ISO 9001 Gap Analysis

A gap analysis compares what your organisation does today with what ISO 9001 requires, clause by clause, and shows you what is missing. The standard does not require one, but it is the quickest way to turn "we want to be certified" into a list of specific work. It stops you rewriting documents that are already fine, and it shows you which gaps matter most before you spend any money.

What a gap analysis covers

A useful gap analysis goes through the requirements in clauses 4 to 10 of the standard and, for each one, asks three questions:

1. Is there something in place? A process, a document, a record or a clear, consistent practice.
2. Is there evidence? Could you show it to an auditor today?
3. Does it work? Is it followed consistently, and does it produce the intended result?

That gives each requirement one of three results: met, partly met or not met. The partial results are usually the most important. They are where a business does the right thing but can't prove it, or has a procedure nobody follows. Both are nonconformities at audit.

If you are working to ISO 9001:2015 with Amendment 1:2024, your gap analysis should include the climate change consideration the amendment added to clauses 4.1 and 4.2. If you are moving to ISO 9001:2026, run the gap analysis against the new edition's text instead.

How to run one

• Fix the scope first. Decide which sites, products and services the management system will cover. Every later judgement depends on it.
• Use evidence, not memory. Look at real records: training files, supplier approvals, customer complaints, calibration certificates and job files. Interviews tell you what people think happens. Records tell you what does happen.
• Walk the process. Follow one order or job from enquiry to delivery and check each step against the relevant requirements. You will find gaps that a document review misses.
• Record what you found, not just the score. "Partly met: supplier approval done informally, no list of approved suppliers, no re-evaluation" is useful later. "Partly met" on its own is not.

For a small business, a thorough gap analysis usually takes a few days of focused effort. It does not need to be perfect. It needs to be honest.

For a quick first view before you start, try our free ISO 9001 gap analysis tool. It asks plain-English questions clause by clause and scores your readiness in about ten minutes, with no signup, and your answers stay in your browser. It shows you where to look; the full gap analysis then gathers the evidence.

From findings to an action plan

The output of a gap analysis is not the checklist. It is the action plan built from it. Group the gaps into pieces of work, give each one an owner and a realistic date, and put the ones that block certification first:

• Documented information the standard explicitly requires, such as the scope, quality policy and quality objectives.
• Processes that produce the records auditors will sample, such as internal audit, management review and corrective action.
• Gaps in core operations, such as how you review customer requirements, control purchased products and services, and handle nonconforming output.

A short summary report for management is worth writing too. It tells top management what certification will involve, what resources it needs and when the system could be ready for audit. That is the kind of commitment the standard expects leadership to show.

Common mistakes

• Scoring the documents rather than the practice. A procedure that exists but is not followed is a gap.
• Marking everything "partly met". It feels safe but tells you nothing. Make a call.
• Doing the analysis alone. The people who do the work know where the real gaps are.
• Never going back to it. Once the system is running, internal audits take over from the gap analysis. Rerun it only when the standard changes.

Templates

Every one of our packs includes a gap analysis checklist written against the same edition as the pack's documents. The ISO 9001 pack checklist works clause by clause, with space for the evidence you found and the actions you need. The combined pack version covers ISO 9001 and ISO 14001 together. You can see the pack overview, which explains how the gap analysis fits with the rest of the documents, in our free ISO templates.

The guides below cover each stage: the checklist, the evidence to collect, the report and the action plan.