From Filing Cabinet to Board Pack: Why Your SOPs Are Governance Evidence

Ask an owner-manager where the company's standard operating procedures live and the answer is often a shared drive, a filing cabinet or the memory of a long-serving office manager. That is understandable in a growing SME. It is also a governance weakness. When a customer dispute, insurer, auditor or buyer asks how a process is controlled, the SOP is the answer — provided it has an owner, a version and a trail.

The binder is not the control

An SOP that nobody owns, reviews or approves is not a control. It is a document. In governance terms, a control needs a design, an owner, operating evidence and a review cycle. When an auditor asks for the policy on credit control, or a buyer asks how supplier onboarding works, a dog-eared binder proves only that paper existed. The board should care because internal control is part of the directors' oversight of the company, not an administrative hobby for the office manager.

Boards approve frameworks, not every procedure

The board does not need to read every SOP. It needs to approve a document control framework and the critical few procedures that underpin the business model. A one-page SOP register is usually enough: title, process owner, accountable director, version, effective date, next review date, linked risk and criticality. That register belongs in the board pack at least annually. It gives directors a map of the control environment without inviting them into operational minutiae.

Give every critical SOP a named owner

Ownership is the difference between a living document and an archaeological find. The process owner is the person who runs the process. The accountable director is the board member who answers for its control. Both should be recorded. When the owner leaves, the SOP should be reassigned before the leaving date, not after the next incident. In a small team, this matters more, not less: the departure of one person can remove the only practical knowledge of a critical process.

Version control can be simple

Version control does not require enterprise software. A consistent convention — V1.0, effective date, author, approver, next review — plus one controlled location is enough for most SMEs. Retire superseded versions. Mark printed copies as uncontrolled. Keep a short change log for critical procedures. The test is whether a new starter can find the current version in under a minute and whether the board can prove which version was in force on a given date. If the answer is no, the document is not yet a governance asset.

Link SOPs to the risk register

The risk register and the SOP register should talk to each other. If the register identifies supplier failure as a principal risk, the controls should point to the supplier onboarding, credit check and business continuity procedures. If cyber incidents are a risk, the access control and backup SOPs are the evidence. This traceability turns a list of risks into an assurance map. It also stops the board from approving a risk appetite that operations cannot deliver.

Evidence in audits, disputes and due diligence

Auditors ask for policies and for evidence that they operate. Customers ask for quality and information security assurances. Insurers ask how incidents are handled. In a dispute, a documented procedure and training record can show that the company took reasonable steps. In a sale, a buyer's due diligence team will ask for the same documents; a business with controlled SOPs is easier to diligence and easier to trust. The commercial value is not theoretical. It is the difference between saying that a process is managed and showing that it is.

A board routine for SOPs

Put the SOP register on the annual board calendar. Once a year, review the critical procedures and confirm owners. Once a quarter, look at exceptions: overdue reviews, incidents, audit findings. After a serious incident, require a root-cause review that ends in an SOP change, not just a memo. Minute the approvals. A board that can show a controlled SOP framework is demonstrating internal control without pretending to be a listed company.

The small-company objection

Owner-managers often say they are too small for document control. The opposite is usually true. In a small team, knowledge sits in fewer heads, so the loss of one person is proportionally greater. A five-person firm does not need fifty SOPs; it needs five critical ones, properly owned. The risk is not having too few documents. It is having documents that nobody trusts.

The question for the board is not whether SOPs exist. It is who owns them, when they were last reviewed, which risk they control and whether the company can prove they operate. Treat the answer as governance evidence, and the operations manual stops being an office artifact and becomes a board document.