How to Audit Your SOPs Before They Quietly Go Stale

Start by listing every SOP that exists, regardless of where it lives: a shared drive, a wiki, a tool like Vanta or Drata if you use one to store policy documents, or someone's personal notes app. You cannot audit what you haven't inventoried, and most companies are surprised by how many versions of the same procedure exist across different tools once they actually look.

For each one, note who wrote it, when it was last edited, and who is supposed to follow it today. That last column is often where the first problem shows up: procedures written for a role that no longer exists, or a team that has since split in two.

The only reliable way to know whether an SOP still matches reality is to watch the actual work happen and compare it step by step against the document. Reading the SOP and asking 'does this still sound right' produces confident agreement even when the real process has drifted, because people remember the intent of a procedure more clearly than its exact steps.

When you find a mismatch, resist fixing it on the spot. Note it, finish the observation, and only then decide whether the document needs to catch up to the practice or the practice needs to be pulled back in line with the document. Sometimes the drift was actually an improvement worth keeping.

Once you've compared documents against practice, every SOP falls into one of three categories:

• Still accurate: leave it alone, but log the confirmation date so the next audit knows it was checked.
• Drifted but salvageable: rewrite it to match current practice, ideally with the person who actually does the work as the reviewer.
• Dead: the tool, team, or process it describes no longer exists. Retire it instead of leaving it to confuse the next new hire who stumbles across it.

Resist the urge to rewrite everything in the drifted pile in one sitting. Fix the ones tied to the highest-risk work first.

An SOP audit that happens once and never again just delays the same problem. Put a recurring date on the calendar, tied to a trigger rather than an arbitrary interval: a tool migration, a reorg, or a role change should all trigger a re-check of the SOPs that touch them, in addition to whatever standing schedule you set.

Median pay for the operations managers who typically own this kind of audit runs close to $105,770 a year¹, which is worth knowing if you're deciding whether to own this yourself or hand it to a hire.

A rewritten SOP should read like instructions for someone who has never done the task, not like a summary for someone who already knows it. That means naming the exact tool, the exact field, and the exact decision rule, instead of phrases like 'check as needed' or 'use your judgment,' which are the two phrases that let drift creep back in unnoticed.

If you can't write a step without a qualifier like 'usually' or 'typically,' that's a sign the underlying process itself isn't settled yet, and rewriting the document won't fix that. Settle the process first, then document it.