You discover that the person you hired three months ago has been following an onboarding procedure that was superseded a year ago. The updated version sits in a Teams channel they were never added to. Nobody told them. Nobody thought to.
This is the SOP storage problem in its most recognisable form: a document that exists somewhere, just not somewhere the right person thought to look, or trusted once they found it. Choosing the right home for your procedures is partly a software decision and mostly a governance one.
What are your realistic options for SOP storage?
For owner-managed businesses with 5 to 50 staff, the realistic options are your existing productivity suite (Microsoft 365 or Google Workspace), a dedicated knowledge or project tool such as Notion, ClickUp, or Monday.com, a formal quality management system for regulated sectors, or a basic shared drive. For service businesses in this size band, the practical question usually comes down to the first two.
Basic shared drives and file servers are where many firms still store their procedures. They are also the option most likely to generate the version confusion described above. The folder labelled “SOPs” fills quickly with files named “Onboarding_v3_FINAL_revised.docx” and nobody can confirm which is live. Collaboris, a UK SharePoint consultancy, identifies centralised storage with clear naming conventions as the first discipline, because fragmented storage is the root cause of staff reverting to informal methods.
Quality management systems occupy a different category. They suit firms operating under formal regulatory frameworks: MHRA oversight, UKAS accreditation, ISO 13485. The implementation overhead and licence cost is disproportionate for a professional services firm without that kind of regulatory exposure. If your sector requires formal document control with audit trails and training records, the QMS path is worth evaluating on its own terms. Otherwise, the contest is between your productivity suite and a knowledge tool.
When does your productivity suite work best as an SOP home?
If your team already relies on Microsoft 365 or Google Workspace for the bulk of its daily work, that suite is often the natural home for SOPs. SharePoint and Google Shared Drives give you role-based permissions, version history, and audit trails at no extra licence cost. Staff can reach procedures from within Teams or Google Docs. The risk is that poor folder structure quickly erodes that convenience.
Both Microsoft and Google provide multi-factor authentication, encryption at rest and in transit, and compliance certifications including ISO 27001 and SOC 2. The NCSC recommends assessing SaaS providers for identity and access management and data residency options, and both platforms meet the bar for typical owner-managed business use cases.
Three disciplines make or break the approach. First, a clear top-level folder hierarchy by function: Operations, HR, Finance, Quality, IT. Second, a named owner for the SOP library who enforces naming conventions and review dates. Third, a lightweight approval step before any document is overwritten, even if that step is a shared review in a Teams channel rather than a formal workflow.
One newer consideration: both Microsoft Copilot and Google Gemini can now search across documents in your suite. That can make SOPs easier to find. It also means sensitive procedures, including incident response plans and HR content, may surface in AI results if permissions are not set deliberately. The NCSC’s guidance on generative AI in organisations is clear that sensitive material fed into general-purpose AI tools can be exposed unless configurations are explicitly locked down. Check your access settings before enabling AI search features across the whole organisation.
When does a dedicated knowledge tool earn its place?
The argument for Notion, ClickUp, or Monday.com shifts when procedures need to live inside the work itself. If a client onboarding SOP should appear as a checklist the moment someone creates a new project, embedding it in a project tool means it arrives at the right time rather than requiring a team member to remember to look for it.
This is the central advantage described in guidance from Slack and MaintainX: SOPs can become task templates. Create a new client onboarding project and the checklist appears. Complete a step and the procedure logs as done. For teams running repeatable client delivery cycles or operational checklists, the integration of procedure and execution is more useful than any feature comparison suggests.
The disadvantages are worth naming clearly. Many of these platforms are US-based, which creates UK GDPR obligations around international data transfers. Before committing, check where the provider’s primary data centres are located and what transfer mechanisms are in use. Some tools also have weaker granular access controls than enterprise document management systems, which matters when SOPs contain sensitive HR or security content.
The bigger risk is tool sprawl. If procedures drift across Google Drive, Notion, and ClickUp because different teams have different preferences, staff face a harder problem than the original one. They are no longer uncertain about where the document might be. They have stopped looking altogether.
What does it cost to store SOPs in the wrong place?
The cost of a poorly stored procedure library accumulates before anyone notices. New starters follow outdated steps, pricing gets quoted inconsistently across the team, and security procedures sit unused because staff cannot find them when something goes wrong. The ICO’s enforcement record illustrates where this trajectory ends for firms that delay addressing it.
The ICO fined British Airways £20 million in 2020 after a breach that exposed personal data of approximately 400,000 customers. The investigation found poor security arrangements and inadequate access controls. Marriott International was fined £18.4 million for similar failures. Both involved large organisations, but the ICO’s analysis applies to smaller firms equally: inadequate technical and organisational measures includes failing to ensure that staff know and can follow security procedures.
For regulated firms, the FCA has taken enforcement action against financial services companies specifically for inadequate systems and controls, including policies and procedures that staff did not follow, often because they could not find them or did not trust that what they found was current.
Cyber insurance underwriters have added detailed questions about documented security procedures and incident response plans to their proposal forms. Firms without findable, current procedures face higher premiums or disputed claims when an incident occurs.
What should you ask before committing to a tool?
Before choosing a platform, start with governance rather than features. A tool can have excellent version control and search capability, but if no one is named as the library owner, if SOPs carry no review dates, and if there is no approval workflow for changes, the platform is unlikely to change what staff actually do.
The questions worth asking are grouped below by what actually matters.
On ownership and review: Who is the named owner of the SOP library by role, not by name? Does each procedure have a review date and a subject-matter owner? How will changes be approved and recorded?
On findability: Can a new hire find the relevant SOP in under sixty seconds without asking a colleague? Does the tool support full-text search across document titles and body content? Can you cross-link related procedures?
On security and data protection: Where is the data stored, and what certifications does the provider hold? Can you restrict sensitive SOPs to named groups? Do any AI features index SOP content, and can you control whether they do?
On exit: Can you export all SOPs and their version history if you move to a different tool?
One final point worth raising with your team. The ICO’s guidance on cloud computing is clear that you remain accountable as the data controller for information stored in any SaaS platform, and that supplier contracts must reflect adequate security guarantees. If your SOPs contain personal data, including staff names, customer data-handling instructions, or incident logs, the platform’s data protection credentials matter as much as its search interface.
If you want to think through how this fits into how your business runs, Book a conversation.
