Strategy

AI Can Draft an SOP in Five Minutes. The Governance Around It Still Takes Months.

AI shrinks the drafting problem. It does not shrink the governance problem.

By Matthew Bixby · 5 min read

AI can draft a usable SOP in five minutes.

The operating system around the SOP is still the work.

I see this every time we walk into a system rollout. The new HRIS goes live. Forty SOPs need to exist. AI gets the first draft to ninety percent in an afternoon. Then the real problem starts.

What AI does not touch

Once the draft is sitting in a Google Doc, the team runs into the same four walls every time.

Review ownership is fuzzy

"QA owns it" or "Compliance owns it" — which means no one does. The SOP sits in a shared drive while two people each assume the other will trigger the review.

Approvals happen in inboxes

The draft gets emailed to three people. One replies "looks good," one redlines a paragraph and replies-all, one never responds. The approval state is somewhere between approved and pending depending on who you ask.

Acknowledgments live in another system

Or a spreadsheet. Or a Slack thread. Or nowhere. When a new version goes out, the old acknowledgments stay valid. When a new hire joins, no one knows whether they acknowledged the current version.

Audit proof has to be rebuilt by hand later

Three months before the audit, someone starts a panic-spreadsheet of which SOPs are current, who approved them, who acknowledged them. It takes two weeks. It is wrong in three places.

AI shrinks the drafting problem. It does not shrink the governance problem.

The eighty-five percent

Drafting is the easy fifteen percent. The other eighty-five percent is the actual work.

  • Ownership — One named person, not a team, not a queue. The named person is on the hook for the next review.
  • Review cadence — Calendar-based, not "we should review annually." Real date. Real owner. Real alert.
  • Approval routing — Defined chain, timestamped, recorded. No more "I think Jane approved it in Slack."
  • Acknowledgment — Captured at the moment the SOP becomes effective. When a new version publishes, prior acknowledgments invalidate.
  • Evidence — Point-in-time exports. Auditor asks for what version was current on March 15. You respond in minutes.
  • Mapping — Every SOP tied to the compliance controls it satisfies. When a framework updates, you remap — you do not rebuild.

That is the part we built SOP Studio for.

What this looks like in practice

A 220-person specialty healthcare provider we worked with had eighty-seven active SOPs and a SOC 2 audit in March. The drafting was not the problem — they had the documents. The problem was that nobody could answer simple questions:

  • Which version of the data-handling SOP was effective on January 1?
  • Who approved the updated incident response procedure?
  • How many people have acknowledged the current breach notification SOP?
  • Where is the policy-to-control mapping for the auditor?

The answers existed. They were just scattered across seven different surfaces — a Google Drive folder, an email thread, a spreadsheet maintained by one person who was about to go on PTO, and three people's memories. Two weeks of manual reconstruction every audit cycle.

That is not an AI problem. AI made the drafting faster. It did not give them an answer to any of the questions above.

The fix was a controlled workflow that captured ownership, approvals, acknowledgments, and evidence by default — at the moment things happened, not in retrospect.

What to do if this sounds familiar

If your team is about to rewrite a stack of SOPs because of a system rollout, an audit, or a new compliance push, the question to ask is not “how do we draft these faster.” AI already solved that.

The question is: after the draft exists, what happens?

If the answer is “we email it around, hope people read it, and figure out the audit story later,” the audit will surface every gap. Every time.

Matthew Bixby is co-founder of SOP Studio and a principal at McBix Consultants. MBA, PMP, SPC, LSSBB.