GxP SOP authoring, explained.

An SOP is a numbered promise to inspectors, and a site's library of them never stops changing

How one outside change becomes a signed SOP that people work from

1. Something changesA rule is revised, a system is upgraded, or a deviation (a recorded departure from a procedure) or a corrective action asks for a new step.
2. Find and rewrite the stepsWork out which procedures and steps answer to the change, then draft each one in the site template.
3. Review and approveThe process owner checks it can be done; quality reviews and signs, with an effective date.
4. People trainThose whose task changed learn the new way before that date.
5. The version takes effectThe old one is withdrawn, its history kept, and the next periodic review is set.

Step 2 is the subject of this guide. The company, people and figures in this guide's example are fictional.

Four things that catch new SOP owners out, starting with a search for "audit trail"

What SOP, effective date, change control and audit trail mean

The one-page summary defines thirteen terms.

A blank-page SOP is the rare case: most GxP authoring is triggered revision and periodic review

In shortPeople picture SOP authoring as writing a new document. Most of the work is revising documents that already exist, because something changed or because a date came up. Each kind starts from different facts, and each asks for a different record of why.

What one step of a good SOP holds, and why each part earns its place

The step is the working unit. Most of what goes wrong with procedures can be traced to a step that does too much, leaves out who does it, or has lost its reason. Here is one step from this guide's fictional example, taken apart.

The example step does two things, reviewing and recording. Many sites would accept that as one action, and some writing rules would split it. Your own rule decides.

21 CFR 211.100, EU GMP Chapter 4 and ICH E6(R3) as of November 2026, and the three EU texts still in draft

In shortThe duty to write procedures has stood for years: 21 CFR 211.22 and 211.100 in the United States (21 CFR is Title 21 of the US Code of Federal Regulations), and EU GMP Chapter 4 in Europe. The changes sit around those texts. ICH E6(R3) took effect for clinical work, FDA's device rule now rests on ISO 13485, and the European Commission consulted on a new Chapter 4, a new Annex 11 and a first Annex 22. Those three remained drafts on November 3, 2026.

What each text says about written procedures, in its own words

Written procedure duties across GMP, GCP, GLP and GDP: who must approve and how much each text spells out

In shortAll four good practices expect written, controlled instructions. They differ in who must approve, and in how much they spell out. GDP says the most about language and versions, GLP is the only one here to ask for a historical file by name, and clinical guidance has moved toward proportion.

Who owns a procedure, what sets off a revision and who approves, practice by practice

The owner and trigger columns describe common practice, and your organization may differ. The last column is from the texts.

What draft Annex 11 section 12 and draft Chapter 4 would change in your procedures

In shortThe drafts are far longer than the texts they would replace, and they turn one short audit trail paragraph into ten clauses. Clause 12.8 would move review to before batch release, which is why so many procedures are in play. They are drafts. The final words can change, and inspectors' only published date is a target for handing text to the Commission.

The current Annex 11 asks that audit trails be "regularly reviewed", in one short clause.8 The draft's section 12 gives this ten numbered clauses.10 A site reading it will find its periodic system review, its laboratory data review, its batch release checklist and its Qualified Person's certification all pulled in. The Qualified Person, or QP, is the person who certifies each batch for the EU market.

Clause by clause: section 12 of the draft and the procedures it reaches

Clause text from the consultation draft.10 The last column is our reading of the kind of procedure each clause reaches, and a site's own library decides.

Draft Chapter 4 on inventories, format and who answers for machine-made documents

Draft Chapter 4 keeps the familiar wording and adds to it. It asks for "An inventory of documents within the pharmaceutical quality system" (4.48). It adds that procedures be written "by using predefined format", and allows "pictures, photos or videos" (4.52). It keeps revision histories (4.54).

It also speaks to automated help directly. "The accountability for the integrity of documents, records or (raw) data produced or processed with artificial intelligence or any other automatic means (e.g. validation scripts) rests with the regulated user" (4.24). Support by such means "should be included in a pharmaceutical quality system" (4.25).18

Why a word search for "audit trail" misses most of the steps that do an audit trail review

In shortFinding impact has two measures: how many of the right steps you found (recall) and how many of what you found were right (precision). A word search has poor recall for steps written in other words, and it can never find a step that does not exist yet. Reading everything by hand has better recall, and a cost you can work out in advance.

Take this guide's fictional case. Draft clause 12.8 touches 23 steps in 17 SOPs at Veltara's Aldenbrook site. Look at how those steps are written today. Six use the words "audit trail". Eleven do the same kind of work under other names: "Review alarm acknowledgements quarterly", "Review temperature records monthly", "Check the cycle printout against the load pattern". And six steps do not exist yet, because the current procedure never asks for the review at all.

Recall and precision on clause 12.8, worked through

Recall is the share of the right answers you found. A search that finds the 6 steps with the words has a recall of 6 ÷ 23, or 26%. Precision is the share of your results that were right. Suppose the same search also returned 40 other steps that mention audit trails and need no change. Precision would be 6 ÷ 46, or 13%. Those 40 are made up for the arithmetic, so measure your own.

Adding synonyms helps: "alarm", "event log", "cycle record". Each one adds recall, and each adds noise to read through. And no word list finds the six missing steps. A search can only return what is written. Spotting that a procedure should say something and does not takes someone who reads the clause and the process together.

People also overrate their own searches. In a well-known study from 1985, lawyers searching a full-text system for documents in a large case said they needed at least 75% of the relevant documents, and finished each search believing they had got there. The researchers estimated mean recall at about 20%.29 That was one legal collection and one older search system, and the study has been argued over since. It is an analogy, because we found no recall study on SOP libraries.

The point carries over: a searcher cannot see what the search did not return. Test your own method on a change you have already assessed.

What reading every step would take, for one clause and for a section

The fictional site's 214 procedures that answer to Annex 11 hold 4,812 steps. Allow 30 seconds to read one step against one clause, a figure we picked for the arithmetic. Your own will vary. The fictional site tracks seven of the ten clauses in the draft's section 12.

That is reading alone, with no drafting. So teams narrow the search first, and that is where steps get lost. The fictional site's own estimate for its last assessment was a consultant and two QA staff for 11 weeks. At 40 hours a week, that is 11 × 3 × 40 = 1,320 hours, ending in a list of documents with no steps named.

A site's real library size is its own. We found no dependable public figure for SOPs per site. One book says flatly that "There is no set rule or formula regarding the number of SOPs needed".3

How to write a GMP SOP step that an analyst can follow on a night shift and an inspector can trace

In shortSay who does what, one action at a time, as a command, with the form named by number. Change only what the source asks for. Test the step with someone who does the work, and resist adding detail each time something goes wrong. The rules ask for an imperative style and unambiguous content, and they leave the rest to your template.

Seven writing rules worth putting in your own template

A vague step rewritten, line by line

All examples come from this guide's fictional SOP-QA-044.

When procedures grow past what people can use

Every investigation that ends with "add a step" makes the document longer, and longer documents get skimmed. We found no controlled study that links SOP readability to deviation rates. What exists is experience. One consultant, Martin Lush, describes a single unnamed site in a white paper, with no method published, so treat his numbers as one person's account.30

Those numbers cannot be checked, and his test costs nothing to try. Leave copies of an important SOP and highlighters in a room where people gather. Ask them to mark only what they do. Then read the result with the process owner.

FDA has cited the opposite failure too: one 2026 warning letter says a visual inspection procedure contained "no definition, criteria, or examples" of a defect class it relied on.31 Length and vagueness can both hurt, so the aim is exact words, in as few of them as the job needs.

One procedures row leads FDA's Form 483 drug file every year, and documentation sits second in UK inspectors' data

In shortFDA's Form 483 lists what investigators saw at the end of an inspection. By our count of FDA's files for fiscal 2018 to 2025, the row for quality unit procedures not in writing or not followed comes first every year. Added up by citation, investigations lead in five of those years. In fiscal 2025, four of the top nine rows name procedures. In MHRA's 2018 and 2019 data, documentation comes second among EU GMP chapters, also by our count.

How we counted the top row, and what the count does not show

Our count. We opened the Drugs sheet of FDA's Inspection Observations spreadsheet for each fiscal year from 2018 to 2025, sorted the rows by FDA's Frequency column and read the top row. We reran this on November 3, 2026, on files downloaded from FDA that day. FDA publishes the rows and does not rank them.4

Bold in the last column marks the years 211.192, added up, passes 211.22(d). Our arithmetic on FDA's rows.4

Three cautions. First, FDA splits some citations across several rows. 21 CFR 211.192, on investigations, has several, and added together it passes 211.22(d) in fiscal 2019 through 2023. So "first every year" holds for FDA's rows and fails for citations.

Second, the row's scope is narrower than its short label: FDA's long description reads "The responsibilities and procedures applicable to the quality control unit are not [in writing] [fully followed]". It counts a missing procedure and an ignored one together, and it does not separate an out-of-date SOP from an ignored one. We know of no public count of findings caused by an SOP that lagged a rule.

Third, a published review of 2024 sterile site observations placed 211.100 in a tie for third among sections, and it says most of those observations concerned process validation, so it is weak support for a point about SOP text.32

UK inspectors' 2018 and 2019 data: how often Chapter 4 is cited, and which paragraph

The UK's medicines regulator, MHRA, publishes spreadsheets of its GMP inspection deficiencies, one row for each reference cited. The newest year on its page, last updated October 15, 2020, is 2019: 5,292 rows from 258 inspections. By our count, Chapter 1, on the quality system, drew 1,314, Chapter 4, on documentation, 700, and Chapter 5, on production, 593.33 The 2018 file ranks the same: 1,519, 757 and 655, in 6,209 rows.34

Paragraph 4.5, the one about keeping documents up to date, drew 60 in 2019 and 53 in 2018. These are UK inspectors' findings, now several years old.

What FDA wrote to four firms about SOP changes and approval

A warning letter is a formal letter from FDA to a firm that summarizes significant violations, and FDA publishes it. CGMP, in the quotes below, is FDA's term for current good manufacturing practice.14

Each letter is about one firm, usually among other findings, and is cited for what it says.

Nine SOP revision failures, from stale links to unexplained steps, and the check that catches each

In shortMost failures come from the seams: between departments, between a change record and the documents it should reach, between SOPs that point at each other. Few are failures of writing skill. Each has a plain cause and a check you can run.

This list is our own reading of the rules, letters and sources in this guide. Row 5 is why the source beside each step matters: the next reviewer can see which steps have one.

Uncontrolled copies: the old version still on the wall

A perfect revision does little good if an old copy is still on the wall. MHRA's published examples include "crib notes on the wall of the goods in area" and "uncontrolled photocopying of pages of the batch record".37 EU GDP says "Superseded or obsolete procedures should be removed from workstations and archived".23 So a good revision plan includes a walk around the floor on the effective date.

When a procedure lags its rule: a released batch, the records behind it and the next inspection

In shortAn out-of-date step means people follow the wrong instruction faithfully, and every record since looks correct. The risks run from one batch to a whole site's standing with a regulator. Working back from the effective date on the first day shows whether you have the time at all.

The date arithmetic on one revision: working back from November 3

The fictional site starts on Monday, October 12, for an effective date of Tuesday, November 3. Suppose one revision takes the site's estimated 12 working days from draft to signature. Counting from October 13, day 12 is Wednesday, October 28. That leaves three clear working days, October 29, October 30 and November 2, for all the training on a procedure that changes how people work.

Three authors of a book on SOPs recommend two weeks as a general rule for training, with more for several sites.3 On those numbers, this schedule fails on day one, and the answer is one of three: start earlier, shorten the cycle, or move the date. A plain calendar tells you that on the first morning, with time still left to act.

AI drafting of GMP procedures: what FDA told one firm, what the EU drafts say and what stays with a person

In shortNo text we read forbids using AI to help write a procedure. FDA has told one firm it must review what AI writes. The EU's draft Chapter 4 keeps accountability with the company, and draft Annex 22 says language models "should not be used in critical GMP applications". Whether SOP drafting is critical is your call to document. Machines can read every step; a person approves every word.

Four ways an AI drafting tool can fail on SOPs, and how to test for each

We found no peer-reviewed study of language models drafting GMP SOPs, as of November 3, 2026. Any accuracy claim you are shown is the vendor's until you test it on your own library. ALCOA+ is the common shorthand for records that are attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available.47 It is a fair test for the record a drafting tool leaves.

The SOP software market: document control, gap assessment consultants and AI drafting, with no dependable size to quote

In shortFour kinds of product and service touch this work: document control systems, consultants who run gap assessments, general AI writing tools, and AI features built for GxP documents. We found no dependable public figure for the market's size. What we can show is the inspection volume behind it, which rose in fiscal 2025.

How an SOP revision moves through a site today, desk by desk, and where a rough twelve working days go

In shortA QA document owner runs the work, process owners check it can be done, and a head of quality signs. Today's tools are a document system, a word processor and a spreadsheet. By our rough estimate, half of a revision's days go to drafting and to review rounds, with much of that time spent waiting.

Document owner, process owner, head of quality: the people on a revision

From trigger to effective date: which desk hands what to the next

Twelve working days split across six stages of one revision

Spreadsheet gap assessment, in-system workflow, or drafting with software

Draft Annex 11 clause 12.8 at Aldenbrook: from a map of 214 SOPs to 17 signed revisions

In shortRuth Calloway, the QA document owner in the example at the top of this page, picks one clause. Agents, AI programs with one job each, find the 23 steps it touches in 17 SOPs and draft the changes with a source beside each step. She decides what stays. The process owners and the Head of Quality review and sign. Nothing takes effect until a person has signed it.

1

The Annex 11 revision, laid out against the library

On Monday, October 12, Ruth opens the regulation ripple, the screen that maps a rule across the library. The left panel holds the draft's clauses, each summarized in plain words with a count of the SOPs that answer to it. The middle holds 214 squares, one per SOP, grouped by department.

The quality council adopted the draft's audit trail section early, on October 5, effective at this site on November 3. That decision is recorded with the source. Of the 214, 61 need a change and 153 need none, and 104 changes are drafted.

2

One click on clause 12.8, and seventeen squares light up

Ruth selects clause 12.8, "Review before batch release". The regulation reader states the requirement in plain words. The impact finder reads all 214 SOPs and 4,812 steps by meaning, and the SOP drafter writes each change in the site's template.

Seventeen SOPs and 23 steps light up across quality, the QC laboratories, production, engineering, IT and the warehouse. Each shows old and new wording side by side, so she can judge from here before opening anything.

3

The redline, with the source of every step in its own column

A redline is a draft with its changes marked. She opens SOP-QA-044, "Audit trail review of GMP computerized systems", draft version 8, in the site's template. Each step shows its source in a column beside it. Step 6.3 said to review the audit trails of the chromatography data system, the software that records the laboratory's chromatography results, annually. The draft says to review the entries relevant to each batch before QA batch release, and to record that on Form QA-012-F3.

Clicking the source chip opens the clause itself in the right rail, with its status: draft text, adopted early by the site. A note below says why the drafter changed the step. Ruth can accept, edit or reject each change.

4

Step 6.7 has no source, so it is her call

Sixteen of this draft's 17 steps name a source. Step 6.7, "Allow 2 working days for the review", has none. The drafter does not delete it and does not invent a reason. It marks the step "No source · your call".

Under the new clause the review blocks release, so a fixed allowance could hold up a batch. Ruth can keep the step with a written reason, which goes on the audit trail, or delete it. She deletes it, with her name recorded.

5

Fourteen writing rules and the SOPs this one points at

She runs the template check. The checker reads the draft against the site's template and its 14 writing rules, among them one action per step, each step names who does it, and forms referenced by number. It also cross-checks SOP-QA-012, SOP-IT-418 and SOP-QA-030 for conflicts.

It reports and never rewrites. With step 6.7 gone, the header reads 16 of 16 steps with a source.

6

The site's own changes land in the same draft

Regulations are only one trigger. Change control CC-2026-114 moves the chromatography data system from v4.2 to v5.1 on November 3, and it touches 5 SOPs. Deviation DEV-2026-0931 found a review done 9 days after QA release of batch VLT-26-0388, on Line 2. Each appears as a source like any clause, and the same ripple shows what it touches.

So step 5.2 of SOP-QA-044 comes from the change control, and step 7.3 from the deviation. Each carries its record number.

7

The step a word search would have missed

SOP-EN-310 is an engineering procedure for the building management system. Step 6.3 said "Review alarm acknowledgements quarterly". It never says "audit trail". The impact finder matched it because alarm acknowledgements in cleanrooms are the kind of record a batch's review needs.

This is a proposal, and a person judges it. Pieter Volk, the engineering owner, may answer that his alarms are out of scope. He answers with the change and its reason in front of him.

8

All seventeen go for approval, each to its own process owner

Back on the ripple, she sends the batch: 4 through her, 5 through Kwame Ansong for the QC laboratories, 4 through Hannah Reyes for production, and 4 through the engineering, IT and warehouse owners. Each then goes to the Head of Quality. The training list travels with them.

The approvals screen holds 20 drafts, the 17 and 3 others. Each draft can be read before it is approved.

9

The people who sign see what changed and why

The approvals table gives each draft's number of changes, its source and who approves it. Dr. Tomas Lindqvist, Head of Quality, can open any one to read it, approve one at a time, or approve the batch after reading.

A batch action is a convenience, and it does not lessen the duty to read. Your own procedures should say when a person may approve several together.

10

Password, second factor and a stated meaning: how the Head of Quality signs

The signature dialog states its meaning: "Approved — content is correct, complete and traceable to its sources". It shows the signer's name and role, asks for a password, and takes a second factor on his registered device. 21 CFR 11.50 asks that a signed electronic record show the signer's name, the date and time, and the meaning.27

The 17 SOPs become effective on November 3, after training.

11

Classroom where the task changes, reading where only the wording does

The training-need writer compared old and new steps for the 17 SOPs. For 38 assignments the task itself changes, so people get a classroom session, due October 27. For 173, only the wording changes, so they read and sign by October 30. That is 146 people and 211 assignments in all, released to the learning system when each SOP is signed.

Mira Solberg, the training coordinator, can change any of them.

A timing note on this case. The site's settings hold a 21-day training lead time. From October 12 to November 3 is 22 days, so the case works when the batch is signed that day or the next. At the 2-day design target, signing on October 14 leaves 20 days, and a quality council would either accept that or move the date.

The SOP library, tracked regulations, periodic reviews, library health and your own writing rules

In shortThe same library is available when no rule is moving. Filter it for overdue periodic reviews and steps with no source. See every tracked text with its status: draft, final or in force. Watch the cycle time on one screen, and set the template, the writing rules and who approves.

1

Every SOP with its owner, dates and status against the revision

All 1,486 effective SOPs at the site, with version, owner, effective date, next periodic review, steps with no source, and status against the Annex 11 revision. Search by number or title, or filter by department.

2

Overdue periodic reviews, found by filter

One click narrows the list. The review interval is your site's setting, here 36 months, and 24 for computerized system SOPs. Those numbers are the sample's own choice, since no rule we read fixes one.

3

Regulations and site changes, each with its status

Every tracked text shows whether it is a draft, watched or adopted early, or in force, along with its clauses and how many SOPs it maps to. Change controls, deviations and corrective actions sit below in the same form. The clause and SOP counts are sample data. They follow the product's own split of each text, and regulators number their texts differently.

4

Library health: cycle time, overdue reviews, steps with no source

The head of quality sees how many SOPs are current with their sources, median days from draft to signature, overdue reviews and the share of steps with no source, by department. All the figures are sample data, showing what the screen tracks once you run it on your own library.

5

Your template, your writing rules, your approvers

One screen holds the template, the 14 writing rules, the rule on steps with no source (block approval or warn), the approvers per department, the training lead time, the review interval, the order in which sources win when they disagree, and which sources are read. Saving a change creates a new version on the audit trail.

Five agents read, match, draft and check; a QA owner decides and the Head of Quality signs

In shortThe agents have read-only access to effective SOPs and GMP records and can only produce drafts. Each works under stated limits. A person reviews every change, and a different person signs. Nothing becomes effective without a signature with its meaning recorded.

The regulation reader, impact finder, SOP drafter, template checker and training-need writer, with the limit on each

Three sign-offs: the document owner decides, the process owner tests, the Head of Quality signs

Role-based access, maker-checker sign-off (one person prepares, another approves), kept versions with redlines, and a full audit trail of every agent step, decision and signature are controls that support your compliance with 21 CFR Part 11, EU GMP Annex 11 and your own procedures. No product can itself be GxP compliant, validated or certified: your quality unit qualifies and answers for its use. Botminds' credentials are SOC 2 Type II audited and information security managed to ISO 27001.

The four people on these screens, and what each one asks for

SOP library and change records in; redlined drafts, an impact map and a training list out

In shortThe solution reads what you already keep: the SOP library, the template, regulations, change controls, deviations and corrective actions. It returns redlined drafts with a source beside every step, an impact map and a training list. Signed versions are released under your document control. The time figures are design targets and estimates, to measure on your own work.

The document, quality and learning systems it sits beside

The price of a lagging SOP library: revision hours, consultant fees and what an inspector finds

In shortWe found no dependable published figure for what an SOP revision costs, so this section shows how to find yours in a week. Count revisions a year, time five of them, and price your last gap assessment. Then add what no sum shows: the step nobody found.

Seven places SOP revision cost stays out of sight, and a week's work to count them

Workarounds, lost reasons and an inspector's next question: costs no spreadsheet shows

Revision hours, gap assessment weeks and steps you stop missing: the return on drafting support

In shortPut in your own numbers. The calculator values revision hours and gap assessment hours released, only as far as you will reuse them, and subtracts the yearly cost. Every default is an assumption to replace. It leaves out the value of a missed step found early, which may be the largest number and is the hardest to prove.

Revision hours, assessment weeks, fees, recall, cycle time and library health, each with its formula

Try your own SOP numbers: revisions a year, hours each, last gap assessment

At these defaults, a small site with 60 revisions a year and no gap assessment in view falls short on hours alone. It may do better by writing down a source for its most important SOPs, by hand, and running the highlighter test. A site with 300 revisions a year and one assessment in view clears the cost at these defaults, and its first question should be recall.

Readiness of your SOP library: step-level text, written rules, linked change records and QA's position on AI

In shortChoose what best describes your site today. Eight questions score 0 to 2 each, and your total builds beside them, with a note on each question and a sample of a strong reply. A ninth question has no score and is there to think about.

Recall, citations, draft rules and signatures: what to ask any SOP authoring vendor

In shortPut these questions to us and to anyone else selling SOP software. The answers show whether a tool finds steps or only documents, whether its sources can be checked, how it treats a draft rule, and how you would test it on your own library.

Testing SOP drafting on a change you already assessed: ten weeks, with recall as the first number

In shortTake a regulation or site change where you know what your team found. Plant a few known misses: test steps you know need a change. Run it blind against your record, then run live revisions in one department with people deciding everything. Decide on three numbers: recall, edits per draft and days from draft to signature.

1. Pick the past change, pull its gap assessment and its follow-up revisions, and time five current revisions.
2. Write the answer key: every step that needed a change, including ones found later, reviewed by your best QA reader.
3. Replay it blind on a copy of the library, with three or four planted misses, and compare step by step.
4. Run live revisions in one department, with the owner working as usual and quality signing the real record.
5. Decide on your numbers, with QA's written position on Annex 22 and on how you would qualify the tool.

Recall, draft edits and draft-to-signature days on your own library

Track all six. Recall, edits per draft and days from draft to signature are the three you decide on.

Writing a GMP SOP, review intervals, AI drafting and Part 11: the GxP SOP authoring FAQ

In shortTwelve questions quality teams search for, each with a complete answer.