An SOP compliance audit checks two things: whether a written procedure is complete and current, and whether people actually follow it. Pick one process, compare what the SOP says with what employees do and what the records show, log the gaps, assign owners and verify the fixes. Done this way, it takes days, not months, and it tells you where your business still depends on you.
This guide is for owners and leaders of mid-market companies who have procedures on paper and suspect the floor, the office or the field does something different. It covers the audit itself, a checklist you can copy, the evidence that counts, example findings and how to close them for good.
TL;DR
- An SOP compliance audit tests the document (is it complete and current?) and the behavior (do people follow it, and do the records prove it?).
- Audit one process at a time. A narrow scope gets finished and produces findings someone can act on.
- Interviews alone are not evidence. Pair them with inspection of records, observation or reperformance.
- Every finding needs an owner, a due date and a verification step. Retraining alone rarely closes a finding.
- Re-audit on a schedule tied to risk, and check earlier fixes at the next audit.
Table of Contents
- What an SOP compliance audit is, and how it differs from a process audit
- Why owner-led companies should audit SOPs
- Plan the audit
- The SOP audit checklist
- Gather evidence that holds up
- Example findings and what they usually mean
- Document findings and close them for real
- How often to audit
- Where we can help
- FAQ
- Sources
What an SOP compliance audit is, and how it differs from a process audit
An SOP compliance audit systematically examines how well an organization adheres to its standard operating procedures. It validates that documented procedures exist and are effectively implemented. Two questions sit inside it: is the SOP good, and is the SOP used?
A process compliance audit is close kin. ASQ describes a process audit as verifying that processes work within established limits, evaluating an operation or method against predetermined instructions or standards to measure conformity and effectiveness. In practice the SOP is usually the predetermined instruction, so the two audits overlap heavily. The difference is emphasis. An SOP audit starts from the document. A process audit starts from the work and asks whether it stays inside its limits.
Both differ from a broad system audit. A process audit is focused on a single activity, such as setting up a machine or stamping a part, and typically involves one work crew. A system audit looks across the whole management system. If you want a sense of how a single narrow workflow can be built around states you can audit, a work order workflow with auditable states is a good small-scale picture of what “audit-ready” looks like.
For an owner, the practical rule is simple: start with a process audit on one SOP. Move to a system view only when you have run several and the same causes keep appearing.
Why owner-led companies should audit SOPs
Most owner-led companies write procedures once, usually after something goes wrong, and never look at them again. Three things then happen. The document drifts away from the real work. New hires learn from whoever sits next to them. And the owner becomes the only person who knows which version is real.
That is what an audit exposes. It also matters commercially. A buyer’s diligence team asks whether the business runs without you, and documented, followed procedures are the evidence. We cover the building side in our guide to creating SOPs and the strategic side in the role of SOPs in mid-market growth. This article is about the check that keeps both honest.
If your industry is regulated (food, healthcare, finance, manufacturing), the audit also protects you against regulator findings. Your regulator’s own rules decide what you must document and keep, so confirm requirements with your compliance counsel or the agency that licenses you before you set your checklist.
Plan the audit
A good plan fits on one page. Settle these points before anyone opens a binder.
- Pick one process and one SOP. Order-to-cash, onboarding a new client, month-end close, equipment changeover, job-site safety check. Choose one that matters to revenue, risk or your own time.
- Write the audit question. For example: “Does the invoicing team follow SOP-014 as written, and do invoices carry the approvals it requires?”
- Choose the auditor. Someone who does not own the process. In a company of $3M to $5M in revenue, that may be an operations lead from another team, a trusted bookkeeper or an outside facilitator. The owner should not audit their own favorite process.
- Set the sample. Decide how many records, shifts or transactions you will look at. Write the number down before you begin, so you cannot stop at the first clean example.
- Tell the team why. Frame it as testing the procedure, not catching people. One guide on SOP compliance suggests treating gaps as learning opportunities rather than occasions for audit anxiety, a framing that gets you more honest answers.
For the audit method, ISO 19011:2018 provides guidelines for managing audit programs, conducting audits and auditor competence, built on risk-based and evidence-based principles. You do not need certification to borrow the logic: scope the audit by risk, and let evidence, not opinion, decide the finding.
The SOP audit checklist
Use the checklist in two passes: the document, then the practice. The items below combine the checks published in a standard operating procedure audit checklist, a practical checklist from Workhint and a quarterly review from Prepared Cloud.
Pass one: the document
| Check | What a pass looks like |
|---|---|
| Title, purpose, objectives | The SOP states why it exists and what outcome it produces |
| Scope and applicability | It says who and what it covers, and what it does not |
| Version and revision records | One current version, with a dated change history |
| Approvals | A named approver and the date, so there is a clear trail |
| Sequential steps | Steps in order, each doable by a trained person without guessing |
| Responsibilities | Owners named by role, not just department |
| Triggers and completion | It says what starts the process and what “done” means |
| Exception paths | It says what to do when the normal path fails |
| Decision rules and controls | Thresholds, approvals and checks are explicit |
| References | Forms, templates and regulations are linked or attached |
| Accessibility | People can find the current version where they work |
The Prepared Cloud guidance adds two points worth stealing: accountable owners should be named by role, and the SOP should spell out exception paths. It also warns that outdated screenshots can be worse than none because they create a false sense of compliance. For systems that change often, annotated text instructions hold up better.
Pass two: the practice
| Check | What a pass looks like |
|---|---|
| Training | Every person in the process was trained on the current version, and the record exists |
| Change communication | When the SOP changed, affected staff were told and the tell is documented |
| Actual behavior | Observed work matches the steps, with no informal workarounds |
| Records | The forms, logs or system entries the SOP requires exist and are complete |
| Effectiveness metrics | There is a measure (error rate, cycle time, rework) showing the SOP works |
| Feedback | Staff have a way to flag a step that does not work |
| Periodic review | The SOP has a review date, and it was met |
| Corrective actions | Past findings were closed with evidence |
If your SOPs fail pass one badly, version control is usually the culprit. Our write-up on SOP version control for mid-market teams shows how to fix that before auditing again.
Gather evidence that holds up
The fieldwork phase is where you gather data: verifying controls, observing processes and talking with the people doing the work, ending with an exit meeting. The quality of your findings depends on the kind of evidence you collect.
Guidance from PwC, based on AICPA auditing standards, lists the ways to test a control: inquiry combined with inspection of documents, observation or reperformance. It also states that inquiry alone is not sufficient evidence that a control operates effectively. Translated for a business owner: never close a finding because a manager said “yes, we do that.”
Use four methods:
- Inquiry. Ask the person doing the work to walk you through it. Ask for the last time something unusual happened.
- Inspection. Pull the records: signed forms, system logs, tickets, invoices, training sign-offs.
- Observation. Watch the work happen on a normal day, not a day announced weeks ahead.
- Reperformance. Ask someone to do a step again, or redo a calculation yourself, and see whether you reach the same result.
Compare three accounts
PCQI Services suggests comparing what the SOP says, what the employee does and what the record shows. When the three disagree, the pattern of disagreement points to the cause:
- SOP and record agree, but the employee does something else: a training or execution problem.
- Employee and SOP agree, but the record is missing or wrong: a recordkeeping problem.
- Employee and record agree, but the SOP says something else: the document is out of date, or the process design was never realistic.
This three-way comparison is the single most useful habit in an SOP audit, because it stops you from blaming people for what is really a document problem.
Example findings and what they usually mean
The examples below are illustrations of patterns we see described in audit guidance, not findings from a specific client.
| Finding | Likely cause | Fix to consider |
|---|---|---|
| Two versions of the same SOP in use | No single source of truth or version control | One controlled location, retire old copies, dated revisions |
| Step 6 is skipped by most of the team | The step is slow, unclear or no longer needed | Test whether the step is needed; fix the step or remove it |
| Approvals are signed after the work is done | The approval step blocks the work, so people backfill | Redesign the approval path and set a response time |
| New hire has no training record for the current version | Changes were never communicated | Tie training sign-off to each revision |
| SOP names “Operations” as owner | Ownership by department, not role | Name a role with authority to change the SOP |
| Screenshots show a retired system screen | Nobody owns review | Replace with annotated text; assign a review date |
| Exceptions are handled by calling the owner | No exception path in the SOP | Document the exception decision rule and who can make it |
That last row matters most to the audience of this site. When exceptions route to the owner, the audit has just found owner dependency, and no amount of staff retraining removes it. The decision rule has to be written down and delegated. Our guide on ending owner dependency with an operating system goes deeper on that.
Document findings and close them for real
The audit record should identify the SOP and process scope, the audit date and reviewers, the sample size, the checklist score, each finding, its risk level, the corrective-action owners and due dates, and a verification plan, per Workhint’s SOP audit guidance. A one-page template with those fields is enough.
Write each finding the same way
State what you saw, the SOP step it relates to, the evidence, and the risk. Keep opinion out. “Three of 15 sampled invoices lacked the second approval required by step 4” beats “approvals are sloppy.”
Respond with correction, cause and corrective action
An organization’s response to a nonconformity should include correction, cause analysis and corrective action. Correction fixes the instance (get the missing approval). Corrective action removes the cause so it does not return. ASQ distinguishes corrective action, which eliminates the root cause of an existing nonconformity, from preventive action, which addresses a potential problem before it occurs.
For cause analysis, ASQ’s 2026 CAPA guidance says a defensible CAPA defines the problem in measurable terms and uses tools such as 5 Whys or fault tree analysis, verifying the cause before committing to action. The same source flags a common failure: closing a record on retraining or notifications without addressing the system condition that allowed the failure.
Set owners, dates and a check
Good action plans include immediate corrective actions, longer-term improvement steps, responsible parties and specific completion dates. That standard comes from a state licensing guide, the Pennsylvania Bureau of Human Services Licensing, written for care providers, but the structure suits any business. Each action gets one owner and a date.
Verify before closing
Auditors confirm effectiveness by checking that actions were fully implemented and examining objective evidence before closing a finding. For you: pull a fresh sample after the fix, and close the finding only if the new records are clean.
How often to audit
There is no universal interval. Tie frequency to risk: audit high-risk or high-revenue processes more often, and stable low-risk ones less. Follow-up audits should verify that corrections were made and that actions were effective, and they are normally combined with the next scheduled audit, based on the finding’s importance and risk.
A workable rhythm for a company with $3M to $5M in revenue:
- Every quarter, audit one or two critical processes in rotation.
- Every time a process changes, spot-check its SOP and training records within the following weeks.
- Once a year, review the whole SOP library for ownership and review dates.
- Before any sale, financing or leadership transition, run a wider pass. Our operational assessment checklist is built for that stage.
If you cannot yet say which processes are most critical, a business process hierarchy will help you rank them.
Our view: an audit is a management system test
We see SOP audits misused in one of two ways. Some owners run them as a policing exercise, which makes the team hide workarounds. Others never run them, and discover during a buyer’s diligence that the manual describes a company that no longer exists.
Our approach starts from diagnosis. Before anything is sold, we look at how work actually flows through people, systems and operations, because recommendations built on a generic template tend to fail on contact with the real business. An audit uses that same logic at the SOP level: measure the gap between the document and the work, then decide which side to change.
The point is not a clean score. The point is that the business runs the same way when you are not in the room. Documented playbooks, delegated decisions and a repeatable check are what turn a good year into a company someone will pay a premium to own. If your audit keeps ending with “call the owner,” you have a delegation problem, and that is solvable.
Andre
Where we can help
If you would rather not audit your own processes, we can do it with you. Our ProfitDriver Analysis™ is designed for owner-led businesses with annual revenue between $3M and $5M. It combines current business data, stakeholder interviews and a review of people, systems and operations to rank where to fix inefficiencies first. You can start with the ProfitDriver Analysis™.
For a fixed-scope engagement, our Growth Sprint is listed at $7,500 to $10,000 one-off and our Performance Sprint at $15,000 to $20,000 one-off. See what each includes on the Sprint page. If your goal is a sale, the management system audit for exit readiness shows how we look at the whole operation.
FAQ
What is an SOP in an audit?
An SOP, or standard operating procedure, is the written set of steps for a recurring task. In an audit, it is the benchmark: auditors compare the work and its records against what the SOP requires. The audit also tests whether the SOP itself is complete, approved and current.
What is the difference between an SOP audit and a process compliance audit?
They overlap. An SOP audit starts from the document and asks whether it is sound and followed. A process compliance audit starts from the activity and asks whether it conforms to its instructions and limits. For a single workflow, run them as one exercise.
What should an SOP audit checklist include?
Cover the document (purpose, scope, version history, approvals, steps, roles, exceptions, references) and the practice (training records, change communication, actual behavior, records, metrics, review dates and past corrective actions). The two tables above give you a ready starting point.
Who should run the audit in a small company?
Someone who does not own the process being checked, such as an operations lead from another team or an outside facilitator. Independence matters more than title. The owner can sponsor the audit and review findings, but should not collect evidence on their own processes.
How do I know a finding is truly closed?
Check objective evidence after the fix: a new sample of records, an observation or a reperformed step. If the only change is a retraining email, the cause may still be in place, so look at the system condition behind the failure.
Sources
- SOP Compliance Audits (Meegle)
- What is an Audit? Types of Audits and Auditing (ASQ)
- Certified Quality Auditor Handbook excerpt (ASQ)
- Work Order Workflow for Maintenance
- ISO 19011:2018 guidance (ISO TC 176)
- Standard Operating Procedure Audit Checklist (GoAudits)
- Standard Operating Procedure Audit Checklist Template (Workhint)
- Quarterly SOP Audit Checklist (Prepared Cloud)
- Nature of Tests of Controls (PwC Viewpoint)
- When the SOP Says One Thing and the Production Floor Does Another (PCQI Services)
- SOP Audit Checklist: What To Check Before Work Moves (Workhint)
- Nonconformity review and closure (ISO TC 176)
- CAPA: A Quality Engineer Guide (ASQ, 2026)
- Effective Plan of Correction guide (Pennsylvania Bureau of Human Services Licensing)