Gap analysis against the actual clauses
One to two days reading your operation against the standard, ending in a report you can act on without us.
- On site
- One to two days for a single-site system
- Report
- Within five working days of the visit
- Covers
- Every applicable clause, not a sample
- Standards
- 9001, 14001, 45001, 22000, HACCP, 27001 readiness
- Yours to keep
- The report, whatever you do next
A gap analysis audits what already exists against every clause of the standard and returns a marked report: met, partial or absent, with the effort behind each gap. It is the cheapest step in a certification programme and the only one that tells you whether the rest is worth doing.
- 01 Enquiry
- 02 Gap analysis
- 03 Plan
- 04 Build
- 05 Embed
- 06 Internal audit
- 07 Close out
- 08 Management review
- 09 Handover
Gap analysis against the actual clauses sits at step 2 of the readiness cycle. You receive a gap report against every clause.
Most gap analyses are sales visits
A half day, a walk round, a list of things you are missing, and a proposal attached. That is a sales call with a clipboard.
A gap analysis is an audit. It samples records, interviews the people who do the work, and tests whether a control exists in practice and not just on paper. It takes a day or two because that is how long it takes to look at evidence, and it produces a report that is useful to somebody who never hires us.
The other failure is a report that lists gaps without sequencing them. Forty findings in clause order is not a plan. Some of those gaps are blocked by others, several of them close in an afternoon, and others need records from the system in use. A useful report says which is which.
We will also tell you when you do not need us. If the system is largely there and the gaps are internal work, the honest output is a report and a recommendation to close it yourself, and we would rather say that than sell an implementation you can run in-house.
What the audit covers
| Area | What we look at | Method |
|---|---|---|
| Documented information | What exists, what version is in use at the point of use, and what the standard requires that is missing. | Document sampling |
| Records | Whether the records the standard requires are being produced, and whether they can be retrieved. | Retrieval testing |
| Process reality | Whether the documented process is the process being run. This is what a desk review cannot tell you. | Interview and observation |
| Management activity | Internal audit, management review, objectives and corrective action, which are where most systems are hollow. | Evidence review |
| Legal and scheme obligations | Permits, licences and scheme requirements relevant to the standard and the site. | Register review |
| Scope and exclusions | Whether the scope you intend to certify is one your operation can actually support. | Management interview |
The report
One document, five parts. It is written to be read by your management team, not by us.
The clause register
Every applicable clause marked met, partial or absent, with the evidence seen against each one.
Findings with evidence identifiers
Each gap tied to what was seen, where and when. A finding without an identifier cannot be verified later.
Effort and dependency per gap
What closing it takes and what it is blocked by. This is what turns a list into a sequence.
A phased plan
The gaps grouped into phases with owners on your side and realistic dates, including the ones that only close with time.
A scope recommendation
The certification scope we would recommend, what to leave out for now, and why.
How the two days run
- 01
Before we arrive
A short call and a document list. We read what you send first, so the site time is spent on evidence and not on orientation.
- 02
Opening and walk
Thirty minutes with management, then the operation, because the process map in the file and the process on the floor are rarely the same.
- 03
Evidence sampling
Records, registers and the management activity. We sample rather than read everything, and we tell you what we sampled.
- 04
Closing meeting
The findings on the day, verbally, with nothing held back for the report. No surprises in writing later.
- 05
The report
Written, sequenced and sent. Then a call to walk your team through it.
A full build that was not needed
A company believes it needs a full ISO 9001 build from nothing and asks for an implementation plan.
We run the gap analysis first. The operation turns out to be well run: purchasing checks its suppliers, production keeps batch records, complaints get answered. Most of it has simply not been written down, and none of it is under document control.
The register separates three things. Met rows are controls that exist and are evidenced. Partial rows are mostly controls that exist but are unwritten, which need documenting, not inventing. Absent rows are the ones genuinely missing.
The implementation scope shrinks to match. The client holds a register that shows what already works, a short list of what is truly missing, and a plan sized to that list rather than to the whole standard.
Before you book
Do you do a free gap analysis?
No, and be careful with one that is free. A free gap analysis has to be paid for somewhere, and it is usually paid for by the implementation proposal attached to it. We charge for the two days, and the report is useful even if you never call us again.
How much of our time does it take?
Management for half an hour at each end, and roughly an hour each from the people who own the main processes. We work around production rather than stopping it.
Can you do it remotely?
Part of it. Documents and records can be reviewed remotely and that shortens the site time. Process reality cannot, and for a manufacturing or food site the walk is where most of the real findings come from.
We already have findings from a customer audit. Is that enough?
It is a good start and we will use it. It is not a substitute, because a customer audits what matters to them and a certification body audits the whole standard. The two overlap but they are not the same scope.
What if the report says we are mostly ready?
Then it says that. It is a useful answer and it happens more often than you would think, particularly with companies that have been running properly for years without documenting it.
Where this usually leads
Our method
What happens after the report, step by step, with the artifact at each one.
Read moreStandardISO 9001
The most common destination for a gap analysis in this market.
Read moreServiceInternal audit
The same discipline, run as a programme once the system exists.
Read moreServiceDocument control
Where a large share of gap findings always land.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Book the two days
It is the smallest commitment on this site and the one that makes every later decision cheaper. You keep the report either way.