Most compliance teams have both SOPs and workflows — and use the words interchangeably without realizing they're describing different things. That confusion creates real gaps: SOPs that are thorough on paper but unenforceable in practice, and workflows that are executed consistently but produce no evidence of the standard they followed. Getting the relationship right between the two is what separates a compliance program from a compliance library.
An SOP (Standard Operating Procedure) is a document that defines the standard. It specifies what should be done, in what order, by whom, and with what evidence of completion. It is static — a record of what the organization has decided the correct approach is. When an auditor asks 'what is your process for X?', the SOP is the answer.
A workflow is the runtime that executes the SOP. It assigns tasks, enforces sequence, triggers handoffs, gates approvals, and records evidence. It is dynamic — a live execution that produces a timestamped record of what actually happened. When an auditor asks 'show me that it ran correctly last quarter', the workflow record is the answer.
The difference matters most in regulated environments. An SOP without a workflow tells you what should have happened — it cannot tell you what did happen, who was responsible when it deviated, or whether the deviation was approved. A workflow without an SOP tells you what happened but not whether it was the right thing — there's no documented standard to measure against. Compliance requires both: the SOP defines the standard, the workflow proves adherence.
There's a common failure mode in teams that mistake one for the other. Teams that treat their workflow tool as an SOP library end up with task lists that have no documented standard — every run can diverge without anyone noticing. Teams that treat their SOP wiki as a workflow tool end up with documentation that proves nothing — the SOP was followed because someone says so, not because the system recorded it.
The practical model: maintain SOPs in your documentation system (Notion, Confluence, SharePoint). Implement them as executable workflows in your workflow tool. Version both together. When the SOP changes, the workflow version changes. When the workflow produces an unexpected record, you have evidence to update the SOP. Each system does what it does best: the SOP is the standard, the workflow is the proof.