If you don't use any ORM in our application, then you better place all your SQL code into stored procedures.

There are no standard rules which specify where to use stored proc or application embedded SQL code. However it's considered by many to be the best practice to use stored procs!