how-to
7 Steps to Prepare for an ISO Gap Analysis
Last Updated: October 26, 2026
Quick Summary
To prepare for ISO gap analysis, define your scope clearly, gather existing documentation and evidence, identify key stakeholders and process owners, and understand the ISO requirements you're assessing against. This structured approach helps you identify what's working, what's missing, and what needs attention before your formal assessment begins.
- Define scope first to clarify which business units, locations and processes fall under the ISO management system.
- Gather evidence including process maps, procedures, records and performance data before opening a checklist.
- Involve frontline staff and process owners because they know how work actually gets done, not just how procedures say it should be done.
- Use a consistent scoring scale (such as Compliant, Partial, or Gap) to assess each requirement against documented evidence.
- Prioritise findings by impact and effort, then create an action register assigning owners and realistic deadlines to close each gap.
Table of Contents
- What Is an ISO Gap Analysis and Why It Matters
- Step 1: Define Your Scope and Boundaries
- Step 2: Gather and Organise Your Current Documentation
- Step 3: Identify Key Stakeholders and Process Owners
- Step 4: Understand the ISO 9001 Gap Analysis Checklist
- Step 5: Review ISO 9001 Gap Analysis Examples and Common Gaps
- Step 6: Follow the ISO Gap Assessment Process
- Step 7: Create Your ISO 9001 Implementation Plan
- Frequently Asked Questions
What Is an ISO Gap Analysis and Why It Matters
An ISO gap analysis is a structured assessment that compares your current management system against the requirements of an ISO standard.
Think of it as a structured comparison of your current system against the standard's requirements.
For organisations seeking ISO 9001 certification, this assessment can inform your implementation pathway.
A gap analysis can help you:
- Compare your current processes and evidence with ISO requirements
- Identify areas that may need further assessment
- Inform leadership's planning for effort and resources
A gap analysis can help your team focus on areas that need attention and avoid duplicating work on processes that already meet relevant requirements.
Step 1: Define Your Scope and Boundaries
Before you assess anything, you need to be crystal clear about what you're assessing.
Scope means the parts of your organisation that will fall under the ISO management system.
Defining scope matters because it:
- Prevents scope creep
- Clarifies which processes and people are covered by ISO requirements
- Helps clarify which activities are included in the management system
To define scope, ask these questions:
- Which business units or locations are in scope?
- Which processes directly support your main products or services?
- Are support functions (HR, finance, IT) included or excluded?
Write your scope statement clearly. Example: "Our scope covers all design, manufacturing, and quality control activities at our facility. Head office finance, HR, and sales are excluded." Document it, you'll reference it throughout your gap analysis and certification audit.
Step 2: Gather and Organise Your Current Documentation
A gap analysis builds on the processes, procedures and records you already have. The preparation work includes assembling evidence and reviewing existing documents. How to Document Quality Management System Requirements can help you structure and document your quality management system requirements properly.
Build a pre-assessment evidence pack
Before you open a checklist, gather relevant evidence so you can assess against records rather than memory.
Governance and context
- Your scope statement (from Step 1) and an organisation chart showing in-scope functions
- Business context notes: key customers, products or services, sites, and any contractual or tender drivers for certification
- A list of interested parties (customers, regulators, workers, suppliers) and their main requirements
Process and operational evidence
- Process maps, flowcharts or work instructions for core processes
- Current procedures, policies and employee handbooks
- Registers: inspection logs, calibration records, training records, incident and injury reports, environmental monitoring records, supplier approvals
Performance and improvement evidence
- Internal audit reports and schedules from the past 12-24 months
- Management review minutes or leadership meeting notes
- Nonconformity, corrective action and customer complaint logs
Ownership details
- A simple table listing each process, its owner, where the related documents live, and the last review date
That ownership table matters: when you later find a gap, you already know who owns the process and who will fix it.
Create a documentation inventory
List what you have, where it lives and who owns it. Expect some documents to be current, some outdated, and some to exist only as institutional knowledge. That is normal; the gap analysis will help you decide what to keep, update or create.
Standards Australia guidance on documentation systems emphasises that documented information should be proportionate to your organisation's complexity. Documentation needs can differ between organisations, depending on their context and operations.
What differs by standard
The evidence you gather shifts depending on which standard is in scope. Keep this in mind as you build the pack:
| Standard | Evidence to prioritise | Typical weak spot |
|---|---|---|
| ISO 9001 (quality) | Process maps, customer complaint records, supplier evaluations, calibration and inspection records | Risk and opportunity assessment; control of external providers |
| ISO 14001 (environmental) | Environmental aspects and impacts register, monitoring data, waste and emissions records, legal obligations register | Aspects and impacts not linked to actual operations; no evidence of legal compliance evaluation |
| ISO 45001 (WHS) | Hazard identification and risk assessments, incident and injury records, consultation records, worker training | Consultation with workers not evidenced; hazard controls not reviewed |
If you are preparing for more than one standard, gather the shared evidence once (leadership, context, document control, internal audit) and then collect the standard-specific records separately.
Distinguish required from optional documentation
Not everything you gather is mandatory. Each standard requires certain documented information. Check the applicable standard to identify what is required for your system. Other documents, such as detailed work instructions or extra registers, are kept by choice.
Consider using how to manage ISO documentation online to organise what you have collected in a structured way before moving to the next step. The Free ISO Starter Pack can help you get started.
Step 3: Identify Key Stakeholders and Process Owners
To prepare for ISO gap analysis effectively, you need the right people involved, including those who actually run the processes.
Identify stakeholders across your scope:
- Process owners: People who run day-to-day operations (production supervisors, site managers, quality coordinators)
- Department heads: Leaders of in-scope areas
- Management representative: The person responsible for driving ISO implementation
Involve frontline staff because they know the real process, not the procedure written five years ago. Frontline workers can help identify differences between documented procedures and how work is done.
Plan interviews or workshops with these groups. Conversations with process owners can complement document review.
Access ISO learning resources to build your team's understanding of ISO requirements before these conversations. Teams can use their understanding of the requirements to inform their input.
Get Your Free ISO Starter Pack →
Step 4: Understand the ISO 9001 Gap Analysis Checklist
A structured checklist can help organise your gap analysis around the applicable ISO requirements.
An ISO 9001 gap analysis checklist can be organised around the standard's requirements, including:
- Context of the organisation (understanding your business environment)
- Leadership and commitment (management involvement and accountability)
- Planning (risks, opportunities and objectives)
For each clause, the checklist asks: "Are we meeting this requirement? Do we have evidence? What's missing?" When using a checklist, distinguish standard requirements from recommendations.
ISO 9001:2015 standard overview outlines the full structure. Many organisations find it helpful to map their current procedures against each clause before the formal gap analysis begins.
Use the ISO 9001 Audit Preparation Checklist to guide your assessment.
Step 5: Review ISO 9001 Gap Analysis Examples and Common Gaps
Reviewing possible gaps can help inform your assessment.
Common gaps in ISO 9001 implementation include:
- Risk and opportunity assessment: Many organisations don't formally identify risks to their quality management system. They react to problems rather than preventing them.
- Documented procedures for critical processes: Work instructions exist informally (people know how to do it) but aren't written down. New staff struggle without documented guidance.
- Evidence of management review: Leadership isn't demonstrating they actively review system performance. Minutes of management meetings don't show ISO-related discussion.
These findings do not, by themselves, determine whether your organisation is failing. A gap analysis can help you consider what action may be appropriate.
Step 6: Follow the ISO Gap Assessment Process
The gap assessment follows a logical sequence. Consistent scoring and checking how processes operate can help you assess evidence alongside documentation.
Step 1: Prepare your team
Brief stakeholders on what you are assessing and why, and share the checklist. Explain that the goal is honesty, not blame. Agree how long each interview will take and what evidence each process owner should bring.
Step 2: Assess each clause against evidence
For each ISO requirement, ask four questions:
- Do we have a process or procedure that addresses this?
- Is it documented (where the standard requires documentation)?
- Do we have evidence it is actually being done (records, examples)?
Step 3: Use a consistent scoring scale
One possible approach is to use a three-point scale:
| Rating | Meaning | What it looks like |
|---|---|---|
| Compliant | Requirement met and evidenced | Process exists, is followed, and records prove it |
| Partial | Requirement partly met | Process exists but is inconsistent, undocumented, or lacks records |
| Gap | Requirement not met | No process, no evidence, or the process contradicts the requirement |
A five-point maturity scale is another possible approach. Apply any chosen scale consistently.
Step 4: Interview process owners and sample evidence
Documents can be considered alongside discussions with the people who run the processes. Useful techniques:
- Ask for a walkthrough, not a description. 'Show me the last time you did this' reveals more than 'tell me how you do this'.
- Sample records. Pick two or three recent examples and trace them end to end. If a procedure says inspections are recorded weekly, ask to see the last four weeks.
- Compare practice to procedure. Where they diverge, note it. A gap between the written procedure and real practice is a finding in its own right.
Step 5: Document findings
Record findings using a simple template: Clause → Current state → Evidence seen → Gap → Recommended action. Be specific, for example 'no training records for forklift operators since March' rather than 'training records incomplete'.
Step 6: Prioritise using risk, not gut feel
Not all gaps are equal. Score each finding on two dimensions:
- Impact: does the gap affect product or service quality, worker safety, environmental outcomes, or a legal or contractual obligation?
- Effort: how much work is needed to close it?
One possible way to organise priorities is a matrix:
| Low effort | High effort | |
|---|---|---|
| High impact | Fix first | Plan and resource |
| Low impact | Fix when convenient | Defer or accept |
Consider prioritising findings by impact and effort, and assign owners and actions where appropriate.
Access ISO learning resources to build your team's understanding of ISO requirements before these conversations. Teams can use their understanding of the requirements to inform their input and apply the chosen scoring approach.
Step 7: Create Your ISO 9001 Implementation Plan
Your gap analysis findings can inform your implementation plan. An implementation plan answers four questions:
- What needs to change? (Each gap from your analysis)
- Who is responsible? (Assign an owner to each action)
- By when? (Set realistic deadlines)
- How will we know it's done? (What evidence will prove completion?)
Realistic timelines matter. Set realistic deadlines that reflect your organisation's context, resources and the work required.
Assign clear owners. Each action needs one person accountable.
ISO Certification Process Timeline guidance provides realistic timeframes for Australian organisations at different maturity levels.
For detailed planning support, review the ISO Certification Process Timeline.
Preparing for an ISO gap analysis is not about perfection.
Whether you're managing the process internally or need expert facilitation, choose a level of support that suits your needs. IntegriSURE Essentials is one of our available packages. For organisations considering a different support level, IntegriSURE Guided is another available package.
Frequently Asked Questions
What documents should you gather for an ISO gap analysis?
Gather relevant management system documentation and evidence, such as policies, procedures, records, process maps, risk assessments, audit reports, training records, and customer feedback. Note what exists and where it is held so you can consider it during the analysis.
Can you do an ISO gap analysis yourself without external consultants?
Yes. An organisation can conduct its own gap analysis. A clear scope, access to relevant processes and evidence, stakeholder input, and a structured approach can inform the assessment. Organisations with limited ISO experience may choose to use guidance or templates as part of their preparation.
How long does an ISO gap analysis typically take?
The time required depends on the organisation's size, complexity, scope and available evidence. The work may involve reviewing documents, consulting relevant stakeholders, assessing processes and compiling findings. Plan the assessment around your organisation's circumstances.
What happens after you complete an ISO gap analysis?
After the gap analysis, consider the findings and decide what actions are appropriate. You may develop an action plan, assign responsibilities, monitor progress and retain evidence of implementation. Certification readiness requires an implemented and operating management system; an independent certification body assesses it for certification.
