template; cite applicable MDR/ISO/FDA clauses and define metrics.
  • Review: Cross-functional review for clarity, feasibility, and compliance; resolve conflicts with adjacent procedures.
  • Approve & issue: Gain controlled approval; assign version, effective date, and distribution in the DMS.
  • Train & implement: Train affected personnel and, where needed, qualify competency before the go-live date (ISO 13485 §6.2; 21 CFR 820.25).
  • Execute & record: Follow steps as written; complete required forms and store records per retention rules.
  • Monitor & improve: Trend KPIs, audits, deviations, and CAPA; then revise under change control.

Common pitfalls

  • Overlong text without clear roles or acceptance criteria, which invites inconsistent execution.
  • Procedures that conflict with linked SOPs or actual practice (audit finding risk).
  • Training recorded but competency not verified for critical tasks.
  • Poor change control: uncontrolled templates, obsolete versions in circulation.
  • Records undefined or incomplete, weakening objective evidence.

Quick checks

  • Can a trained user run the process using only this SOP and its attachments?
  • Do steps map to applicable MDR/ISO/FDA clauses and internal KPIs?
  • Are records, forms, and retention clearly specified and accessible?
  • Is there a defined review cadence and a measured effectiveness check?

FAQ

Are SOPs mandatory?

Effectively yes. MDR Art. 10(9) and ISO 13485 require documented processes; FDA 21 CFR 820 expects written procedures for key activities such as CAPA, complaints, purchasing, and production.

How do SOPs differ from work instructions (WIs)?

SOPs define the process (who/what/when/records). WIs give task-level detail (how to do a specific step). Use SOP → WI → form hierarchy for clarity.

How often should we review SOPs?

At planned intervals or upon triggers such as audit findings, CAPA, regulatory changes, or metrics trending out of limits. Many firms use 1–3 year cycles.

Can we manage SOPs electronically?

Yes. Use a controlled DMS with versioning, access control, and audit trails; if using e-signatures and e-records, align with applicable requirements (e.g., 21 CFR Part 11) and your validation policy.

How should we handle deviations?

Define a deviation process in the QMS: pre-approval where feasible, immediate containment, documented rationale, impact assessment, and CAPA where indicated.