What Should a Standard Operating Procedure Include?

Key takeaways

ISO 9001:2015 Clause 4.4.2 (iso.org/standard/62085.html) requires that a quality management system retain documented information to support the operation of its processes. An SOP that names the owner, the trigger, and the decision authority for each step satisfies that requirement. An SOP that says only 'the team reviews the output' does not, because it names no person and no decision criterion.
In Dave by voolama (hellodave.ai), the ten workflow node types map directly to SOP step types: User Interaction for steps where a person provides input, Human Review for steps where a person approves or rejects, Agent Interaction for steps where AI drafts content automatically, Routing for decision points, and Information for documented context the team needs during execution. Sourced from the workflow-editor help documentation, DEV v0.11.0, confirmed 2026-08-30.
The Human Review task in Dave by voolama (hellodave.ai) is the mechanism that enforces the SOP's decision points at runtime. When a workflow instance reaches a Human Review node, it pauses and creates a task in the Task Inbox for the named reviewer. The reviewer reads the Payload, clicks Approve, Reject, or Request Changes, and adds an optional Comment. Only Admin and Use roles can view the Task Inbox and submit decisions. Sourced from the tasks help documentation, DEV v0.11.0, confirmed 2026-08-30.
COSO Internal Control Integrated Framework, Control Activity principle 10 (coso.org/guidance-on-ic), requires that control activities address the specific risk. For a small team using AI, the specific risk is an AI-generated output reaching a client, a customer, or a public channel without a named person having confirmed it. The SOP's decision point section names who decides and what criterion they apply. The Human Review node enforces it at runtime.
Dave by voolama (hellodave.ai) has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. Only Admin and Curate roles can open the Workflow Editor, add nodes, connect edges, and save versions. Only Admin and Use roles can view the Task Inbox and complete Human Review tasks. The SOP's owner column must match the role that has permission to perform each step. Sourced from the workflow-editor and tasks help documentation, DEV v0.11.0, confirmed 2026-08-30.

Summary

A fill-in SOP template for small teams, with seven required sections and a column showing which Dave by voolama workflow node handles each step. Grounded in ISO 9001:2015 Clause 4.4.2, COSO Control Activity principle 10, and the workflow-editor and tasks help documentation.

The SOP template: fill this in before building your workflow

Copy the template below. Fill in every section before building the workflow in Dave by voolama (hellodave.ai). The Node Type column tells you which node to place in the Workflow Editor for each step. Drag the node type from the Node Palette onto the canvas, rename it to match the Step Name, and connect it in sequence. Sourced from the workflow-editor help documentation, DEV v0.11.0, confirmed 2026-08-30.

STANDARD OPERATING PROCEDURE

SOP Title: [PLAIN-LANGUAGE NAME FOR THIS PROCESS]
SOP ID: [YOUR INTERNAL REFERENCE NUMBER, e.g., SOP-001]
Version: [VERSION NUMBER, e.g., 1.0]
Date: [DATE THIS VERSION WAS WRITTEN]
Owner: [FULL NAME, TITLE]
Reviewed by: [FULL NAME, TITLE]
Review date: [DATE]

SECTION 1: PURPOSE
What does this process do, and why does it exist?
[Write 2-4 sentences. Name the output this process produces and the risk it controls.]

SECTION 2: TRIGGER
What starts this process?
[Name the specific event, request, or schedule that causes someone to run this SOP.
Examples: 'A new client submits an intake form.' / 'Every Friday at 9 a.m.' / 'A guest sends a message through the booking platform.']

SECTION 3: NUMBERED STEPS
[Add or remove rows as needed. Every step must have a Node Type.]

Step | Step Name | Who Does It | What They Do | Node Type (Dave by voolama)
-----|-----------|-------------|--------------|----------------------------
1 | [NAME] | [ROLE] | [ACTION] | Start
2 | [NAME] | [ROLE or AI] | [ACTION - if AI drafts, name what facts it needs] | User Interaction OR Agent Interaction
3 | [NAME] | [ROLE] | [DECISION - name the criterion] | Human Review
4 | [NAME] | System | [BRANCH - name the condition] | Routing
5 | [NAME] | [ROLE or AI] | [ACTION] | [Node Type]
... | ... | ... | ... | ...
N | [NAME] | System | End | End

SECTION 4: DECISION POINTS
[List every Human Review step from Section 3. Name the criterion the reviewer applies.]

Step | Decision Name | Who Decides | Criterion for Approve | Criterion for Reject | Criterion for Request Changes
-----|---------------|-------------|----------------------|---------------------|------------------------------
[#] | [NAME] | [FULL NAME OR ROLE] | [SPECIFIC CONDITION] | [SPECIFIC CONDITION] | [SPECIFIC CONDITION]

SECTION 5: DEFINITION OF DONE
What does a completed, acceptable output look like?
[Write 3-6 bullet points. Each must be specific enough that two different reviewers would reach the same conclusion.]
- [ ] [SPECIFIC CRITERION 1]
- [ ] [SPECIFIC CRITERION 2]
- [ ] [SPECIFIC CRITERION 3]

SECTION 6: WHAT THIS PROCESS DOES NOT COVER
[Name at least two things this SOP explicitly does not cover.]
- This SOP does not cover: [EXCLUSION 1]
- This SOP does not cover: [EXCLUSION 2]

SECTION 7: VERSION HISTORY
Version | Date | Changed by | Summary of changes
--------|------|------------|-------------------
1.0 | [DATE] | [NAME] | Initial version

Node type reference: which Dave by voolama node maps to which SOP step

The Node Type column in Section 3 of the template maps each SOP step to one of the ten node types in the Dave by voolama (hellodave.ai) Workflow Editor. Drag the correct node type from the Node Palette (left sidebar) onto the canvas and rename it to match the Step Name. Only Admin and Curate roles can open the Workflow Editor, add nodes, and save versions. Sourced from the workflow-editor help documentation, DEV v0.11.0, confirmed 2026-08-30.

SOP Step Type	Node Type	Color / Icon	Creates Task Inbox item?	When to use it
Process start	Start	Green / Play	No	The first node in every workflow. Maps to the Trigger in Section 2 of the SOP.
Person provides input or content	User Interaction	Blue / User	Yes	A team member submits facts, a form, or content the workflow needs. Maps to any step where a person is the actor and the output is data or content.
Person approves, rejects, or requests changes	Human Review	Amber / Eye	Yes	A named reviewer reads the Payload and clicks Approve, Reject, or Request Changes. Maps to every row in Section 4 (Decision Points). Only Admin and Use roles can complete Human Review tasks.
AI drafts content automatically	Agent Interaction	Purple / Bot	No	An AI agent processes the workflow context and returns a result without human involvement. Maps to steps where AI produces a draft. Requires an agent to be configured.
AI checks quality automatically	Agent Review	Pink / Bot	No	An AI agent evaluates content against defined criteria and returns pass/fail. Maps to automated quality checks before a Human Review step.
Conditional branch	Routing	Purple / GitFork	No	Logic-only branching based on a field value or condition. Maps to branch conditions in Section 3.
Documented context for the team	Information	Indigo / Info	No	A documentation or annotation node that does not affect execution. Maps to the Definition of Done (Section 5) and reference information the team needs during the workflow run.
External system call	API Call	Cyan / Zap	No	Calls an external REST API and maps the response back into the workflow context. Maps to steps that fetch or send data to an external system.
Content safety check	Safety	Teal / Shield	Possible	Runs content safety and compliance checks. Maps to steps that screen output for policy violations before a Human Review.
Process end	End	Red / Square	No	A terminal node marking workflow completion. A workflow can have multiple End nodes for different outcomes.

What this template does not cover: six open limits

This template covers the seven sections a small team SOP must include and the mapping from SOP steps to Dave by voolama (hellodave.ai) workflow node types. Six things this template does not cover:

This is not legal or compliance advice. The ISO 9001:2015 Clause 4.4.2 and COSO Control Activity principle 10 citations are to publicly available documents. Whether a specific SOP satisfies a specific regulatory requirement requires a qualified professional's assessment. Dean Brown is not a licensed ISO 9001 lead auditor, quality management professional, or compliance attorney.
Regulated industries have additional SOP requirements beyond ISO 9001:2015 Clause 4.4.2. Healthcare SOPs are subject to FDA 21 CFR Part 820 (Quality System Regulation). Financial services SOPs are subject to FINRA Rule 3110 and SEC Rule 17a-4. Food production SOPs are subject to FDA 21 CFR Part 117 (FSMA Preventive Controls). This template provides a general structure. Industry-specific requirements must be layered on top by a qualified professional in that industry.
This template does not cover how to configure AI agents. The Agent Interaction and Agent Review node types require an AI agent to be configured before the workflow can run. Agent configuration is covered in the Dave by voolama agents help documentation and at hellodave.ai/learn-dave/build-your-first-workflow.
This template does not cover ISO 9001:2015 certification. ISO 9001:2015 certification requires a third-party audit by an accredited certification body. Using this template does not constitute or imply ISO 9001:2015 certification.
Dave by voolama does not publish or distribute the SOP output. The platform generates drafts and records Human Review decisions. Distributing the output to clients, customers, or external systems is a separate step outside the platform.
This template does not substitute for a qualified operations or process consultant. A small business implementing SOPs for the first time may benefit from working with a qualified business operations consultant who can assess the specific risks and regulatory requirements of the business's industry and location.

Frequently asked questions

Why does an SOP need a named owner rather than just a team or department?

Because a team cannot be held accountable: only a person can. ISO 9001:2015 Clause 4.4.2 (iso.org/standard/62085.html) requires documented information that supports the operation of processes. A process with no named owner has no one responsible for keeping it current, no one to contact when a step fails, and no one whose approval is recorded in the audit log. In Dave by voolama (hellodave.ai), the Human Review task records the acting user's ID with every decision. That record is only useful if the SOP names who is supposed to be in that role.

What is the difference between a decision point and a step in an SOP?

A step is an action: draft the document, send the message, check the figure. A decision point is a judgment: does this output meet the standard, or does it need revision? In Dave by voolama (hellodave.ai), steps map to Agent Interaction nodes (AI does the work) or User Interaction nodes (a person provides input). Decision points map to Human Review nodes, which pause the workflow and create a task in the Task Inbox. The reviewer clicks Approve, Reject, or Request Changes. Without a named decision point in the SOP, the workflow has no node to pause at and the output goes forward without review. Sourced from the workflow-editor help documentation, DEV v0.11.0, confirmed 2026-08-30.

How does the Information node in Dave by voolama relate to an SOP?

The Information node (indigo/Info icon in the Node Palette) is a documentation or annotation node that does not affect execution. It is the correct place to store the SOP context the team needs during a workflow run: the definition of done, the quality criteria, the client's preferences, or the regulatory requirement that applies to this process. The workflow-editor help documentation (DEV v0.11.0, confirmed 2026-08-30) states: 'Use it to add notes, context, or instructions directly on the canvas.' The SOP's Definition of Done section maps directly to the Information node's content.

Who can build the workflow from the SOP in Dave by voolama?

Only Admin and Curate roles can open the Workflow Editor, add nodes, connect edges, and save versions. The Create role cannot access the Workflow Editor. The Use role cannot access the Workflow Editor. The SOP owner who designs the process and the person who builds it in Dave by voolama (hellodave.ai) may be different people: the owner writes the SOP, and the Admin or Curate role holder translates it into the workflow graph. Sourced from the workflow-editor help documentation, DEV v0.11.0, confirmed 2026-08-30.

How often should a small team review and update its SOPs?

ISO 9001:2015 Clause 4.4.2 (iso.org/standard/62085.html) requires that documented information be maintained and retained. It does not specify a review interval: that is the organization's decision. A practical minimum for a small team: review each SOP when the process it describes changes, when a Human Review task is rejected more than twice in a row for the same reason (which signals the SOP's definition of done is unclear), or when a new team member cannot follow the SOP without asking for help. Record the review date and the reviewer's name in the SOP's Version History section.

Sources

Last reviewed Nov 6, 2026