Introduction
Most quality problems surface at the worst time: during a certification audit, or after a customer complaint. A gap analysis moves that discovery earlier, when fixes are cheap and no one is watching.
The need is real. In the 2025 ASQE report, only 31% of respondents said they fully understand how quality costs affect their organization's financial performance. That is a visibility problem, and a checklist-based review addresses it directly.
This guide explains what a gap analysis is, how to run one, and what to check clause by clause. It covers controls, documented information, competence, suppliers, customer requirements, and improvement.
Key Takeaways
- A gap analysis compares your current QMS against the applicable ISO 9001 edition.
- Record evidence, status, gaps, priorities, owners, due dates, and closure actions, not just a score.
- Assess clauses 4 through 10 against real work practices and records.
- Supports readiness, but does not replace an internal or certification audit.
What Is an ISO 9001 Gap Analysis, and Why Does It Matter?
A gap analysis is a structured comparison of your processes, controls, documents, and records with ISO 9001 requirements. Reviewers ask a simple question for each requirement: what do we actually do, and what proves it?
Edition check: ISO now lists ISO 9001:2026 as the current edition, and ISO 9001:2015 is withdrawn. Clause titles in this guide follow the 2015 structure. Confirm exact wording and transition expectations against an authorized copy of the edition that applies to your project.
When to Perform One
- Before or early in implementation
- When preparing for certification or recertification
- After major organizational changes
- When reassessing a multi-site QMS
How It Differs From Other Assessments
| Activity | Purpose |
|---|---|
| Gap analysis | Optional readiness comparison against the standard, as BSI describes it |
| Internal audit | Checks whether the implemented QMS conforms to planned arrangements and ISO requirements; the standard requires an audit program |
| Certification audit | Performed by an independent certification body; ISO itself does not certify companies |
Benefits
- Realistic implementation scope
- Better resource planning
- Prioritized corrective actions
- Stronger employee involvement
- A baseline for measuring progress
One rule matters above the rest: assess the system as it operates today. Planned procedures earn no credit.
How to Perform an ISO 9001 Gap Analysis Step by Step
The process combines several activities:
- Document review
- Interviews and observation
- Evidence sampling
- Findings documentation
- Follow-up planning
Collect evidence where work happens, preferably in real time.
1. Define the Scope and Prepare
- List sites, departments, products, services, processes, and applicability decisions.
- Confirm the ISO 9001 edition and your certification objectives.
- Gather policies, procedures, records, audit reports, complaints, performance data, and management review outputs.
- Assign an objective review team.
2. Gather Evidence From Documents and Real Work
Review documents first. Then interview process owners and employees to see whether practice matches paper.
Record specifics: document titles, revision levels, records, system entries, observations, and who you interviewed. "Training seems fine" is not evidence.
3. Map Processes to Requirements
Link core and support processes to clause groups so requirements are judged in context. Include process interactions, outsourced activities, suppliers, customer requirements, multiple sites, and shared corporate controls.
4. Rate Each Requirement and Describe the Gap
Use defined statuses and state what evidence each one requires:
- Conforming
- Partially conforming
- Not conforming
- Not applicable
Separate three situations:
- A process that is missing
- An effective process that is poorly documented
- A process that exists but is not followed consistently
Write each gap with the requirement, observed condition, objective evidence, and potential consequence. Do not assign blame to individuals.
5. Prioritize and Assign Responsibility
Rank gaps by:
- Customer impact
- Product or service risk
- Legal or contractual relevance
- Effect on certification readiness
- Effort and dependencies
Give each gap an owner, target date, resources, and a way to verify the fix worked.
6. Build the Action Plan
Group findings into workstreams such as:
- Document control
- Competence
- Operational controls
- Supplier management
- Internal auditing
- Corrective action
Define each deliverable, the people involved, sequence, and closure evidence.
7. Review, Validate, and Repeat
Present findings to process owners and top management. Resolve disputed evidence and fix unsupported observations before finalizing. Repeat at milestones to confirm changes work in practice.
Example: Trace One Customer Order
Pick a single order and follow it from inquiry and contract review through planning, purchasing, production or service delivery, inspection, release, feedback, and corrective action.
Common misses include:
- A work instruction that is obsolete
- No retained evidence of operator competence
- A supplier used without approval
- A complaint closed without checking that the corrective action worked
ISO 9001 Gap Analysis Checklist: Clause-by-Clause Guide
Treat the checklist as a working tool, not a substitute for the standard. Each row should tie a requirement to:
- Current practice and objective evidence
- Status, gap description, and priority
- Owner, due date, and closure evidence
Add supporting fields for site or department, process owner, document and record references, reviewer, review date, and applicability notes.
Clauses 4 and 5: Context and Leadership
- Are internal and external issues, interested parties, and customer and statutory requirements identified?
- Are QMS boundaries, process interactions, and scope defined?
- Does top management assign responsibilities, support the quality policy, integrate the QMS into business processes, and promote customer focus?
Look for a current scope statement, interested-party reviews, process maps, evidence the policy was communicated, role descriptions, and resource commitments.
Clause 6: Planning
- Have risks and opportunities been identified with proportionate actions, not a form with no follow-through?
- Do objectives align with strategy, carry measurable indicators where appropriate, and have owners, resources, timing, and monitoring evidence?
- Are QMS changes planned, resourced, communicated, and evaluated for consequences?
ISO audit guidance notes that the 2015 standard prescribes no specific record format for risk actions.
Clause 7: Support
- Are people, infrastructure, work environment, and measuring resources identified and maintained?
- Are competence criteria defined, training evaluated for effectiveness, and records retained?
- Do employees know the quality policy and their contribution to objectives?
- Is organizational knowledge available when processes or products change?
- Is documented information created, approved, revised, protected, retained, and disposed of under control, including external documents?
Interviews, record review, and observation all help verify competence. ISO guidance confirms that the 2015 edition requires no quality manual or fixed list of procedures. Judge documents by whether they control the work.
Clause 8: Operation
- How are customer requirements determined, reviewed, and changed? Is design and development controlled where it applies?
- Do external-provider controls include selection criteria, performance monitoring, and verification of purchased outputs? An approved-supplier list alone often doesn't prove control.
- Are work instructions, validation, traceability, and customer property controlled?
- Are preservation, post-delivery activities, release authorization, and nonconforming outputs controlled?
Observe real jobs and sample records. The test is whether controls work on the floor, not whether a procedure exists.
Clauses 9 and 10: Performance Evaluation and Improvement
- Is customer satisfaction monitored? A formal survey is not specifically required, but a method for obtaining and reviewing perceptions is.
- Does the internal audit program define criteria, scope, frequency, auditor objectivity, reporting, and follow-up?
- Do management reviews cover performance trends, audit results, customer feedback, risks, resources, and decisions?
- Are nonconformities contained, investigated for cause, corrected, checked for recurrence, and verified as effective?
- Is continual improvement driven by real results and lessons learned?
Management reviews are a historically common finding area, so sample the records.
How Synergistic Systems Can Help
Synergistic Systems is an ISO consulting firm that helps organizations move from gap analysis and assessment to implementation through modular documentation, organizational, and training systems. Founded in 2000, it has worked on hundreds of projects across varied industries.
Its approach focuses on translating complex operations into usable documents, records, responsibilities, and working sessions, without piling on paperwork. A cloud-based intranet hosts:
- Controlled documents and records
- Audits and corrective actions
- Management reviews and the risk register
Strengths that support implementation include:
- Founder Gary Lane is a Certified Quality Auditor and Certified Manager of Quality / Organizational Excellence
- Project managers work with personnel from top management to hourly teams
- Consultants bring experience with many third-party registrars
Organizations with multiple sites can benefit from consistent documentation, controlled records, and shared implementation methods. Each site's actual processes and risks still need their own assessment.
Conclusion
A gap analysis checklist shows what already works, what is incomplete, what evidence is missing, and which actions come first. That clarity makes budgets and timelines realistic.
Keep refining the checklist as processes change, actions close, and internal audits and management reviews turn up new opportunities.
Frequently Asked Questions
What should be included in an ISO 9001 gap analysis checklist?
Include the clause reference, requirement summary, current practice, objective evidence, status, gap description, priority, owner, due date, and closure verification.
What is ISO 9001 gap analysis?
It compares your current QMS with ISO 9001 requirements to identify conformity, partial conformity, and missing or ineffective controls. It does not award certification.
What are the 7 steps of a quality management system (QMS)?
"Seven steps" usually refers to the seven requirement clauses, 4 through 10, not a named ISO method. A gap analysis workflow is a separate, practical sequence. Verify terminology against the current edition.
What documented procedures does ISO 9001 require?
ISO 9001 prescribes no universal procedure list. Required documented information depends on applicable requirements, context, risks, and processes, and on what you need to show effective control.
Is there a PDF version of ISO 9001:2015 available?
Official copies come from ISO, the ANSI Webstore, or national standards bodies, and copyright prohibits unauthorized distribution. ISO 9001:2015 is now withdrawn, so check which edition and transition timeline apply to you.
