ISO 9001 SOP Format: What Clause 7.5 Requires and What the Auditor Actually Checks
The consultant arrives six weeks before the audit with forty SOPs on a pen drive. They are formatted beautifully. They describe a company that is not yours. The auditor, who has seen this many times, will spend twenty minutes on the format and two hours on whether anyone follows them.
ISO 9001:2015 does not prescribe an SOP format. It requires, under clause 7.5, that documented information be identified, in a suitable format, reviewed and approved, available where needed, protected, controlled for changes and retained. Any SOP that carries a title, unique number, version, approval names, revision history and a records section meets the format requirement. What the auditor actually tests is whether the procedure matches what happens and whether the records prove it.
This page gives the sections an ISO 9001 SOP needs, the clauses behind each, what the auditor checks, and how to avoid the pen-drive problem.
What ISO 9001:2015 actually requires of an SOP
The 2015 edition removed the 2008 requirement for a quality manual and the six mandatory documented procedures. It replaced them with the general term "documented information" and left the organisation to decide what needs documenting, based on the risk that undocumented work goes wrong.
Three clauses matter for SOPs.
Clause 7.5.2, creating and updating. Each document must be identified (title, date, author or reference number), be in an appropriate format and medium, and be reviewed and approved for suitability. This is where the title block, document number and approval names come from.
Clause 7.5.3, control of documented information. Documents must be available and suitable for use where and when needed; adequately protected; and controlled for distribution, access, retrieval, storage, change control, retention and disposition. This is where version control, the single master location and the revision history come from, and where "an old copy was still on the notice board" becomes a finding.
Clause 8.5.1, control of production and service provision. The organisation must have documented information that defines the characteristics of the product or service and the activities to be performed, and the results to be achieved. This is the requirement that the procedures exist for the work that affects quality.
Clause 7.2 adds that records of competence, meaning training, must be retained. In practice, each SOP has a training record showing who was trained on which version.
The ISO 9001 SOP format that passes
The standard nine sections satisfy the requirements above without adding anything. Mapped to the clauses:
Title block and document number — 7.5.2 identification.
Version, effective date, prepared / reviewed / approved by — 7.5.2 review and approval; 7.5.3 change control.
Purpose and scope — 8.5.1 activities and results to be achieved.
Roles and responsibilities — 5.3 organisational roles, responsibilities and authorities.
Definitions — 7.5.2 suitable format.
Procedure — 8.5.1.
Records — 7.5.3 retention, and the evidence for 9.1 monitoring and 9.2 internal audit.
References — 4.4 process interactions; links to policy and forms.
Revision history — 7.5.3 control of changes.
Add a header on every page with document number, version and page x of y, and a footer stating "Uncontrolled when printed" if the master is digital. Both are conventions rather than requirements, and both prevent the commonest finding.
What the auditor actually checks
Auditors in India, working for bodies accredited under NABCB or an equivalent foreign accreditation, follow a similar routine on SOPs.
Is the copy in use the current version? They pick a procedure, go to where it is performed, and compare the version there with the master. A superseded copy on the wall is a nonconformity.
Does the person doing the task know the procedure exists, and do they do it that way? They ask the operator, not the manager, to walk through the task. Divergence between the SOP and the walk-through is the finding that matters.
Do the records named in the SOP exist, filled in, for the period sampled? If the SOP names a register, they open the register. Blank pages, backfilled entries in one pen on one day, or a register that starts the week before the audit are all visible.
Is there a training record for the current version? Especially after a revision. A procedure changed in March with training records from the previous year is a finding.
Was the change approved by someone with authority? Revision history with a name, and that name is the role the procedure says approves.
Is the SOP linked to a process? Under clause 4.4 the organisation must determine its processes and their interactions. An SOP that belongs to no identified process, or a process with no SOPs at its risk points, raises the question of how the organisation decided what to document. The process documentation spoke covers this layer.
The pen-drive problem
Most first-time ISO 9001 certifications in Indian SMEs go the same way. A consultant is engaged, documents are generated from a library, a certificate is issued, and the documents are not opened again until the surveillance audit. The certificate is real. The quality system is not.
The cost is not the audit. It is that the company has taught its people that written procedures are decoration for outsiders. When the owner later needs SOPs that work, to open a second unit or to stop being the approver of everything, the team's first experience of SOPs is already the pen drive.
The alternative costs more time and less money. Write fewer SOPs, for the tasks where variation actually creates risk. Write them from observation, using the seven-step method. Test each on the person who performs it. Then let the consultant format and file them. The audit passes either way; only one of the two approaches leaves the company with procedures it uses.
How many SOPs does ISO 9001 need
There is no number. Clause 7.5.1 says the extent of documented information can differ with the size of the organisation, the complexity of its processes and the competence of its people. A twenty-person services company can be certified with a dozen procedures. A hundred-person manufacturer might need forty. The test the auditor applies is whether the absence of a procedure at a given point creates a risk to conformity of the product or service. If the honest answer is yes, document it. If the task is done consistently by competent people without one, you may not need it, and you should be able to say why.
ISO 9001 SOP format for specific sectors
Manufacturing. Procedures for production control, in-process inspection, final inspection, calibration, nonconforming product, and preventive maintenance are almost always needed under 8.5, 8.6, 7.1.5 and 8.7. Work instructions at each machine sit beneath them.
Services. Enquiry handling, service delivery, customer complaint, and supplier evaluation. The format is identical; the records are usually digital.
Pharma and food. ISO 9001 is often held alongside GMP under the revised Schedule M or FSSAI requirements, which are more prescriptive about SOP content, change control and training records. Where the two overlap, write to the stricter one.
Questions people ask
Does ISO 9001 require SOPs?
It requires documented information wherever its absence would risk the conformity of products or services. In practice that means procedures for the tasks that affect quality. It does not mandate the term SOP, a number of them, or a format.
What is the ISO 9001 SOP format?
Any format meeting clause 7.5: identified with a title and number, in a suitable medium, reviewed and approved, version-controlled, available where used, protected and retained. The nine-section format on this site meets it.
Is a quality manual required in ISO 9001:2015?
No. The 2015 edition removed the requirement. Many companies keep a short one because it is a convenient place to describe the scope, the processes and their interactions, and it is a useful index to the SOPs.
Who approves SOPs under ISO 9001?
Whoever the organisation designates, provided they have the authority and the approval is recorded. Typically the process owner or the management representative. The auditor checks that the approval name matches the authority stated in the procedure.
How long should SOP records be kept?
Long enough to demonstrate conformity and meet legal requirements. Three years is a common default for quality records in India; statutory records such as tax and payroll follow their own periods. State the retention period in each SOP's records section.
Where to go deeper
SOP Format — the nine sections in full.
SOP Template — the layout, including notes for ISO and GMP use.
Process Documentation — the clause 4.4 layer above the SOPs.
How to Write an SOP — writing procedures that describe the real work.
What Is an SOP? — the full guide.