A gap assessment compares what your company does today with what an ISO standard requires, and lists what is missing or weak. You run it at the start of a certification project, before you build or fix anything. It is different from an internal audit, which checks a system that is already running.
Last reviewed: 17 October 2026. Facts checked. We ran one web search on gap analysis and internal audit. The sources were mainly Advisera, a consultancy that sells ISO training and tools, plus community posts. They agree that a gap analysis comes first and an internal audit comes after implementation. They said a gap analysis is not mandatory. One source said an annual internal audit before the certification audit is required under ISO 27001 clause 9.2, which we treat as specific to that standard. We did not open any ISO standard (paid documents) or confirm what a certification body expects.
Gap assessment, internal audit and certification audit
| Gap assessment | Internal audit | Certification audit | |
|---|---|---|---|
| When | At the start | After the system runs | After the internal audit |
| Question | What is missing? | Does it conform and work? | Does it meet the standard? |
| Done by | You, or an adviser | Your independent auditor | An outside certification body |
| Result | Action plan | Findings and corrective actions | Certificate or findings |
| Required? | Not mandatory, per our sources | Required by the standards | Needed for a certificate |
For the later steps, see how to run an ISO internal audit and the certification audit stages.
Step 1: Fix the scope and the standard
Decide which standard, which sites, which products or services, and which departments are included. Write down what is excluded and why. A vague scope makes every later step vague. Use the current edition of the standard, and check any amendment.
Step 2: Break the standard into questions
Take the clauses and turn each requirement into a plain question, such as "Do we have a written policy, and do staff know it?" Keep the standard's exact wording nearby. If you work from a paid standard, keep to your licence terms and do not publish its text.
Step 3: Collect what already exists
Many companies already do much of what a standard asks, but without records. Gather policies, procedures, registers, minutes, training sheets, customer complaint logs, supplier lists and previous audit reports. Talk to the people who do the work, not only the managers.
Step 4: Rate each requirement
Use a simple scale and apply it the same way to everything.
| Rating | Meaning |
|---|---|
| Met | Practice and records both exist |
| Partly met | Practice exists but records or consistency are missing |
| Not met | Nothing exists, or it exists on paper only |
| Not applicable | Excluded with a written reason |
For each "partly" or "not met", note the evidence you saw and the evidence you expected. Write what you observed, not what you assume.
Step 5: Rank the gaps
Not every gap is equal. Rank by three questions:
- Would a certification auditor raise this as a major nonconformity? See major vs minor nonconformities.
- Does it affect customers, safety, legal compliance or the data you hold?
- How long will it take to fix?
Start with gaps that are serious or slow. A missing risk assessment, for example, holds up many other clauses.
Step 6: Build the action plan
For each gap record the action, the owner, the due date and the evidence that will show it is closed. The sources we read say the plan should name actions, responsible people and timelines. Keep the plan short enough that someone will read it. Review progress at a fixed interval, and keep the management team informed.
Step 7: Implement, then audit internally
Fix the gaps, run the new processes long enough to create records, and then run an internal audit. This step answers a question the gap assessment cannot: whether the changes were put in place and work. Do not skip it. Then hold a management review, which most management system standards expect before certification. Check the exact clauses of your standard.
Step 8: Choose the certification body
Check that the certification body is accredited for your standard and sector. We did not verify the accreditation rules for India here, so confirm them with the accreditation body and ask the certification body to show its accreditation scope.
Mistakes to avoid
- Treating the gap assessment as the internal audit.
- Using someone who will later audit their own work.
- Rating "we do it but have no record" as met.
- Writing a long action plan with no owners.
- Starting to buy tools before the gaps are known.
- Copying another company's procedures without adapting them.
Frequently Asked Questions
Is a gap assessment mandatory for ISO certification?
The sources we read say it is not mandatory. It is a planning step that most companies find useful.
Who should run it?
Someone who knows the standard and can look at the work objectively. It can be an in-house person or an outside adviser. For the later internal audit, the auditor must be independent of the work audited.
How long does it take?
We did not verify typical durations. It depends on scope, size and how much is already documented. Agree the scope first, then estimate.
Can we use the same checklist for the internal audit?
You can reuse the question list, but the internal audit also samples records to test whether the system works. Our ISO 9001 clause-by-clause checklist shows that style.
What if the gap list is very long?
Rank the gaps, fix the serious ones first, and set a realistic date for the certification audit. Moving the date is better than certifying a system that does not work.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error