Writing and Enforcing Your SOPs for GxP Compliance Success - for Quality Professionals

"Say what you do, do what you say and be able to prove it."

This paper addresses the fundamentals of writing and enforcing your SOPs not only for compliance and in accordance with internal company policies and requirements but certainly for ensuring compliance with FDA requirements as well.

Typical definitions include the procedures and processes that you utilize and operate under. These procedures and processes have been standardized to ensure they are done the same way every time. A "clearly written description of how specific tasks are to be done." Another satisfactory definition would be "detailed written instructions that achieve the uniformity of the performance of a specific function."

Is the firm doing what the regulations specify? Is the firm doing what their procedures specify?

If you are medical device or a pharmaceutical manufacturer, these definitions come as no surprise because when it comes to FDA regulations and guidance documents "establish" means to define, to document (in writing or electronically) and to implement. The goal and emphasis with FDA is simple.


This article is related to the White Paper:
SOP Management as a Compliance Tool in FDA and ISO Environments.
To get the full details, please download your free White Paper.

Proof of "Establish"

  • Is the firm doing what the regulations specify?
  • Is the firm doing what their procedures specify?

There are innumerable examples of FDA-483s and Warning Letter citations that relate to procedures (or the lack thereof) that occur within life science manufacturing environments across the global landscape. Recent observations reflect, for example, that a company failed to establish and maintain procedures for implementing corrective and preventive action, including requirements for analyzing complaints. Another company failed to establish and maintain procedures to address the identification, documentation, evaluation, segregation, disposition and investigation of nonconforming product.

Yet another company failed to establish procedures for quality audits, as required by 21 CFR Part 820.22.For example, a firm may not have any quality audit procedures in place to assure that the quality system is in compliance with the established quality system requirements and to determine the level of effectiveness of the quality system. Audits may also not have taken place.

If you take a commonsense approach and look at what is necessary to maintain control of your operations and then add in the extra requirements to ensure compliance, you will have a well-documented system that can be controlled and maintained with a minimum amount of paperwork.

Drafting SOPs that are too restrictive and hard to follow or document is asking for trouble. What is amazing (and ironic) is that many companies have "decent" procedures that are deployed and have been implemented within their quality management systems. However, they just don't enforce what they have already created and instituted.

  1. First, determine what SOPs are necessary
  2. If possible, have the employee responsible for the SOPs draft them
  3. Make sure the SOPs are understandable
  4. Make sure the SOPs match the procedures
  5. Keep the SOPs succinct where possible
  6. Train the staff to the SOPs
  7. Audit the SOPs to make sure they are being implemented correctly
  8. When making changes to the document, make sure that it has the correct revision
  9. Remove all out of date SOPs, including ones in employee desks
  10. If your SOP has written notes, it is not a good SOP

Plan for Results

Standard operating procedures work best when they are designed to achieve specific results. Decide what business goals will be achieved through better management with SOPs and how those goals will be measured. Many benchmarks exist in the industry to help measure quality and efficiency in specific areas.

Produce a First Draft

Select a format for the procedure (see table 1). If you choose to use simple steps, hierarchical steps or the graphic format, first make a detailed list of the steps in the order that they are to be accomplished. A simple way to get started is to observe someone performing the process as it now exists and write down everything that the person does. This list is now a draft of the procedure.

If the procedure needs to appear as a flowchart, start with the most reasonable starting point. Draw the decisions that a worker will need to make and the actions that follow each decision. Don't try to write everything perfectly as you create the first draft because it is almost certain you will have to make subsequent revisions anyway.

Table 1
Many decisions? More than 10 steps? Best SOP format
Simple Steps

Conducting an Internal Review

Provide each worker who performs the procedure with a copy of the SOP draft. Ask the workers to review and suggest changes that will make the procedure easier to understand or that will improve accuracy or performance. Assure the workers that their input is important and will be utilized. People are much more likely to accept and use an SOP if they feel a sense of ownership for it.

Another reason to involve the workers is that they are likely to have good ideas. Highly successful managers actively engage their work teams in a continual quest to become more efficient, increase cost-effectiveness and improve quality.

Conducting an External Review

Managers increasingly rely on advisers outside their own organizations. The SOP writing process is an excellent way to tap into the expertise of your advisers. Provide them with a copy of the SOP draft. Ask them to suggest any changes that will make the SOP clearer and more effective. Revise the procedure as necessary to incorporate their input.

Testing SOPs

For procedures to be effective, they must be performed in the workplace. There is only one way to be absolutely certain that a procedure is well written and performs as expected. Have someone test the procedure by performing each step exactly as it is described while the writer of the SOP observes. In addition, it is good to ensure that a person who is not familiar with the work follow the procedure. Any steps that cause confusion or hesitation for this "test worker" should be subject to revision.

Posting SOPs

Make a final draft of the procedure and post it in appropriate locations throughout the work environment. A master SOP file should be kept in a central location so workers can review little-used SOPs when necessary. It is essential to keep SOPs up-to-date.


One of the last steps in the SOP writing process is often the most neglected. Training or retraining workers to follow revised procedures is essential. If training and retraining doesn't happen, individuals will interpret the meaning of procedures in different ways, leading to inconsistency in work routines and inconsistent performance.

An effective SOP training program will first make the worker aware of what training activities will take place and what he she will be able to accomplish when training is complete. The trainer should explain and demonstrate both why and how each step in the SOP is performed and then give the learner a chance to practice.

The trainer should also provide positive feedback as the learner masters the procedure and patiently revisits those parts that need improvement.


An audit will show whether the SOP procedures are being adhered to and whether the objectives are being met. It can also help identify areas where improvements can be made.Each SOP should be audited about three months after implementation and thereafter at least annually, but annual audits are discretionary and should be determined by the company in question and by its compliance history. In addition, the SOP should be audited when dispensing errors or when "near misses" occur. These audits will help to identify ways of preventing their recurrence.

Developing and using operating procedures is a way of life. Well-written, organized and controlled procedures can help ease internal confusion, avoid product liability actions and reduce recalls. Think of your customers, patients and end-users, for example. What if something occurs that results in a serious injury or adverse health consequence (or worse)? What if a procedure was not followed? Mitigate your compliance and legal exposure by following and enforcing all policies and procedures.

It is important to have a defined and deployed system to manage process and documentation changes and to assist in maintaining control within both the quality system and the organization as a whole. Therefore, firms must "establish and maintain" procedures. To do so, companies should define, document (either on paper or electronically) and implement standard operating procedures (SOPs).

Companies must then follow up, review and revise these documents as needed. The intent here is simple: Companies must ensure that their respective organizations develop and manage operationally sound procedures that are compliant with the law (i.e, FDA) and with other enforcement bodies as necessary. Furthermore, it's important to ask whether your company is complying with your company's corporate policies as set forth by the executive management group.

During past, and certainly recent FDA inspections, the agency commonly observed that companies failed to keep accurate records and that they neglected to establish and maintain procedures. This is a recurring theme based on indicators.

SOPs (and the method by which process change is managed) serve as a fundamental means of communication for all levels of an organization. Not only do they engage employees on a departmental level but they also allow management and employees to gain a cross-functional view of the organization.

This SOP approach encourages employees to think about how process change may affect other functional areas. A good change-control system forces managers to think through processes and examine how changes might affect product, personnel, production, and equipment.

Procedures provide an opportunity to clarify processes to ensure that personnel understand said procedures and are trained appropriately. Having well-organized and detail-oriented documentation also ensures consistency on execution, which is especially important when more than one person is responsible for executing a process.

All companies experience change, especially in terms of personnel. Employees leave and are replaced. Business processes and strategies evolve. However, documentation can remain a stable tool as long as employees are taught to use consistent rules when developing and modifying company documentation. Writing procedures and subsequently maintaining them removes ambiguity from interpretations and helps clarify the "story" of a document for future reviewers.

One of the most common mistakes that regulated entities make when writing procedures is copying the regulation word for word, which results in a procedure that does not provide employees any instructions or tools for performing tasks.

Procedures should be made up of several sections, which at a minimum can include purpose, scope, definitions, background, associated and reference documents, responsibilities, revision history, and the actual steps of the procedure.

Procedures should begin with a purpose section, which defines what the procedure is going to describe (process, assembly, etc.). The purpose can additionally define the requirements being met by the particular procedure.

The scope of the procedure should describe to whom or to what the procedure applies. The scope of a document can be specific so that it includes only a subset of the employee population or process, or it can be general and include the entire organization, location or process.

A definition section is typically considered optional. However, it can be helpful with complex or technical documentation. Definitions are exactly as you would expect them to be: a dictionary or glossary of terms that are mentioned within the procedure. The background section is also considered optional and is a good place to tie in the quality and regulatory reasons (or associations) for the existence of the procedure.

The responsibilities section of the procedure defines who is responsible for the execution of the process both directly and indirectly. There can be several responsible parties associated with one procedure.

Both an individual (e.g, a training coordinator) and groups of people (e.g, management, the quality assurance department) can be responsible for a procedure. Do not call out specific employee names. It is better to address the responsible job title or function (e.g, document administrator).

Revision history allows an organization to review earlier versions of a procedure. The organization can also revisit methods and programs previously employed. Such tools enable firms to avoid duplicating mistakes or having to recreate processes.

Avoiding duplication and limiting the number of mistakes an organization makes can ultimately save money and time and reduce employee frustration. When developing the procedure section, describe how to execute the process in the same order that the tasks are performed.

Using flowcharts is a great way to explain process direction and is acceptable for communicating internal processes. Flowcharts should be used in conjunction with a textual description. The procedure section should give instructions for correctly completing (i.e, filling in blanks) the supporting forms and reference attachments. Include sufficient detail to ensure consistent execution of the task.

The next issue of GxP Lifeline will include the second part of Writing and Enforcing Your SOPs for GxP Compliance Success.

David R. Dills is a Quality & Compliance Advisor at MasterControl and an independentRegulatory & Compliance Consultant with an accomplished record. Dills has more than22 years of hands-on experience with emphasis on Class I/II/III medical devices, In Vitrodiagnostics, and pharmaceuticals in the areas of QA, Regulatory Affairs and Compliance. Since2000, Dills has provided consultative services on behalf of manufacturers, has subcontractedfor third-party consultancies and has provided services involving all key stages of the productdevelopment; submissions; commercialization process; inspection readiness preparation; GxPcompliance; audits/assessments; remediation/regulatory strategies; postmarketing surveillanceand vigilance reporting; clinical affairs; deployment and remediation; Quality Management;documentation systems; software validation; ISO 13485; CE Mark; and multi-countryproduct registrations. He has been previously employed by medical device firms and consultancies, including a globallyrecognized CRO.

Dills has served on the Faculty Advisory Board for the Pharmaceutical Training Institute and currently serves on the Editorial Advisory Boards for Software Quality Professional and the Institute of Validation Technology (IVT), publisher of the Journal of GXP Compliance and Journal of Validation Technology and on the Readers’ Board for Medical Device & Diagnostic Industry and Medical Product Manufacturing News and was accepted for inclusion into the 2005-2006 Strathmore's "Who's Who" of Professionals. Dills has published validation, regulatory and compliance-related articles and is an accomplished global industry presenter. Mr. Dills’ academic degrees include studies in Environmental Science and Biology. He is a former Chair and Co-Chair of ASQ’s Section 1506 and an active member of the Biomedical Division, RAPS, PDA, ISPE, and other industry working groups.