The documented procedure (or SOP — standard operating procedure) describes HOW a process is carried out: sequence, responsibilities, criteria and the records it generates. ISO 9001:2026 no longer requires the "six mandatory procedures" of the old version — it requires documented information to the extent necessary for the consistent operation of the processes (clause 7.5). In plain words: document where the lack of a standard generates error, and no more than that.
The established structure has seven sections: 1. Purpose (why the procedure exists, in one sentence); 2. Scope (which areas and processes it applies to); 3. References (standards, other documents); 4. Definitions (terms and acronyms); 5. Responsibilities (who does what); 6. Description (the step by step itself, in the order of execution); 7. Records (which evidence the process generates, where it is kept and for how long). Complete it with the control header: code, revision, date, prepared by and approved by.
The mistake that kills procedures is writing for the auditor instead of for the user: long paragraphs, legalese, zero images. A good procedure is one that a new employee can follow alone: short sentences, verbs in the imperative, a flowchart when the logic has branches, a photo when the visual detail matters. If the document has five pages and nobody reads it, it is an audit liability, not a management asset.
The template below shows the structure applied to a real procedure for handling nonconformities. Use it as a skeleton: replace the content of the sections and keep the discipline of the format.