SOPs · 11 min read
Policy vs Procedure vs SOP: What Is the Difference?
A policy says what must happen and why. A procedure says who does what, and in what order. An SOP, or standard operating procedure, gives the exact steps for one routine task. So a policy might require that a leaver loses system access on their last day, the procedure explains how HR and IT coordinate that, and the SOP walks the IT administrator through the clicks.
The three get mixed up because many companies use the words loosely, and because there is no legal definition that fixes them. It matters anyway, since each document needs a different owner, a different approver and a different audience. Put steps in a policy and you end up asking the whole company to re-acknowledge a screenshot change. Put a rule in an SOP and the people it applies to may never read it. I’ve been through ISO 9001 audits more than ten times, and in an audit the labels matter less than whether each document does its own job and the people concerned can show they follow it.
Policy vs procedure vs SOP at a glance
This table sums up the usual pattern in a small or growing company. Your own titles may differ, and what matters is that each document has a clear owner and a clear job.
| Policy | Procedure | SOP | |
|---|---|---|---|
| Answers | What must happen and why | Who does what, and in what order | Exactly how to do one task, step by step |
| Reads like | A short statement of a rule | A sequence across people or teams | Numbered instructions a new person can follow |
| Usually written by | A department head | The team running the work | The person who does the task |
| Usually approved by | Leadership or the board | The function head | The team lead or quality lead |
| Who reads it | Everyone it applies to | The people involved in the work | The people doing that task |
| Reader’s obligation | Usually to acknowledge it | To follow it | To follow it, and often to be trained on it |
| How often it changes | Rarely | Sometimes | Whenever the tool or task changes |
| Length | One to three pages | Two to five pages | As long as the task needs |
One subject, written three ways
The easiest way to see the difference is to take one subject through all three layers. Here is how our example company, ShiftTilt, handles system access when someone leaves.
Notice how each one changes at its own speed. If ShiftTilt moves to a new identity provider, the SOP is rewritten, the procedure probably stays the same and the policy doesn’t move at all. If it splits IT into two teams, the procedure changes. Only a decision by leadership, such as giving contractors a longer grace period, changes the policy. Keeping the layers apart means a change touches one document and goes to the people it affects, and nobody else gets a pointless request.
What is a policy?
A policy is a decision the company has made, written down. It states the rule, who it applies to, why it exists and what happens if someone breaks it. A good one is short and survives changes in tools, because it doesn’t name them. Our guide to the policy on policies sets out what each policy should contain.
Many laws ask for policies by name. The HIPAA Security Rule requires covered entities to implement “reasonable and appropriate policies and procedures”, and it is one of the clearest examples of a rule that asks for both documents as separate things.
Source: 45 CFR 164.316(a)
Since a policy binds people, it usually needs proof that they saw it, which is why policies are the document most often sent for attestation or acknowledgment.
What is a procedure?
A procedure turns a rule into coordinated work. It names roles rather than people, sets the order of events and shows where one team hands off to another. Its reader is someone taking part, who needs to know what is expected of them and who comes next.
Regulators care about procedures because they are what people actually follow. FDA rules for drug manufacturing say “there shall be written procedures for production and process control”, and OSHA’s process safety rule requires employers to develop written operating procedures. In both cases the law requires a documented way of working, and an inspector can compare it with what is happening on the floor.
Sources: 21 CFR 211.100(a), 29 CFR 1910.119(f)
What is an SOP?
A standard operating procedure is a set of written instructions for a routine task, detailed enough that a trained person gets the same result each time. EPA guidance describes SOPs in much the same way, as written instructions documenting a routine or repetitive activity. SOPs are common wherever consistency is the point, such as labs, manufacturing, healthcare and finance operations.
Source: EPA, Guidance for Preparing Standard Operating Procedures (EPA QA/G-6)
Good SOPs are written by the people doing the work, tested by someone who hasn’t done it before, and updated when the task changes. Our guide to creating SOPs covers the ten steps, and our document control procedure explains how to keep them under control.
Is a procedure the same as an SOP?
Often, yes, and this is where most of the confusion sits. Many companies use the two words interchangeably, particularly in regulated industries, where every controlled procedure is called an SOP. Others, including most quality systems, keep a procedure as the cross-team view and an SOP or work instruction as the view of one task.
No rule forces either choice. ISO 9001:2015, for example, moved away from requiring documented procedures and now talks about documented information, leaving you to decide what form it takes. Pick one meaning, write it into your document control procedure and use it everywhere. An auditor will accept your terms if you apply them consistently, and a new hire will thank you.
Source: ISO 9001:2015, clause 7.5
Standards, guidelines, processes and work instructions
Most compliance frameworks use a few more words, and once a company passes about 50 people you will start to need some of them. Here is how the whole family fits together, from the broadest to the most specific.
| Term | What it is | Example |
|---|---|---|
| Policy | A rule the company has decided on, and why | Customer data is only stored in approved systems. |
| Standard | A specific, measurable requirement that supports a policy | Passwords have at least 14 characters. |
| Guideline | Recommended good practice, with room for judgment | Prefer a video call for difficult feedback. |
| Process | The high-level flow of work from start to finish | Quote, order, delivery, invoice. |
| Procedure | Who does what within that flow, and when | Sales sends the signed order to finance within a day. |
| SOP | A controlled, step-by-step instruction for a routine task | How to create an invoice in the accounting system. |
| Work instruction | The finest detail for one step, often at the workstation | How to set the label printer for size B. |
| Form or record | What gets filled in as proof that the work happened | A signed inspection sheet. |
The test for a guideline is simple. If someone could ignore it and face no consequence, it is a guideline, and if they could be disciplined, it is a policy and should be called one. Mislabeling a rule as a guideline is a common way to end up unable to enforce it.
Policy, procedure and SOP examples
Here are four more subjects, taken through the same three layers. They are illustrations, so adjust the limits and timings for your own company and your own rules.
| Subject | Policy | Procedure | SOP |
|---|---|---|---|
| Expenses | Spending over a set limit needs approval first. | The employee asks the manager; the manager approves; finance reimburses in the next pay run. | How to submit a claim in the expense tool, with the receipt photo rules. |
| Data breach | Suspected breaches are reported within one hour, with no blame for reporting. | The finder tells IT; IT assesses; legal decides who to notify. | How IT isolates a laptop and preserves logs. |
| Workplace safety | Only trained and certified people drive forklifts. | The supervisor assigns drivers; safety checks certificates every quarter. | The daily pre-use forklift inspection, step by step. |
| New hires | Every new hire confirms the core policies in week one. | HR adds the person; IT sets up access; the manager runs the first-week plan. | How HR creates the account and sets the right tags or groups. |
How to tell which document you are writing
- Would leadership need to agree to change it? If so, it is a policy.
- Does it involve more than one role or team? It is probably a procedure.
- Could a new person follow it alone at a screen or a machine? It is an SOP or a work instruction.
- Does it name a specific tool? It shouldn’t be in a policy.
- Does it contain the words should consider? It is a guideline, unless you meant must.
- Does it prove something happened? It is a form or a record, and it needs to be kept.
What auditors do with these documents
An auditor treats the layers as a chain. They start with the requirement, ask for the policy that answers it, read the procedure that puts it into practice, then pull records to see whether people did what the documents say. They may also interview someone doing the work, and compare the answer with the SOP. Our guide on how to prepare for a compliance audit walks through how a sample turns into a finding.
This has a practical consequence: the more you write down, the more you can be held to. A procedure that promises a quarterly check creates a finding the first quarter you miss it. Write what you really do, then do what you wrote.
Common mistakes
Putting steps in the policy. A policy full of screenshots goes out of date quickly, and every fix sends it back for approval and acknowledgment. Move the steps to an SOP and link to it.
Writing a policy with no procedure behind it. “We review access quarterly” is a promise. If nobody owns the work, it fails the first time an auditor samples it.
Giving a document no owner. Each one needs a named person who keeps it current. Our guide to policy owners covers how to choose them.
Sending everything to everyone. People stop reading when most of what arrives doesn’t apply to them. Send a policy to everyone it covers and an SOP only to the people who do the task.
Mixing terms between teams. If HR calls something a policy and IT calls the same kind of document a standard, write one short definition list and use it everywhere.
Keeping them in different places. Procedures that live in a wiki and policies that live in a drive drift apart, and nobody notices until an audit. Our guide to policy governance shows how to hold the whole set together.
How to manage policies, procedures and SOPs in AllyMatter
We built AllyMatter so that all of these documents can live in one place and still be handled differently. Every document goes through an approval flow before anyone sees it, and each one keeps its version history. Tags decide who sees what, so a policy can go to the whole company while an SOP goes only to the people holding a warehouse or finance tag.
The difference comes at distribution. You choose per document whether people acknowledge it or are simply informed, so a policy can collect a record by name with reminders, while a procedure update can just notify the team. Review dates keep each one on its own schedule, and version compare shows every word removed and added. For an SOP, you can embed a Loom recording or a diagram in the page, and attach related records as evidence.
Questions about policies, procedures and SOPs
What is the difference between a policy and a procedure?
A policy states what the company requires and why. A procedure explains who does what, and in what order, to meet that requirement. For example, a policy might say that all suspected data breaches are reported within one hour, and the procedure explains who gets told and what each of them does next.
Is an SOP a policy?
No. A policy is a rule, and an SOP is a set of steps for doing a task. An SOP often exists because of a policy, but it can change whenever the tool or task changes, without the rule itself changing.
What is the difference between a procedure and an SOP?
In many companies the two words mean the same thing, and that is fine as long as you are consistent. Where they are separated, a procedure describes who does what across a piece of work, and an SOP gives the exact steps for one routine task. Regulated companies often use SOP for any controlled procedure.
Which comes first, a policy or a procedure?
The policy comes first, because it sets the rule that the procedure has to meet. In practice, many small companies already have a working procedure and write the policy afterward to record the decision behind it, and that is a perfectly good way to start.
What is the difference between a policy and a guideline?
A policy is mandatory, and breaking it has consequences. A guideline is advice, and people can use judgment. If you would discipline someone for ignoring it, it is a policy, so don’t call it a guideline.
What is the difference between a process and a procedure?
A process is the overall flow of work from start to finish, such as quote to cash. A procedure is the detail of how one part of that flow gets done, including who does it and when.
Can policies and procedures be in the same document?
They can, and for a small company with a short list it can be a sensible start. The catch is that every procedural change then reopens a document that leadership approved and everyone acknowledged, so most companies separate them as the list grows.
Does a small business need all of these?
No. A company of 20 people usually needs a set of policies and a few SOPs for tasks that have to be done the same way every time. Standards, guidelines and work instructions can wait until an audit, a customer or a mistake calls for them.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.