SOP for ISO 9001: How to Document Processes for Certification [2026]
If you are preparing the company for certification — or fixing nonconformities from an audit — this page settles the three questions that most often stall documentation: what the standard actually requires, what the auditor looks for in an SOP and how to structure it without producing paperwork nobody uses.
What ISO 9001 actually requires
ISO 9001:2015 does not use the term "SOP" anywhere. What it requires is documented information (clause 7.5): the organization must maintain and control documentation to the extent necessary to support the operation of its processes (clause 8.1) and to have confidence that they are carried out as planned (clause 4.4).
That wording is deliberate: it is your organization that decides which processes need a document and at what level of detail. The practical criterion is risk — if the absence of a written standard can cause errors, rework, accidents or inconsistency in what the customer receives, document it. The SOP is simply the most established format for this in operational processes.
The important consequence: for-show documentation is worse than lean documentation. Twenty SOPs nobody opens generate more nonconformities (through divergence from practice) than six living SOPs the team knows and that match what actually happens on the floor.
What the auditor looks for in an SOP
In an audit, the SOP is checked on two fronts: form (is the document controlled?) and adherence (does practice follow the document?). The typical checklist:
-
Identification and control: code, version, date and approver visible. The employee accesses the current version — not a printed copy from two years ago.
-
Clear responsibilities: each step has an owner named by role (not by person). If the auditor asks "who approves?", the answer is in the document.
-
Executable steps: steps in imperative voice, with objective criteria ("check the invoice against the PO" instead of "verify the documentation"). Decisions with both paths described.
-
Adherence to practice: the auditor interviews whoever runs the process and compares it with the written document. This is where most nonconformities arise.
The 4 most common nonconformities
1. An outdated document in use
The process changed, the SOP did not. Obsolete printed copies circulating are a classic audit finding. Prevention: a revision history with an owner and a scheduled periodic review.
2. Practice that diverges from the document
The SOP describes an idealized process the team never followed. Prevention: write from what really happens (interviewing whoever runs it) and only then standardize improvements.
3. Ambiguous responsibility
"The department arranges it" does not say who does it. Prevention: one owner per step, named by role — exactly what the lanes of a BPMN flowchart make visible.
4. A required record that does not exist
The SOP says "record it in form X" and the form has not been filled in for months. Prevention: only require records that have real use — and check before the audit.
An SOP structure suited to ISO 9001
A structure that covers what clause 7.5 asks for (identification, format, review and approval) and what the auditor checks: an identification header with version, objective and scope, responsibilities by role, steps in a Step / Action / Notes table, risk & quality notes and a revision history. We break down each section in the SOP template for Word — or generate one filled in:
$4 in free credits on sign-up · no card · the SOP comes with version, responsibilities and revision history
The role of the flowchart in documentation
The process approach (clause 4.4) asks the organization to determine the sequence and interaction of its processes — and nothing communicates sequence and interaction better than a flowchart with lanes by owner. It also speeds up the audit itself: the auditor understands the process in a minute and goes straight to the checks.
See how they look in practice: browse the process flowchart examples, learn how to make a process flowchart or explore the gallery with the complete SOPs — procurement with an approval threshold, onboarding and support ticket handling, all with mapped decisions and two possible outcomes.
How to speed up without losing quality
The bottleneck in ISO documentation is never the knowledge — it is the time to turn what the team knows into a standardized document. That is exactly the step FluxoGen automates: you describe the process in plain text (or interview whoever runs it and paste the notes) and get the BPMN flowchart with lanes by owner and the SOP in Word with steps in imperative voice, responsibilities and risk & quality notes.
The document comes out as a qualified draft: validation with the team that runs the process — the step that guarantees adherence in the audit — remains yours. But the 2–4 hours of writing per process turn into minutes of review.
$4 free on sign-up · complete SOP from $1.40 · automatic refund if generation fails
Frequently asked questions
Does ISO 9001 require SOPs?
Not by name. The standard requires "documented information" (7.5) to the extent necessary to support operations (8.1). SOPs are the most common way to meet this in operational processes — but which processes to document, and in what detail, is your decision.
How many SOPs do I need to get certified?
There is no minimum number. Document where the lack of a standard creates real risk. A few living, followed SOPs are worth more than dozens for show — auditors notice the difference.
Will an auditor accept an AI-generated SOP?
The auditor evaluates content and adherence to practice, not the writing tool. An SOP generated by AI and validated by whoever runs it is as valid as a manual one. What fails is a document that does not reflect the real operation.
What is the difference between an SOP, a procedure and a work instruction?
A procedure describes the flow (who does what, in what order); a work instruction details a specific task; the SOP sits between the two. For ISO 9001 they are all "documented information" — the hierarchy is your organization's convention. See the recommended structure in the guide on how to write an SOP.