Standard Operating Procedure Review Checklist: Purpose, Control, Evidence and Change
A standard operating procedure is useful only when a competent reader can perform the work consistently, recognize an exception and produce the evidence needed for review. Length is not quality. A ten-page SOP can still fail if its trigger, owner, control point or change history is unclear.
Use SOP-8 to review a new or existing procedure before approval.
The SOP-8 review
| Test | Review question | Minimum evidence | Weight |
|---|---|---|---|
| S — Scope and trigger | When does the procedure start and stop? | trigger, boundary, exclusions | 10 |
| O — Owner and authority | Who performs, approves and escalates? | named role, decision limits, backup | 10 |
| P — Preconditions | What must be true before work begins? | inputs, access, safety/data checks | 10 |
| 1 — One observable sequence | Can the steps be followed in order? | numbered actions with outputs | 20 |
| 2 — Two-way exception path | What happens when normal work fails? | stop/escalate route and recovery route | 15 |
| 3 — Three evidence points | What proves the procedure operated? | input, control and completion records | 15 |
| C — Change control | How are versions reviewed and retired? | owner, version, approval, effective date | 10 |
| K — Knowledge check | Can a trained user explain critical judgment? | scenario test and sign-off | 10 |
Score the SOP out of 100. Below 70, return it for revision. From 70 to 84, permit a controlled pilot with recorded observations. At 85 or above, it may be ready for approval if legal, safety, privacy, quality and technical specialists have completed their own reviews.
The threshold is an internal decision aid, not a regulatory standard.
Start with a one-line operating contract
Write:
When [trigger] occurs, [role] performs [bounded process] to achieve [observable outcome], records [evidence] and escalates [exception].
Example: “When an approved supplier invoice enters the finance queue, the accounts payable analyst verifies the purchase order, receipt and payment details, records the three-way match and escalates mismatches before release.”
If this sentence is ambiguous, the procedure will probably be ambiguous.
Build steps around verbs and outputs
Each numbered step should contain:
- one primary action verb;
- the input used;
- the rule or criterion applied;
- the output produced;
- the evidence retained.
Weak: “Check the invoice carefully.”
Stronger: “Compare supplier name, bank details, purchase-order value and receipt quantity with the approved records; mark each field pass/fail in the match log.”
The US Environmental Protection Agency’s QA/G-6 guidance is written for quality systems, not as a universal corporate rule. Its treatment of preparation, approval, revision and control supports a broader lesson: a procedure should be both usable and governed.
Design the exception path before the happy path is approved
For each critical step, ask:
- What condition requires the user to stop?
- What can the user correct within their authority?
- What evidence must travel with an escalation?
- Who decides whether work resumes?
- How is a recurring exception turned into a process change?
Use two branches:
Exception detected → contain/stop → record → escalate → decide
Decision received → correct/recover → verify → resume or close
An escalation address without decision authority is not an exception process.
Require three types of evidence
| Evidence point | Purpose | Invoice example |
|---|---|---|
| Input evidence | Proves the work started from an authorized source | approved purchase order and receipt |
| Control evidence | Proves a rule was applied | three-way match log and exception flag |
| Completion evidence | Proves the outcome and handoff | approval record, posting reference, payment release ID |
Do not retain personal, payment or security data simply because a checklist has a blank field. Define the minimum record, location, access and retention rule with the responsible specialists.
Test with three scenarios
Before approval, ask a trained user to perform or walk through:
- a normal case;
- a foreseeable exception;
- a boundary case where the SOP should not be used.
Record where the user hesitated, interpreted a term differently or had to ask for missing authority. Fix the procedure, not only the user.
Change control checklist
- unique identifier and title;
- process owner and approver;
- version and effective date;
- reason for change;
- affected systems, roles and linked procedures;
- training or communication requirement;
- retirement of superseded copies;
- next review date or event trigger.
The EPA also maintains a current SOP guidance landing page that should be checked for the latest agency materials. Organizations should apply the laws, standards and quality requirements that actually govern their sector.
A compact review meeting
Run a 30-minute review in this order:
- Five minutes: owner states trigger, outcome and exception.
- Ten minutes: user walks the normal sequence.
- Five minutes: reviewer introduces an exception.
- Five minutes: evidence and authority are checked.
- Five minutes: changes, owner and due date are recorded.
Do not approve by silence. Record approve, approve with conditions, pilot, or revise.
Next step
Professionals building repeatable operations can connect this checklist with process, quality, supply-chain and resilience study through MTF Institute’s Operations Management and Supply Chain programme. Use the course for structured learning and SOP-8 as a reusable review tool.