ISO 9001 Gap Analysis to Action Plan: How SMEs Turn Findings into Evidence
By AuditReady Editorial Team
Written and maintained by the AuditReady editorial team and checked against the current published standard text.
Published · Last updated
Part of our guide to ISO 9001 Gap Analysis.
The direct answer: what should happen after the checklist?
After the checklist is completed, every meaningful gap should be sorted into one of four outcomes:
Gap analysis outcome What it means Typical next record No action required Evidence exists and is current Keep reference to existing record Document needed A process exists but is not defined clearly Procedure, form, log or register Evidence needed A template exists but has not been used yet Completed form, schedule, minutes or checklist Improvement needed The process is weak, inconsistent or ineffective Corrective action request or action register entry
This prevents the checklist becoming a long list of comments with no clear owner. The aim is not to create paperwork for its own sake. The aim is to prove that the business understands its QMS, has filled important gaps and can maintain the system after implementation.
A simple action plan structure
A useful gap action plan does not need to be complicated. It should show enough information for the business to control the work and enough evidence for an auditor to understand what changed.
Include these columns or fields:
- gap or finding reference;
- related ISO 9001 area or business process;
- short description of the issue;
- risk or priority;
- action required;
- owner;
- target date;
- current status;
- evidence needed to close;
- closure date;
- effectiveness check, where relevant.
If the issue is significant, recurring or linked to a nonconformity, raise it through the corrective action process rather than leaving it as an informal task. The ISO 9001 pack includes a corrective action request form and register, which helps keep root cause, actions and evidence in one controlled place.
Example: turning findings into actions
The rows below are illustrative examples, not a screenshot or a claim that every business will have the same gaps. They show how to convert checklist notes into decisions.
Example gap analysis note Better action plan entry Evidence to retain “No formal management review yet.” Schedule first review, prepare inputs and complete minutes. Owner: Managing Director. Management review schedule and completed minutes “Supplier checks are inconsistent.” Define supplier approval method and update approved supplier evidence. Owner: Purchasing. Supplier record or purchasing procedure evidence “Internal audit not planned.” Create audit programme and complete first internal audit checklist. Owner: QMS coordinator. Audit programme, checklist and findings “Customer complaints are handled by email only.” Define complaint capture and review method. Owner: Operations. Complaint log or corrective action record
The wording should be specific enough that a busy owner knows what to do. “Improve supplier control” is vague. “Update approved supplier evidence for top ten active suppliers by 30 October” is usable.
Link the gap analysis to internal audit
Gap analysis and internal audit are related, but they are not the same thing. A gap analysis normally asks, “What is missing or weak compared with the intended system?” An internal audit asks, “Is the system implemented, effective and being followed?”
Once your action plan is underway, use the internal audit checklist and audit programme to test whether the closed gaps really work. For example, if the gap analysis found missing training records, the internal audit should not only confirm that a form exists. It should check whether relevant people have records, whether competence needs were considered and whether the process is maintained.
This is where templates become practical. The ISO 9001 pack includes an internal audit checklist and audit programme, so findings from the gap analysis can be carried into audit planning instead of being forgotten after document drafting.
Feed important gaps into management review
Management review is not just a meeting to satisfy a clause. It is where senior management should understand what the gap analysis found, what resources are needed and whether risks or opportunities require action.
The free Management Review Minutes sample includes the ISO 9001 Management Review Minutes form QMS-FRM-07. Its meeting details cover review date, chairperson, attendees, apologies and review period. Its required inputs include previous actions, changes in context and interested parties, performance and objectives, audit results, nonconformities and corrective actions, resources and competence, and risks, opportunities and improvement. Its action table records action or decision, owner, due date, status and evidence.
That structure is useful after a gap analysis because it turns implementation issues into management decisions. If the gap analysis shows that more audit time, training, software, calibration support or process ownership is needed, management review is the right place to record the decision and assign responsibility. The ISO 9001 management review template guide explains the review record in more detail.
Decide what is a correction, corrective action or improvement
SMEs often put every gap into one list and call it corrective action. That can make the system heavier than necessary. A better approach is to classify the work:
- A correction fixes an immediate issue, such as completing a missing record.
- A corrective action addresses cause, such as why records are repeatedly missing.
- An improvement makes the system clearer or more efficient, even if there is no nonconformity.
- A project task builds the system, such as creating the first audit schedule.
This classification helps prevent overreaction. If one meeting minute is missing, you may simply complete or recover the record if appropriate. If management reviews have never been held, you probably need a planned action with owner, date, inputs and follow-up.
Prioritise actions before writing more documents
A gap analysis can produce a long list. Do not start by writing every possible procedure. Start with risk, customer impact and certification readiness.
Useful priority questions include:
- Could this gap affect customer satisfaction, product or service conformity?
- Could it prevent the business from showing required QMS evidence?
- Is the gap repeated across several processes?
- Does the issue need management resources or a decision?
- Can the gap be closed by using an existing template properly?
This avoids a common SME problem: creating documents faster than the team can use them. A simple completed record is usually more valuable than a polished procedure that nobody follows.
How to keep evidence tidy
Evidence should be easy to find. For each action, decide where the closing evidence will live before the owner starts work. That may be a completed form, a register entry, an audit record, a training record, a management review action or a revised procedure.
Use consistent file names and revision control. Keep blank templates separate from completed records. If a document is revised, record what changed and why. If a finding closes because evidence already existed, note the evidence location rather than duplicating the record.
The goal is not to overwhelm the auditor with files. The goal is to show a clear trail from gap, to decision, to action, to evidence.
Templates and guides that help with real catalogue links
The ISO 9001 pack includes the documents SMEs typically need to move from gap analysis to implementation: management system manual, procedures, policies, forms, Excel logs/registers, Excel schedules, audit checklists, gap analysis checklist, Management Review Minutes form, management review procedure and schedule, internal audit checklist and audit programme, corrective action request form and register.
If you want to understand the first stage, start with the ISO 9001 gap analysis checklist guide. When actions need senior management decisions, use the management review actions guide to connect minutes, owners and evidence. You can also download the free Management Review Minutes sample because that exact form is included in the free sample download.
Sources
For the wider workflow, see the gap analysis.
For the wider workflow, see the iso 9001.
Page role: action plan
This page is for turning confirmed gaps into owners, dates, actions and evidence. Complete the assessment first with the gap-analysis checklist, then use the gap-analysis hub for the wider workflow.
For the wider workflow, see the gap analysis.
For the wider workflow, see the iso 9001.