ISO 9001 Gap Analysis: When It Helps, How to Run One, and When to Skip It

A gap analysis is the first thing most guides tell you to do when you start on ISO 9001, and the first thing I often suggest a small business does not do. That will horrify some people, so this guide explains when a gap analysis earns its place, when it is a week spent confirming what you already know, and how to run one properly when it is the right call.

What a gap analysis is

A gap analysis compares what your business currently does against what ISO 9001 requires, clause by clause, and records where the two differ. The output is a list of gaps, each with a rough size, which becomes the implementation plan. It is not an audit (there is no system yet to audit against) and it is not a requirement of the standard; nothing in ISO 9001 asks you to do one.

When you probably do not need one

If you have not already got a strong quality management backbone in the business, you most likely just need to go through the standard and start building the system as if from scratch. The gap analysis will not tell you anything you do not know: the gap is “all of it”, and a spreadsheet saying so in 60 rows adds a week and no information.

What a business starting from nothing actually lacks is knowledge and understanding of how to relate the standard to its own reality. A gap analysis does not supply that. Reading the ISO 9001 clauses guide and working through the requirements checklist does, and the time is better spent describing how the business works than scoring its absence of documents.

When a gap analysis is worth doing

A gap analysis is much more useful in a larger company, or one with pockets of maturity in different areas and a set of existing policies and procedures. Typical cases:

• A business that had ISO 9001 years ago, let it lapse, and still has parts of the old system in use.
• A company that has grown by acquisition or by adding teams, each with its own way of working.
• A business already certified to another standard (ISO 27001, ISO 14001, ISO 45001) that wants to add 9001 and reuse the common clauses.
• A consultant-built system the business inherited and never fully understood.
• Anywhere a customer or tender has set a deadline and you need to know how far away you are before committing.

In each of these the question is not “do we have a QMS?” but “which parts of what we have already meet the standard, which need adapting, and which are missing?”, and that is exactly what a gap analysis answers.

The consultant-built system problem

The gap I see most in businesses with an old or consultant-built system is not in the documents, it is in the people. If someone builds the QMS for you, it is less likely that you understand how it is built or what you have committed to, and you end up calling that consultant back constantly for updates and to get you through audits. That is fine for some companies. In my opinion it is much better to teach people to fish for themselves: it minimises the cost, and it makes the QMS yours rather than someone else’s. A gap analysis of an inherited system should therefore ask, for each process, not only “does this meet the clause?” but “does anyone here know why it says what it says?”

How to run a gap analysis in practice

When it is the right tool, this is how I do it in a business of ten to fifty people. It takes two to four days spread over a week or two, depending on how much documentation there is to read.

1. Agree the scope. Which parts of the business, which sites, and whether it is 9001 alone or an integrated system. If you intend to claim any exclusions (design and development is the usual one), decide that now, because it changes what you are comparing against.
2. Read what exists. Policies, procedures, forms, the last audit report if there was one, the old manual. Note what is current, what is out of date and what nobody uses. This is desk work and most of it can be done before any interviews.
3. Walk the processes. Sit with the people who win work, confirm orders, deliver, buy, check and invoice, and ask them to show you how it actually happens. Compare that with the documents. Where the two differ, the practice is usually right and the document is the gap, not the other way round.
4. Score each requirement. Work through clauses 4 to 10 and mark each requirement as met, partly met, not met or not applicable, with a one-line note on the evidence or its absence. Our free ISO 9001 gap analysis tool is a spreadsheet laid out for exactly this, with the 2026 requirements already listed.
5. Size the gaps. Not every gap is equal. Missing management review minutes is an afternoon; no supplier evaluation at all is a process to design; nobody owning quality is a leadership conversation. Group the gaps into quick fixes, processes to build and decisions for the owners.
6. Turn it into a plan. Owners, order and dates. The gap analysis is finished when it has become the implementation plan, not when the spreadsheet is full.

What the gaps usually are

In an established business with some existing system, the same gaps come up again and again:

• Context and interested parties (clause 4) never written down, because nobody saw the point. Usually a page of work.
• Objectives that are not measurable, or that are really KPIs, with no plan behind them. See the quality objectives guide.
• Competence records that stop at the certificate: no record of what each role needs or how competence was judged.
• Supplier control done well by the person who buys, with no evaluation or approved list anywhere.
• Non-conformances handled but not recorded, because problems are solved quickly as part of the day job and nobody stops to log them. The most common finding at audit too; see the non-conformance guide.
• Documents that describe a business that no longer exists: procedures written for a previous owner, a previous size or a previous system.
• No internal audit and no management review, which are the two things a certification body will not proceed without.

Notice that most of these are records and visibility rather than activity. The business is already doing the right thing; the gap is that nobody can prove it. That is good news, because making an existing activity visible is far quicker than inventing one.

Gap analysis for ISO 9001:2026

If you are already certified to ISO 9001:2015 and preparing for the 2026 edition, a gap analysis is the right tool, and a short one. The structure is unchanged, so the comparison is only against the additions: quality culture and ethical behaviour, risks and opportunities treated separately, the expanded organisational knowledge requirement and the other changes in our ISO 9001:2026 guide. Half a day against the existing system is normally enough to produce the transition plan.

Where to go next

If you have decided you need one, download the free ISO 9001 gap analysis tool and start with step 2 above. If you have decided you do not, go to the clauses guide and the certification guide and start building. And if you would like an outside view before deciding either way, a gap analysis is the first day of our ISO 9001 consultancy programme, and we will tell you if you do not need the rest of it.

Frequently asked questions