Which Manufacturing Certifications Require SOPs?

Almost every major manufacturing certification and regulation requires SOPs or documented procedures in some form. The strongest mandates come from medical device and pharma rules like ISO 13485 and FDA cGMP, and from safety regulations like OSHA Process Safety Management, which explicitly demand written procedures. Broad quality standards like ISO 9001:2015 are more flexible: they require documented information to support your processes rather than a fixed list of named SOPs. Either way, if you want to certify or pass an audit, you need procedures written down.

This guide names the specific standards and regulations across four families, quality, medical and pharma, food safety, and safety and environmental, and tells you exactly what each one requires you to document. If your concern is the IT, data, and security side instead, the equivalent compliance frameworks that require documented procedures are covered separately. The wording matters, so we draw a clear line between standards that ask for documented information and those that mandate written procedures.

Key takeaways

• Yes, the major manufacturing certifications require documented procedures to certify and to pass audits, though the exact wording and rigor differ by standard.
• ISO 9001:2015, ISO 14001:2015, and ISO 45001 use the flexible term documented information, not a fixed list of mandatory SOPs.
• ISO 13485, FDA 21 CFR Part 211 (pharma cGMP), and several OSHA rules explicitly mandate written procedures or documented procedures.
• Food safety schemes (HACCP, FDA Part 117, SSOPs, ISO 22000 / FSSC 22000 / BRCGS / SQF) all require written plans and documented controls.
• Auditors do not just want a procedure on the shelf. They want the SOP and the records that prove you actually followed it.

Documented information vs documented procedures: the distinction that matters

Before naming standards, get this distinction right, because auditors and consultants do. Documented information is the modern, risk-based term used by recent ISO standards. It means you decide what to write down based on what your processes need, and it can be a procedure, a form, a record, or a work instruction. There is no fixed shopping list.

A documented procedure (often called an SOP) is the older, stricter requirement: a specific named procedure the standard or regulation insists you create and maintain. ISO 13485 and most FDA and OSHA rules work this way. Mixing these up is a credibility mistake, so the table at the end of this article maps each standard to which one it uses.

Quality management certifications

ISO 9001:2015 (general quality management)

ISO 9001:2015 is the world's most widely held quality management certification, used across almost every manufacturing sector. A common myth is that it forces a long list of mandatory SOPs. The 2015 revision actually dropped the previously required quality manual and the six mandatory documented procedures, replacing them with the broader concept of documented information.

That does not mean documentation is optional. Clause 7.5 governs documented information, and clause 4.4 requires you to determine the processes needed for your quality management system and maintain documented information to support their operation. In practice, that still means SOPs and work instructions wherever a process would not run consistently without them. You choose the set; you do not skip documentation.

IATF 16949 (automotive)

IATF 16949 is the automotive quality standard. It builds directly on ISO 9001 and then adds sector-specific requirements that lean heavily on documentation: control plans, the Production Part Approval Process (PPAP), and detailed work instructions at the workstation. Automotive audits expect procedures that tie the standard to what actually happens at each station, so the documentation burden is higher than plain ISO 9001.

AS9100 (aerospace)

AS9100 is the aerospace quality standard, also built on ISO 9001. It adds documented requirements unique to aviation, space, and defense work, including First Article Inspection per AS9102, configuration management, and controls for foreign object debris (FOD) and counterfeit parts. Each of those typically needs its own procedure to demonstrate control during an audit.

Medical device and pharmaceutical regulations

This family contains the most procedure-prescriptive rules in manufacturing. If you make medical devices or pharmaceuticals, written procedures are not a suggestion, they are named in the regulation.

ISO 13485:2016 (medical devices)

ISO 13485:2016 is the quality management standard for medical devices, and it is the most procedure-prescriptive standard in this guide. Unlike ISO 9001, it explicitly mandates documented procedures for roughly twenty named activities, including corrective and preventive action (CAPA), complaint handling, and design control. Where ISO 9001 says decide what to document, ISO 13485 hands you a list and says document these.

FDA 21 CFR Part 211 (pharmaceutical cGMP)

FDA 21 CFR Part 211 sets current good manufacturing practice (cGMP) for finished pharmaceuticals. The phrase there shall be written procedures runs throughout the regulation. Named examples include 211.100 (written procedures for production and process control), 211.67 (equipment cleaning and maintenance), and 211.198 (complaint handling). For a pharma manufacturer, SOPs are the literal text of compliance.

FDA 21 CFR Part 820, now the QMSR (medical devices)

FDA 21 CFR Part 820 governs medical device quality systems in the United States. It is changing: the Quality Management System Regulation (QMSR) becomes effective on February 2, 2026, replacing the former Quality System Regulation (QSR). The QMSR incorporates ISO 13485:2016 by reference, which means the documented-procedure expectations of ISO 13485 now carry the force of US federal regulation for device makers.

Food safety certifications and regulations

Food manufacturing is heavily documented, and in several cases the regulation literally names the procedures you must write.

HACCP

HACCP (Hazard Analysis and Critical Control Points) is the foundation of modern food safety. It is built on seven principles, and principle 7 is record-keeping and documentation. You cannot run a HACCP plan without documented hazard analyses, critical limits, monitoring procedures, and corrective actions.

FDA 21 CFR Part 117 (FSMA)

FDA 21 CFR Part 117, the Preventive Controls rule under the Food Safety Modernization Act (FSMA), requires a written food safety plan along with written preventive controls and sanitation controls. The word written is in the regulation, so a documented plan is mandatory, not best practice.

SSOPs (Sanitation Standard Operating Procedures)

Sanitation Standard Operating Procedures (SSOPs) are SOPs named directly in regulation. Under USDA 9 CFR 416, meat and poultry establishments must develop and maintain written SSOPs. This is about as explicit as a regulatory SOP requirement gets: the standard operating procedure is the legal artifact.

GFSI-benchmarked schemes: ISO 22000, FSSC 22000, BRCGS, SQF

The major food safety certification schemes benchmarked by the Global Food Safety Initiative (GFSI), namely ISO 22000, FSSC 22000, BRCGS, and SQF, all require documented procedures and records. Customers and retailers often demand one of these schemes, and certification audits depend on having current, followed procedures in place.

Safety and environmental certifications

OSHA Process Safety Management, 29 CFR 1910.119

OSHA Process Safety Management (PSM), at 29 CFR 1910.119(f), explicitly mandates written operating procedures for handling highly hazardous chemicals. The rule specifies required content and requires that the procedures be certified annually as current and accurate. This is one of the clearest written-SOP mandates in US workplace law.

OSHA Lockout/Tagout, 29 CFR 1910.147

OSHA Lockout/Tagout (LOTO), at 29 CFR 1910.147(c)(4), states that energy control procedures shall be developed, documented and utilized. For machines and equipment that can release hazardous energy during service, a documented procedure is required by law.

ISO 45001 (occupational health and safety)

ISO 45001 is the occupational health and safety management standard. Like other recent ISO standards, it uses documented information rather than a list of mandatory SOPs, and it requires you to maintain documented information for operational controls that manage health and safety risks.

ISO 14001 (environmental)

ISO 14001:2015 is the environmental management standard. It also uses documented information, requiring it for operational control of activities with significant environmental aspects and for emergency preparedness and response. As with ISO 9001, you choose the documents your processes need, but documentation is still expected.

Comparison table: what each certification requires

Use this table to see, at a glance, which standards demand explicit written procedures and which use the more flexible documented-information model.

Why audit-ready means more than just having an SOP

Across every standard above, auditors look for two things together: the documented procedure and the records that prove the procedure was actually followed. A pristine SOP that nobody uses, or one that no longer matches the line, is a finding waiting to happen. The hardest part of compliance is rarely writing the first version of a manufacturing SOP; it is keeping every procedure current as the process changes.

This is where capturing procedures on the floor helps. With sopmodo, an operator records a task by voice and photos while they actually do it, and the AI drafts an ordered SOP from that walk-through. A reviewer edits and exports it as a PDF or DOCX. Recording the real procedure instead of reconstructing it from memory makes it far easier to keep audit-ready SOPs accurate when equipment, materials, or steps change.

Frequently asked questions

The bottom line

Which manufacturing certifications require SOPs? Effectively all of the major ones, with the wording varying by standard. ISO 13485, FDA cGMP, and OSHA's PSM and Lockout/Tagout rules explicitly mandate written procedures, while ISO 9001, ISO 14001, and ISO 45001 require the more flexible documented information that still leads most manufacturers to write SOPs. Whatever your standard, the path to certification and a clean audit runs through procedures that are written down, kept current, and backed by the records that prove you followed them. If keeping those procedures accurate is the bottleneck, see how sopmodo captures them on the floor, or request access to try it.