How to Do a Gap Analysis ~ The Definitive Guide [ISO 9001]

A gap analysis is a survey - often using a checklist - that determines the differences (gaps) between an organization’s current business systems and the requirements of controlling criteria, such as standards like ISO 9001:2015.

A gap exists where existing policies, processes, or procedures do not fully meet the stated requirements.

What follows is our definitive guide for conducting a Gap Analysis. It is geared towards ISO 9001 but can also be applied to ISO 14001, 45001, 27001, etc. You won't find a more detailed gap analysis process online anywhere. It's a long read, but it includes all the steps necessary and everything you need to know about performing a gap analysis.

When To Do A Gap Analysis?

A gap analysis is performed at the start of your ISO project. This is the first step in the process and should be performed as soon as your company decides to become ISO certified.

It should not take place:

• Before your business has done research in ISO 9001 certification
• Before your business has decided to become ISO 9001 certified
• After your business has started filling out paperwork for ISO 9001 certification
• After your business has created a plan for updating your quality management system

A gap analysis will help scope out the improvements you need to make in your current quality management system and make the ISO paperwork more straightforward.

What is a Gap Analysis Checklist?

A gap analysis checklist highlights and summarises the requirements contained in a standard, such as ISO 9001:2015; it is not intended to cover all of the requirements comprehensively, only an overview of them.

It is used to capture the gaps in your organization’s management system and the requirements of ISO 9001:2015 to determine the following:

1. What existing company processes and procedures already meet ISO 9001 requirements
2. What existing procedures and processes need to be modified to meet ISO 9001 requirements
3. What additional procedures and processes need to be created to meet ISO 9001 requirements

Make sure that you purchase copies of ISO 9000:2015 and ISO 9001:2015. Read them both and familiarize yourself with their language and concepts. Although ISO 9001:2015 is written in dense, formal language, the clause titles are self-explanatory.

How to Conduct a Gap Analysis

While becoming ISO 9001 certified is complex, completing an ISO 9001 gap analysis is considerably less complicated. There are six major steps to completing an ISO 9001 gap analysis.

Your organization may already have a compliant quality management system in place, or you might be running an uncertified system; the gap analysis checklist provides a structured framework to help assess the current status of your QMS in terms of fulfilling the requirements of ISO 9001:2015.

After the gap analysis, you should have a clear picture of how your existing quality management system compares with the requirements of ISO 9001. In general, the steps for conducting a gap analysis are:

• Reviewing what is the present operation/process and what already exists
• Analyzing the relevant sections of the ISO 9001 standard to determine what is required
• Documenting the differences or gaps

These differences and gaps should be organized into a detailed findings list for review and approval by top management.

In summary, the gap analysis should include a review of all processes and procedures for management controls and technical controls, such as sampling, method validation, equipment calibration, qualification and maintenance, employee qualifications, and others.

The unique knowledge obtained about the status of your existing quality management system will be a key driver of the subsequent implementation approach.

Benefits of a Gap Analysis

You can develop a findings list and action plan using the gap analysis's output, including additional tasks such as selecting and dealing with an accreditation or certification body.

A gap analysis template will help you identify gaps and recommend how to fill them.

Armed with this knowledge, you can establish accurate budgets, timelines and expectations that are proportional to the state of your current management system when directly compared to the standards' requirements.

The gap analysis output, a findings list, provides a valuable baseline for the implementation process and for measuring progress.

Try to understand each business process in the context of each requirement by comparing different activities and processes with what the standard requires.

At the end of this activity, you will have a list of activities and processes that comply and ones that do not. The latter now becomes the findings list and the target of your action plan.

Why Is a Gap Analysis Important?

Now, it sounds like a lot of work when you could skip straight to filling out the certification forms. Why bother with all those extra steps?

A gap analysis is important because it will highlight what areas need to be completed for your business to qualify for ISO.

It is important to start with a gap analysis to determine what your company already does to meet the ISO requirements and what it needs to improve. 

A gap analysis can help:

• Save time
• Save money
• Focus your energy
• Narrow your goals

A gap analysis will help your business save valuable time. Instead of blindly stumbling through endless confusing paperwork, without knowing whether your business qualifies for ISO 9001 certification or not, use a gap analysis to determine where to begin in the paperwork process.

Save time by learning where your company falls short and improving those areas before getting swamped with paperwork.

A gap analysis can also save your business money in the long run. It may cost money to hire a professional consultant, purchase a gap analysis checklist, or even assign one of your own employees to perform the analysis. However, running a gap analysis will be less expensive, even if it's only time you save.

Jumping headfirst into a mass of paperwork before properly preparing will only lead to wasted time, confusion, and frustration for whoever was assigned to complete it. This wastes time that could be better spent in more productive, valuable areas.

After all, time is money, and that adage is clearly shown regarding complicated paperwork.

A gap analysis can help you focus your energy. ISO 9001 has an intensive list of requirements that companies must uphold to become certified. Because it is a very involved list, it is easy to quickly become lost and focus on less relevant requirements. 

With a gap analysis, your business is less likely to be running around spending resources on trying to fix areas that don’t need to be fixed and already fall into the ISO 9001 standards while ignoring areas where your company needs improvement in following those standards. If your goals for improvement are too broad, a gap analysis can help you narrow them down.

Using a Gap Analysis Checklist

Our gap analysis checklist is aligned with the requirements of ISO 9001:2015, and gap analysis must be undertaken with due reference to the standard.

The gap analysis tool is divided into seven sections, which reflect the contents of ISO 9001:2015. The two gap analysis tools, Part A and Part B, provide a structured framework to assess the current status of a QMS in terms of fulfilling the ISO 9001 clauses:

Part A comprises the gap analysis checklist, aligned with ISO 9001 clauses and provides comments and notes to assist users.

Part B comprises the gap analysis findings list, which details the gaps and proposed remedial actions required to close the identified gaps between ISO 9001 and your current management system. The findings list then feeds an Action Plan.

Each question in the gap analysis checklist should be assessed by the auditor for conformance to the requirements of ISO 9001, along with the auditor’s knowledge of your organization’s products, services, processes, and facilities; they will be able to make a judgment on conformity, using the criteria set out in the table below:

1 Assigning Responsibilities

Who did you identify to conduct the gap analysis? In the ideal situation, this person will also be the Management Representative since project management and auditing skills are highly beneficial.

Someone with less auditing experience can do a gap analysis, provided that they are willing to learn and interpret the requirements of ISO 9001:2015 and are available to put in the time necessary to know and understand the gap analysis process.

To perform a practical analysis, the people undertaking gap analysis exercises should be objective, open-minded, listen, communicate clearly, report fairly without bias, and be familiar with the standard. If your auditors have not been trained on the ISO 9001 requirements, provide training before performing the gap analysis.

Gap analysis exercises are often a time-consuming, in-depth process. Ideally, the person (or team) running the gap analysis will have experience in quality assurance and auditing. Whether or not you have an employee available with that kind of background, of course, depends on your company. If you are a small company without someone experienced in quality assurance to lead your gap analysis, do not despair!

Alternatively, professional ISO 9001 gap analysis consultants may be hired to run the analysis for you. These professionals can significantly decrease the time spent on a gap analysis compared to someone outside the ISO 9001 quality management field.

Though hiring one of these professional consultants may be more expensive than assigning one of your employees to run the gap analysis, hiring a professional will save you much time in the long run.

2 Create or Purchase a Gap Analysis Checklist

The next step in the gap analysis process is creating or buying a checklist.

A gap analysis checklist will lay out the requirements for ISO 9001 certification in several steps.

A checklist can help you stay on task and focus on the elements required for ISO 9001 certification. Having a checklist can help you navigate the requirements listed in the ISO 9001 form. There are two ways to obtain a gap checklist: write your own or purchase a professionally written one.

If your business chooses to write its checklist, it is recommended that you research existing gap analysis checklists before attempting to write your own.

Gap analysis checklists should be detailed and will often end up being lengthy documents. Ours is 50 pages. Dig deep to make sure you hit all the important points if you decide to write your own!

Click here to purchase a Gap Analysis Checklist & Template.

View a sample of our Gap Analysis Checklist

Purchasing a pre-existing checklist can:

• Save time – these often extraordinarily lengthy and detailed checklists are already completed and do not need to be written, saving your business time
• Avoid mistakes – experts in the ISO field write checklists purchased from reputable sources and will have been edited to ensure that all necessary pieces are included, leaving nothing out
• Minimize confusion – because these checklists should be very thorough, confusion can quickly arise regarding what aspects need to be focused on and what is not required
• Set out the scope of the requirements and project in hand

A good gap checklist should be very detailed and contain all necessary questions. It should summarize all ISO 9001’s requirements.

3 Scheduling the Gap Analysis

Now that you have completed the preliminary steps set a date for the analysis to be conducted. Ensure your employees know the date and time for the gap analysis, especially if you’ve hired a professional consultant.

A member of your organization’s management should approve the audit schedule before the start of the gap analysis cycle. When changes are made in timing or auditors, records with justification for changes should be maintained.

Schedule the gap analysis and communicate to all employees what is being done and why. You will want to make the employees comfortable answering your auditor's questions.

You may want to consider sending out a newsletter to inform employees that the gap analysis will be performed and by whom, when, and why the gap analysis is being performed.

Determine whether you intend to audit by process, procedure, or area of the facility; our recommended approach is usually to audit by each area of the facility.

Divide the facility into manageable areas and schedule time to audit each section of the standard that applies to the area. If you are using an audit team, assign the team to cover the various areas of the facility.

Arrange your gap analysis checklists so that each auditor has the sections of the standard applicable to the areas of the facility they will cover.

4 How to Perform a Gap Analysis

Begin by assuming you are doing most of what ISO requires—you probably are! Many people talk about the high cost of implementing management systems, but this is a false assumption.

If you do it right and understand the standards, implementation should not be a problem since 75% of your management system is already in place. Here are some initial review tasks to consider:

• Compare actual performance with external standards, regulations, codes of practice and guidelines
• Review existing management procedures
• Compare actual operations with internal policies and procedures
• Identify policies and procedures dealing with external contracts for services and suppliers
• Gather the views of internal and external interested parties
• Assess if/how other internal systems can help or interfere with QMS performance

The consultant will ask your employees questions about your quality management system (using the gap analysis checklist), so make sure your employees are prepared to answer questions.

Suppose you have elected to do the gap analysis yourself. In that case, you should still let your employees know when you plan on analyzing to ensure they are at the top of their game and can answer the questions detailed in this gap analysis checklist.

Remember, the gap analysis focuses on the present, so only look at processes you have in place currently, not ones you plan to add in the future. Also, remember to take thorough notes on your findings as you go through the gap analysis.

Following the schedule you prepared, go into each area of the facility to evaluate the current quality management system. Focus on what is in place and what is not. Remind auditors that you are not focusing on compliance or nonconformity to the current system but on its design and how it matches ISO 9001’s requirements.

Gap analyses can be conducted with small groups of staff. For example, a gap analysis can be performed with the senior management group and a separate gap analysis with middle management and operational staff. It is not unusual to receive different responses to questions depending on the position and level of staff within the organization.

When sampling or interviewing employees, the auditor must decide how many samples to take. The recommended approach is to start with two or three samples or interviews, and if there is uncertainty or error, then take additional samples. Take notes on what is in place and what will need to be developed and changed. Also, take complete notes, including reference documents and examples.

You will want to identify the gaps from the standard current system's status for each requirement or set of requirements. You can then turn that into a findings list.

Set a completion date for completing the action; fill that date in on your action plan. Set a meeting or two date to assign responsibilities for the findings list.

An important consideration in using the gap analysis checklist is that, for most staff, this will be an introduction to an audit-like process and the practical aspects of a QMS. Therefore, it must be a positive experience from all perspectives.

Any gap analysis or audit should focus on the processes and the overall system, not on the individuals following the practices and procedures provided.

Allow enough time for an in-depth audit. The more information you can provide for your findings list and action plan, the more efficient and effective your implementation project will be. When the gap analysis has been completed, meet with the auditors to summarize the results.

These results can be transferred to the findings list for implementation. This meeting should be held shortly after the audit to keep the information fresh.

5 Reviewing & Reporting the Findings

After the gap analysis has been completed, examine the results. Consider what needs improvement and what already fulfills the requirements.

This is where the note-taking you did in the last step will be helpful! Continue to keep notes detailing why a process needs change, not just that it needs updating to fit the requirements.

Ideally, you or the consultant will use these notes to create a list of steps to improve your quality management processes.

Gap Analysis Report

A gap analysis report should be prepared before the gap analysis exercise.

The gap analysis report should include a summary of what was reviewed, the findings and plans for follow-up actions.

When you have completed the gap analysis, you will probably have many findings. Some conclusions might be problems, and some might be opportunities for improvement.

Review your notes and collect the findings into the report. Summarize the gap analysis findings, you will usually identify several categories of tasks:

• Processes that comply with the standard and are documented
• Processes that comply with the standard and must be documented
• Processes that do not adhere to the standard and must be redesigned
• Processes required by the standard that are not currently in place

The findings and conclusions should be formally documented in the summary report. Too often, the audit report only reiterates facts and data the managers already know.

The value is in identifying issues and opportunities they do not know! This summary should be reviewed by the lead auditor and then by the Process Owner and Management Team. Make final revisions and file the audit report and all supporting audit materials and notes.

Describing Objective Evidence

Objective evidence of the audited documentation must be maintained. This evidence can comprise physical or digital attachments, with file reference notations on the checklist.

When using the checklist, the procedure's revision level, date of record or report, and individual interviewed need to be listed. When an auditor provides an Opportunity for Improvement (OFI), the auditor should review whether the process owner accepts the suggestion and the plan for dealing with it.

Describing Nonconformities

Often, the first time a ‘gap’ or ‘problem’ i45s is mentioned, it is vague, subjective, or even abstract. The root cause is unlikely to be identified without a proper definition, and incorrect or insufficient corrective actions are implemented.

The implementation team will benefit from investing adequate time upfront defining the nonconformity to ensure subsequent process steps proceed accurately and efficiently.

The statement of nonconformity is the action or process that was observed not to comply. The nonconformance should be written to identify the process that is not adequate.

The requirement is the action that is required but was observed not to comply. The standard’s clause number, procedure number, work instruction reference, interview information, etc., is typically quoted.

Nonconformities should include information on the requirement, the gap leading to the nonconformance, and the supporting evidence available.

This was observed during the audit, and it caused the nonconformance to be written. Additionally, suppose your organization has committed to a requirement in its documentation, e.g., its project quality plan. In that case, evidence must exist that your organization conforms to the planned arrangements.

Summarizing the Gap Analysis

A good summary report is the output, which is the value of any audit. It deserves an appropriate amount of attention and effort. You should have noted the issues and improvements you saw during the gap review.

These should have been marked clearly so you can quickly review and capture them as you write the gap analysis report.

These results can be transferred to the findings list for action. The more information you can add to your findings list, the more thorough and effective your overall action plan will be in the latter stages.

Although positive comments are not specified on the gap analysis checklist, it is always a good policy to include them in the summary of the gap analysis report.

6 Implementing Actions and Improving the QMS

The final step you should focus on leads to the next step in the ISO 9001 implementation process: creating a plan of action for improving your quality management systems.

When the gap analysis is complete, meet with the auditors to go through and review all under‐developed or absent elements. These results can be transferred to the findings list for an action plan.

This action plan will help you get on track to update your quality management system for certification. It should be developed to allow the different elements to be prioritized over some time.

The more information you can obtain from your findings lists, the more thorough and effective your overall action plan will be. It is important to remember that your QMS should be customized to reflect your organization and its operating environment.

Implementing a formal management system is best handled as a specific project led by someone with project management experience. Ideally, the person should be a vital member of the organization’s management team and have sufficient authority and trust among the personnel involved.

No matter how small your organization, failing to get your people involved will be a missed opportunity and a showstopper.

Be sure to space out the implementation activities over a reasonable timeframe. You should set clear, concise goals and deadlines for updating your quality management system and develop a detailed action plan for reaching those goals.

Remember, the more specific and detailed your plan is, the easier it will be to implement.

From the previous step, you will usually identify several categories of tasks:

• Processes that comply with the standard and are documented
• Processes that comply with the standard and must be documented
• Processes that do not adhere to the standard and must be redesigned
• Processes required by the standard that are not currently in place

Implementing a management system like the one detailed in this document will give your organization the necessary foundation to enact a culture change.

The culture shift will start during the early development and implementation phase. By involving and consulting the employees at this early stage, you can more easily secure buy-in by assigning responsibility and utilizing their skills, knowledge and experience to help develop the management system.

Using the Process Approach to Manage Changes

We suggest using the familiar Plan-Do-Check-Act (PDCA) methodology to manage your organization’s transition to the new requirements.

1. Plan: Undertake a gap analysis to understand how the requirements affect your QMS and then prepare the implementation plan based on the results
2. Do: Implement the plan by ensuring that the new requirements are embedded into your QMS and your processes
3. Check: Evaluate the effectiveness of the newly implemented aspects by performing a complete system (element) audit, review the findings and implement any corrective actions
4. Act: Take action to address any implementation problems and improve the QMS before beginning the process of auditing

Think about each action. Does it require the development of a philosophy (e.g., objectives), a process (e.g., a reporting system) or a new practice? Please read through the actions identified and prioritize them.

It is helpful to do a quick sensibility check and ask yourself, "Do I need everything I’ve identified to achieve a successful system?" This is an excellent time to see if your actions sufficiently address the gaps identified and are suitable for your organization.

You do not need to have each action up and running straight away. Develop an implementation plan that will allow you to phase different elements over some time. Go with what works. Do not force a process or activity that has no place in your business. For example, if you are attempting to develop a risk assessment methodology, think about how complex you want to make this process; make it practical and focus on what you’re trying to achieve.

It is likely that during the first few months, Top management will need to routinely reinforce its requirements to ensure that staff maintain motivation and do not lapse back into old habits.

Iterative adjustment of new or existing quality management system documentation should also be expected as staff become accustomed to the requirements and begin to suggest usability improvements.

Instant business or operational improvements may initially be observed.

The benefits of a properly functioning QMS are not just restricted to the knowledge that it complies with regulatory requirements but also the discipline to manage customer requirements effectively and mitigate risk.

Choosing an Implementation Team

Top management should consider creating an Implementation Team to assist in developing the new management system. This decision should be based on the size of the organization or facility implementing the QMS.

This team should consist of key individuals from various divisions, departments, and operating work areas within your organization who are familiar with the facility and its processes. Diversity among team members will bring together a pool of expertise and ideas to develop and implement the QMS.

The implementation team should meet ‘as needed’ according to the project timeline. When the team meets, it must address the items on its findings list.

Spread the implementation team meetings along the implantation timeline so you do not have too many meetings simultaneously. For example, you may want to have the document control team meet early in the project to establish a system for collecting and controlling the documents that will be generated.

The internal audit team would meet later because audits will not begin until the system is complete.

After the Implementation Team members have been selected, an initial orientation meeting should be held. At the meeting, everyone involved should be informed of the organization’s planned implementation and team members’ new responsibilities.

The initial orientation meetings will start the program well, but many more meetings will be necessary. While the primary activities during the early meetings will involve system development and implementation, the Team Leader may also wish to use this time to provide team members with some training.

The Implementation Team should meet regularly to resolve problems and report progress. Meeting minutes should be documented, as they may prove helpful when working with Certification Auditors. In some cases, the documented meeting notes may answer auditors' questions.

Checking for Improvement

An essential part of implementation is determining whether your actions have worked. This step focuses on how to resolve this. Consider doing a review six months after your initial development has started; you can increase the interval as your QMS matures.

Consider getting an internal and external perspective to understand what is working and what is not. Use your initial gap analysis to identify what may need updating. Have things changed? Talk to your staff and see what they think.

Ensure that your organization has selected the appropriate tools and techniques to investigate the causes, thereby establishing and implementing a process for continual improvement.

The impetus for continual improvement must come from the use of (as a minimum):

• QMS Policies
• Risks and opportunities
• QMS objectives
• Analysis and evaluation of data
• Audit results
• Management review
• Nonconformity and corrective action

Requirements for continual improvement interrelate with the following clauses:

• QMS planning
• QMS objectives
• Risks and opportunities
• Recommendations for improvement
• Improvement of the system, processes and products
• Analysis and evaluation of data
• Nonconformity and corrective action

Processes can always be made more efficient and effective, even when producing conforming products. A continual improvement program aims to increase the odds of satisfying customers by identifying areas that need improvement.

It requires your organization to plan improvement systems and consider many other activities that can be used in the improvement process.

You will be required to ensure that you continually improve the degree to which your products and services meet customer requirements and measure the effectiveness of your processes.

To this end, the continual improvement principle implies that you should adopt the attitude that improvement is always possible, and your organization should develop the skills and tools necessary to drive improvement.

What Can Go Wrong With a Gap Analysis If Done Incorrectly?

• Substituting gap analyses for other assessments
• Creating a solution before properly examining gap analysis results
• Developing improper training methods for implementing a solution
• Creating improper documentation

One confusion about gap analyses is that they are the only analyses a business needs to do in preparation for the ISO 9001 certification process. This is not the case. Gap analyses should not substitute for other assessments.

Risk management, internal audits, customer satisfaction evaluations, and other assessments should be made in addition to a gap analysis.

Each assessment has a different focus and fills a different purpose than a gap analysis. Because of these other focuses and purposes, one type of analysis should never replace another.

Attempting to do so could lead to complications. A few examples of what may go wrong if one analysis is substituted for another are risks that may be ignored or underestimated, the maintenance of existing processes that could be forgotten, and the depreciation of focus on customers.

Another mistake often seen in gap analyses is jumping straight into a solution to a perceived problem before creating a plan of action based on the gap analysis.

This defeats the entire purpose of conducting a gap analysis by ignoring the areas the gap analysis says need focus and instead diving headfirst into whatever seems to be the issue, regardless of the problem.

Similar to the previous mistake, developing improper training methods for improving quality management systems is another mistake.

An administrator may sometimes begin developing training methods for employees to help improve quality management systems without first checking to ensure they fit the gap analysis results. This once again defeats the purpose of a gap analysis.

Creating improper documentation, whether over-documenting or under-documenting a process, is another area some companies struggle with.

In the sometimes baffling world of ISO 9001, it can be hard to tell what needs to be documented and what does not. In the past, ISO standards required that everything had documentation. This is no longer the case. 

Companies that have been adhering to ISO standards for a long time sometimes have a complex mass of obsolete documentation because they never revamp their documentation when an ISO 9001 update is released.

Conversely, some companies have no documentation for how their quality management systems are supposed to run. The key is to balance over- and under-documentation.

Outline each process in your quality management systems clearly and concisely, and update them as needed to comply with the new ISO 9001 standards.

In conclusion, you can create a gap analysis for your business with little time and effort.

This is one of the most critical first steps in obtaining certification.

Highlighting the areas in your quality management system that do not meet ISO 9001 requirements will save you time, money, and resources.