What Is an ISO 9001 Gap Analysis?
It's a readiness assessment — reviewing your documentation, processes, and records against what ISO 9001 (see our requirements guide) actually expects, and producing a clear list of gaps to close before pursuing certification.
Why Perform a Gap Analysis?
Going into a Stage 1 audit without knowing where you stand means the certification body becomes your first real readiness check — at a cost, and on their timeline. A gap analysis lets you find and fix issues on your own schedule, with far less pressure.
Areas Usually Reviewed
- Context — is the organization's context and interested parties actually defined?
- Leadership — is there visible, documented evidence of management commitment?
- Planning — are risks, opportunities, and quality objectives identified and tracked?
- Support — are competence, resources, and infrastructure adequate and evidenced?
- Operations — are operational processes actually controlled as documented?
- Performance Evaluation — is monitoring, internal audit, and management review happening?
- Improvement — are nonconformities and corrective actions properly closed out?
Example Gap Analysis Questions
These are representative of the kind of practical questions a gap analysis asks — not an exhaustive audit checklist, but a sense of the level of detail involved:
- Is the QMS scope clearly defined and communicated?
- Are quality objectives measurable and reviewed at planned intervals?
- Are competence requirements for key roles documented?
- Is there evidence that internal audits are actually effective, not just completed?
- Are corrective actions verified as resolving the root cause, not just the symptom?
- Is customer feedback captured and used to drive improvement?
- Are supplier and outsourced process controls documented?
- Is there a defined process for managing documented information (creation, approval, version control)?
- Are risks and opportunities reviewed as part of planning, not as a one-off exercise?
- Does management review cover all the inputs the standard expects (audit results, customer feedback, process performance, etc.)?
- Are nonconformities from previous internal audits tracked to closure?
- Is there evidence that top management is actively involved, not just informed?
- Are roles and responsibilities for quality clearly assigned and understood?
Gap Analysis vs Certification Audit
| Gap Analysis | Certification Audit | |
|---|---|---|
| Performed by | Internal team or a consultant | Independent, accredited certification body |
| Outcome | A list of findings and recommendations | An official certification decision |
| Formality | Informal, flexible in scope and depth | Formal, governed by accreditation rules |
| Stakes | Low — findings are yours to act on privately | High — results affect your certificate status |
Common Gaps We See
Without claiming any statistic we can't verify, a few patterns come up repeatedly in gap reviews across industries: internal audits that check documentation exists but not whether it's followed, management review meetings that happen but don't leave a documented trail, and quality objectives that were set once and never revisited.
Can You Perform a Gap Analysis Yourself?
Yes — an internal self-assessment using the requirements as a checklist is a reasonable starting point and costs nothing but time. The limitation is that internal staff are often too close to their own processes to spot the gaps an outside reviewer would catch immediately. For a general first pass, self-assessment is fine; for a specific, nagging question you're not confident about, an outside opinion is usually worth more than another internal pass.
Practical Consultant Note
The most valuable gap reviews aren't the longest ones — they're the ones that focus on the two or three areas a company is genuinely unsure about, instead of re-checking everything from scratch every time.
Not ready for a formal audit yet, but want a structured readiness check? See our pre-assessment service.
Have One QMS Area You're Unsure About?
Send us your specific gap analysis question and get a focused, professional assessment — US$19, one-time.
Start a $19 Quick CheckFrequently Asked Questions
Can you perform an ISO 9001 gap analysis yourself?
A: Yes, especially as a first pass — many organizations use a checklist internally to get a rough picture. An external, experienced reviewer often catches gaps that internal staff miss simply because they're too close to their own processes.
How is a gap analysis different from the certification audit?
A: A gap analysis is an internal or consultant-led readiness check with no formal outcome beyond a list of findings. The certification audit is performed by an independent, accredited certification body and results in an official certification decision.
How long does a gap analysis take?
A: It depends on company size and scope, ranging from a short document-based review to a multi-day on-site or remote assessment for larger, more complex organizations.
Do I need a gap analysis before every certification audit?
A: It's not formally required by the standard, but skipping it means your Stage 1 audit effectively becomes your first real readiness check — which is a costlier and more stressful way to discover gaps.