ISO gap assessment: what it is and how to prepare

A gap assessment is usually the first step towards ISO certification. It compares how your organisation works today with the requirements of the standard, such as ISO 9001 (quality), ISO 14001 (environment), ISO 45001 (occupational health and safety) or ISO 22301 (business continuity), and tells you what is missing before you invest time and money in implementation.

Done well, it saves money: you build only what you need and keep what already works.

What a gap assessment covers

The assessor works through each clause of the standard and rates your current position. For the management system standards that share the same high-level structure, the main areas are:

• Context: the issues, interested parties and scope of the system.
• Leadership: top management commitment, policy, roles and responsibilities.
• Planning: risks and opportunities, objectives and how changes are planned.
• Support: resources, competence, awareness, communication and documented information.
• Operation: the controls specific to the standard, for example customer requirements and suppliers in ISO 9001, or hazard identification and emergency preparedness in ISO 45001.
• Performance evaluation: monitoring, internal audit and management review.
• Improvement: nonconformities, corrective action and continual improvement.

The result is a gap register: each requirement rated, for example, as met, partly met or not met, with the evidence seen and what needs to be done.

How it is done

1. Agree the scope. Which standard, which sites and which activities. Scope affects cost and timeline more than anything else.
2. Review documents. Policies, procedures, forms, registers, licences and previous audit reports.
3. Interview and observe. Short interviews with management and key staff, and a walk-through of the workplace to see how things are actually done.
4. Report. The gap register, the main risks, a prioritised action plan and a realistic timeline to certification.

For a single-site organisation, the on-site work typically takes one to three days, depending on size and the number of standards.

How to prepare

• Gather what you already have, even if it is informal. Many organisations already meet more of the standard than they expect.
• Make the right people available: the managing director or a senior sponsor, operations, HR and whoever handles quality, safety or the environment today.
• Be candid. A gap assessment is not a certification audit; nothing fails. The more accurate the picture, the more useful the plan.

What happens after the assessment

1. Close the gaps. Develop the missing processes and records, train staff and start using the system in daily work.
2. Run the system for a period so there is evidence that it works, typically a few months.
3. Carry out an internal audit and a management review. Certification bodies expect to see both completed before the certification audit.
4. Certification audit. An accredited certification body audits in two stages: Stage 1 reviews documentation and readiness; Stage 2 assesses whether the system is implemented and effective. Certificates are then maintained through annual surveillance audits and recertification every three years.

Common gaps we see

• Risks and opportunities not formally assessed, or assessed once and never revisited.
• Objectives without measures, so progress cannot be shown.
• No internal audit programme or management review, often the last things to be set up and the first things a certification body checks.
• Competence not recorded: people are capable, but there is no evidence of training or qualifications.
• Documents that describe an ideal process rather than how the work is really done.

One standard or several?

Because ISO 9001, ISO 14001 and ISO 45001 share the same structure, many organisations assess and implement them together as an integrated management system, with one set of shared processes for documents, audits, management review and corrective action. A combined gap assessment shows how much can be shared.

Next step

An independent gap assessment gives you a clear, costed route to certification, and a plan that builds on what you already do well.

This article is general information, not legal or professional advice. Requirements can change; check the current law and guidance, or speak to us about your circumstances.