Creating Standard Operating Procedures for QM

In a Standard Operating Procedure (SOP), companies define their processes, for example how they develop medical devices or provide services.

Standards such as ISO 9001 and ISO 13485 require Standard Operating Procedures. Companies can define these specifications in their quality management manual directly or in independent documents.

1. Standard Operating Procedures: introduction, definitions

a) Definition

ISO 9000 defines a procedure as follows:

ISO 9000 defines a process as follows:

A Standard Operating Procedure thus documents how a company (e.g., a manufacturer) intends to carry out an individual activity or a process (set of activities). The terms Standard Operating Procedure and process description are to be understood synonymously.

b) Process description versus Standard Operating Procedure

Based on the above definitions, a Standard Operating Procedure is equivalent to a process description when describing several interrelated or mutually influencing activities.

A process description includes the description of the entire process, e.g., software development process. It defines phases, roles and activities. For example, it requires a software system test at the end of development. How, i.e., with which methods, these tests are carried out (e.g., with equivalence classes) can be part of a referenced Work Instruction or Standard Operating Procedure.

c) Differences between Work Instructions and Standard Operating Procedures

Work Instructions and Standard Operating Procedures differ concerning several aspects:

Aspect	Standard Operating Procedure	Work Instruction
Affected roles	Usually several	Usually one
Granularity	Many work steps. The SOP refers to the Work Instruction for the individual work step. You mention the tools to be used without describing their operation.	Fine-grained description of a work step, including precise instructions on how to use tools.
Duration of the activity	The procedure often cannot be completed in one step and without interruption.	A Work Instruction describes an activity that can usually be completed without interruptions or dependencies.
Responsibility	Process owner	Persons performing the activities.
Training and use	Standard Operating Procedures are trained. They serve as a reference for understanding processes.	Work Instructions are available at the location of the activity.

2. What should a Standard Operating Procedure contain?

a) Content

The Standard Operating Procedure should describe:

• role(s),
• actions,
• methods,
• aids and tools,
• order (e.g., sequentially, in parallel),
• inputs and
• outputs.

b) Meta information

A good Standard Operating Procedure should describe the following at the meta level:

• Clear identification of the SOP, e.g., document ID
• SOP version
• Author(s)
• Responsibilities
• Scope
• Objective
• Change history

3. Content of Standard Operating Procedures

a) Chapter structure

Johner Institute consultants and auditors generally use the following chapter structure

1. Meta information
   • Purpose
   • Scope
   • Responsibilities
   • Adressees
   • Distribution list
   • Process owner
   • Training
   • Performance indicators
2. General information (optional)
3. Process description
   • Overview (e.g., flow chart)
   • Step 1
     • Input
     • Description of the activity
     • Output
   • Step 2 – n (same)
4. Annex
   • Referenced documents
   • Version history

b) Description of the procedures

Graphical description

Various modeling languages such as UML activity diagrams, BPMN and classical flow charts can be used. Numerous tools, including free tools (e.g., draw.io), are available.

Tabular description

Tables are an alternative way of showing the information. These are only suitable for sequential processes.

Step	Input	Activity	Output	Role	Comment
1	Use scenarios Stakeholder requirements	Specification of the software requirements	Software requirements specification	User interface designer

4. List of Standard Operating Procedures

a) Overview of the regulatory requirements

The requirements which SOPs manufacturers have to define and follow can be found in these regulations, among others:

• ISO 13485
• MDR and IVDR
• FDA 21 CFR part 820 (which again refers to ISO 13485)

b) ISO 13485

Standards, such as ISO 13485, require companies to have procedures, such as document control, design and development planning, procurement, and corrective actions.

ISO 13485:2016 has adapted the list of necessary standard operating procedures to its predecessor version. A more general list of the required procedures below:

• Validation of the application of computer software used in the quality management system
• Control of documents
• Control of records
• Management review
• Design and development including transfer of design and development and control design and development changes
• Purchasing
• Procedures and methods for the control of production
• Servicing (if applicable)
• Validation of processes for production and service provision including validation of the application of computer software
• Validation of sterilization and sterile barrier systems (if applicable)
• Product identification
• Traceability
• Preserving the conformity of product
• Control of monitoring and measuring equipment including validation of the application of computer software
• Feedback
• Complaint handling
• Reporting to regulatory authorities
• Internal audits
• Monitoring and measurement of product
• Control of non-conforming products
• Analysis of data
• Corrective actions
• Preventive actions

Strictly speaking, these standards (e.g., ISO 13485) require that the manufacturers

• define,
• document (in writing! This is then the Standard Operating Procedure),
• implement,
• provide training on, and
• maintain

all the above procedures.

c) MDR and IVDR versus ISO 13485

MDR resp. IVDR requires fewer Standard Operating Procedures than ISO 13485.  On the other hand, there are procedures that manufacturers must define according to MDR and IVDR, which ISO 13485 does not mention explicitly, for example, risk management.

It should be noted that ISO 13485 does require risk management as an activity.

Conclusion: If you act in accordance with the current edition of ISO 13485, you fulfill the essential quality management requirements of MDR and IVDR, Article 10 and Annex IX.

5. Other

a) Standard Operating Procedures as part of the QM manual?

There are arguments in favor of integrating these Standard Operating Procedures directly into the  QM manual, and there are arguments against it. Arguments against the integration of Standard Operating Procedures into the quality management manual are:

1. Separation of confidential and non-confidential content
   A lot of manufacturers want to proudly present their QM manual to the outside world. If this manual contains in-house know-how, this is not possible. The problem does not occur if there are separate SOPs.
2. Interchangeability of standard operating procedures
   Development service providers, in particular, are often forced to develop according to their customers’ specifications. This is easier for them if they use the customer’s SOPs rather than their own. Not having their SOPs in their QM manual means that the QM manual is not affected by this.
3. Quicker approval
   It is easier to make changes to SOPs because not every change requires a new release of the  QM manual, which can be time-consuming, especially for large companies. Component separation sometimes also makes sense in the document landscape.

But separating the QM manual and SOPs is not always the best solution. Small companies with only one or a few products are sometimes better served by an integrated document set.

Are you unsure which option is best for you? Please feel free to contact us. We’re happy to help. Contact us now.

b) Abbreviations in the Standard Operating Procedure

Common abbreviations are often used in the SOP to clarify the document. All abbreviations used should be noted separately in a document. Examples:

• Mgmt: Management
• EO: Environmental Officer [Dt: UB: Umweltbeauftragter]
• EM: Environmental Management [Dt: UM: Umweltmanagement]
• SOP: Standard Operating Procedure
• WI: Work Instruction [Dt: AA: Arbeitsanweisung]
• QM: Quality Management

---

Change history

• 2023-08-16: Subheadings added to chapter 2
• 2023-05-31: Editorial changes