The Four Moves That Finished a 12-Month Rollout in 8

Most rollouts start with rewriting. Wrong order.

Before we rewrote a single SOP, we put every active document into one format — same voice, same structure, same naming, same metadata fields. Purpose, scope, owner, version, review cadence, applicable frameworks. Every SOP. Same shape.

This was not glamorous work. AI handled the first pass on each document. Humans confirmed. It took a week.

Why it mattered: once everything was in the same shape, the delta between old and new became obvious. About 60% of the "we need to rewrite this" list turned out to be "we need to update three sections of this." The rewrite list shrank by half before we wrote a word.

The original plan had a six-week consultant exercise to map each SOP to the underlying SOC 2 and ISO controls. That is the standard rate for that work. Three people. Six weeks. A spreadsheet at the end.

We did it differently. We fed the standardized SOP library and the framework control libraries to an AI model and asked it to propose mappings with confidence scores. Humans reviewed and adjusted in a working session.

What was a six-week exercise compressed into about four days of focused review time. The output was better than the consultant version because the model surfaced gaps we would have missed.

This sounds boring. It was the move that moved the most.

Before: each SOP had "owner: Quality team" or "owner: Compliance" or, in three cases, "owner: TBD." Review cycles slipped. Approvals stalled. When something went wrong, three people each thought the other was on it.

After: every SOP had exactly one named person attached. Not a team. Not a role. A person. By name. With an email address.

That single change cut review-cycle slippage to near zero. The named owner got the calendar alert. The named owner had the credit when the review happened on time. The named owner had the accountability when it did not. No "I thought she was doing it."

The standard pattern for acknowledgment is: SOP goes live, three months later compliance does a sweep, sends out an email with a checkbox, collects the signatures, files them.

That is acknowledgment theater. Nobody is reading the SOP at the moment they check the box. They are clicking through to clear an email.

We flipped it. Acknowledgment was captured at the moment a person became responsible for the SOP — at go-live for existing staff, on day one for new hires, on the effective date of each new version. The acknowledgment was tied to the specific version. New version published, prior acknowledgments invalidated, re-collection triggered automatically.

The behavior change was immediate. People who had been clicking through "yes I read it" started actually reading. Because the moment they checked the box was the same moment they needed to know what was in the document.