Home › ISO Knowledge Hub › ISO Gap Analysis & Planning
ISO Gap Analysis & Planning
Move beyond a gap checklist. Establish applicable criteria, test operational evidence and convert findings into a risk prioritized implementation plan with accountable owners, realistic milestones, defined resources and verified completion.
This practical guide connects assessment to execution: Scope → Evidence → Priority → Workstreams → Milestones → Readiness Decision. The grading scales and illustrative stage gates are planning aids, not scores or timelines mandated by ISO.
01. Build a Credible Scope and Criteria Baseline
A gap analysis compares the organization’s current practices and evidence with specific, applicable criteria. It is not a score assigned merely because a procedure exists. First identify the standard, applicable edition, organizational scope, functions, sites, outsourced interfaces and other binding obligations.
Confirm the assessment basis before sampling. Every finding should identify the applicable reference, relevant process, work location or entity, and evidence of the existing condition.
- Standard and edition: Check current publication status and assess against the actual licensed document.
- Organizational boundary: List legal entities, facilities, remote work, products and services in scope.
- Evaluation criteria: Distinguish requirements from guidance, voluntary practices and separately binding obligations.
- Sampling strategy: Focus on significant processes, site variations, outsourced activities and possible failure consequences.
- Deliverable: Approved scope statement, criteria register, interview plan and evidence request list.
01 Applicable scope
Entities, products, services, processes, sites and relevant third party interfaces.
02 Criteria map
Specific applicable clauses, contractual obligations and organization specific control expectations.
03 Assessment evidence
Interviews, observed work, measured results and retained records from the relevant period.
Connected Knowledge Hub guidance
Before you begin, see Choosing the Right ISO Standard and ISO Scope & Applicability. A gap analysis is only meaningful when the criteria and scope are defined.
02. Evidence Grading: Distinguish Documents from Working Controls
Use a consistent internal evidence scale to describe how confidently the current process fulfils applicable criteria. The illustrative grades below are not ISO defined ratings, and the absence of a record does not automatically mean a requirement has failed unless evidence is required or the outcome cannot otherwise be verified.
On smaller screens, swipe sideways to view all columns.
| Illustrative grade | What it means | Typical evidence | Planning response |
|---|---|---|---|
| A: Verified | Control works in practice across relevant samples. | Observed activity, records over time and outcomes aligned with criteria. | Maintain; monitor for change. |
| B: Partial | Design exists but implementation or repeatability is not adequately demonstrated. | Procedure exists; incomplete records or mixed results. | Clarify weakness and assign targeted action. |
| C: Not Evidenced | The necessary control or proof is absent, or a substantive deviation is demonstrated. | No responsible owner or observed failure against a specific requirement. | Assess consequence and prioritize correction and systemic action. |
| N/A: Justified | Criterion is not applicable where the relevant standard permits. | Documented applicability rationale, scope and supporting facts. | Retain rationale; revisit when scope changes. |
Objective evidence quality check
For each conclusion ask: What exact criterion applies? What was sampled? Who performed the work? How recent is the evidence? Does it represent typical operations? Could another reviewer reach the same conclusion from the record?
03. Five Decisions from Gap to an Owned Action
The best assessment output is not a long list of observations. It is a controlled route from a supported finding to an action that someone can resource, perform, review and verify.
Validate the gap
State the unmet criterion, affected process and supporting evidence.
Determine exposure
Consider likelihood, severity, customer and compliance consequences.
Set priority
Sequence critical work and document rationale for competing demands.
Assign ownership
Name an accountable owner, contributors, resources and due date.
Verify readiness
Review implemented controls, objective evidence and residual risks.
Decision discipline
Before commissioning a large task, ask whether it is a real nonconformity, a control weakness, a documentation gap or a future improvement opportunity. If it is an actual nonconformity, use a suitable nonconformity and corrective action process alongside the implementation plan.
04. Risk & Evidence Heatmap: Prioritize What Matters
Combine business exposure and evidence confidence to guide where the team focuses first. Do not multiply scores mechanically without considering regulatory duties, severe consequences, interdependent processes and management judgment.
On smaller screens, swipe sideways to view all columns.
| Illustrative gap / focus | Risk exposure | Evidence grade | Proportionate response |
|---|---|---|---|
| Legal / customer obligations | High | C / Weak | Escalate immediately; confirm applicability and containment needs. |
| Outsourced supplier monitoring | High | B / Partial | Check supplier risk, contractual controls and actual oversight. |
| Site level internal audit coverage | Medium | C / Weak | Sample significant sites; adjust audit program and competence. |
| Competence verification | Medium | B / Partial | Observe critical tasks and review capability evidence. |
| Controlled document index | Lower | B / Partial | Improve traceability without displacing critical controls. |
How to interpret the heatmap
High / weak needs prompt attention; Medium / partial needs a planned investigation or strengthening; Lower / evidenced may be scheduled or monitored. Colors illustrate management priorities, not standard defined grades or certification outcomes.
05. Gap to Action Register: Owner, Due Date and Evidence
Use one traceable record linking each significant finding to an accountable owner, supporting participants, priority, committed milestone and specific completion evidence. A date or percent complete is not proof that the intended control works.
Fictional example: The relative weeks below are for illustrating planning only; they are not ISO implementation or certification deadlines.
On smaller screens, swipe sideways to view all columns.
| Gap / Workstream | Finding and basis | Priority | Owner / support | Target milestone | Required closure evidence |
|---|---|---|---|---|---|
| GAP-01 Supplier oversight | Critical outsourced calibration reviews are inconsistently recorded. | High / B | Procurement Manager Quality + Operations | Wk 02 Supplier control workstream | Revised supplier controls, sampled acceptance records; effectiveness review after use. |
| GAP-02 Competence | Training attendance exists; capability in a critical task is unverified. | Medium / B | HR Lead Process Owner | Wk 04 People & competence | Observed task demonstrations and signed competence decisions. |
| GAP-03 Internal audit | A significant remote site was omitted from prior audit sampling. | High / C | Audit Programme Owner Site Manager | Wk 03 Assurance workstream | Risk based updated audit programme, completed site audit, documented findings. |
| GAP-04 Management review | Actions from prior review lack closure evidence. | Medium / B | IMS Coordinator Leadership Team | Wk 05 Governance workstream | Action register reconciled with objective evidence and review decisions. |
Minimum action record fields
Record ID, criterion reference, observed condition, evidence sample, owner, action, dependency, resources, target date, completion evidence, verifier, review result and remaining exposure. Re open or revise actions when implementation or effectiveness is not established.
06. Workstreams, RACI and Resource Commitments
Cross functional planning works best when each deliverable has one accountable role and visible supporting resources. This illustrative RACI is a starting point; adapt it to your governance model, legal responsibilities and actual decision authority.
On smaller screens, swipe sideways to view all columns.
| Key activity | Sponsor | Project Lead | Process Owner | Audit Lead | Team |
|---|---|---|---|---|---|
| Approve scope and criteria | A | R | C | C | I |
| Collect process evidence | I | A | R | C | I |
| Prioritize risks and budget | A | R | C | C | I |
| Implement controls and train | I | C | A/R | C | I |
| Conduct follow up internal audit | I | C | C | A/R | I |
| Authorize readiness decision | A | R | C | C | I |
RACI: R = Responsible for doing the work; A = Accountable for the outcome; C = Consulted; I = Informed. “A/R” indicates one role is both accountable and responsible. Illustrative assignments are not mandatory ISO requirements.
Five workstreams to consider
- Governance: Leadership decisions, policy, objectives, review and escalation.
- Process & controls: Operational procedures, supplier interfaces, service delivery and monitoring.
- People: Awareness, competence evaluation, role clarity and training resources.
- Information: Documented evidence, records, technology and version control.
- Assurance: Internal audit, corrective action, management review and readiness sampling.
07. Milestones, Dependencies and a Practical Project Rhythm
Sequence the project around evidence producing deliverables rather than an arbitrary documentation timetable. Interdependencies matter: An internal audit of a control that has never operated cannot establish sustained effectiveness.
On smaller screens, swipe sideways to view all columns.
| Illustrative phase | Primary deliverable | Entry dependency | Review checkpoint |
|---|---|---|---|
| Baseline agreed | Signed scope, criteria map and gap register | Leadership and owners agree boundaries and standard editions. | Sponsor authorizes plan and key risks. |
| Actions mobilized | Owner assignments, approved resources and milestones | Critical gaps sorted by consequence and dependency. | Check scope, budget and ownership. |
| Controls implemented | Revised and operating processes with evidence | People trained and operational changes deployed. | Review use in representative samples. |
| Assurance performed | Internal audit findings and corrective actions | Sufficient operating history for meaningful sampling. | Review residual risk and unresolved NCs. |
| Readiness reviewed | Decision log and evidence to requirements trace | Audit results, objectives and management review available. | Management determines next justified steps. |
Schedule realism
Set duration according to organization size, scope, complexity, existing control maturity and evidence cycles. Dates must be set by the organization or by confirmed contractual, regulatory or certification arrangements, not by an invented universal “ISO implementation deadline”.
08. Readiness Gates: Verify Before Declaring Complete
Stage gates are internal management checkpoints to prevent premature readiness claims. Passing a project gate is not equivalent to independent certification approval; the chosen certification body applies its own legitimate assessment process where third party certification is sought.
G1 Assessment approved
Scope, edition, criteria, sampling rationale and material findings are reviewed by responsible management.
G2 Action plan funded
Critical gaps have accountable owners, workable resources, dependencies, milestones and approved responses.
G3 Controls operating
Changes are in use, personnel can demonstrate expected practices, and representative evidence has accumulated.
G4 Independent internal check
Internal audit and corrective action follow up demonstrate the management system is applied and residual weaknesses are visible.
G5 Readiness decision
Management reviews objectives, remaining risks, gaps, corrective actions and necessary next steps.
Illustrative go / hold / revise decision
Proceed: Required evidence is available and material risks are acceptably treated. Hold: A critical control has not operated or lacks required evidence. Revise: Responsibility, scope, resources or the planned approach has changed. Record the rationale and decision maker; do not substitute a readiness score for judgment.
09. Worked Example: A Supplier Control Gap Becomes a Real Plan
Consider a fictional manufacturer whose contracted calibration supplier provides certificates, but the company does not consistently review whether those certificates cover the required measuring ranges. The issue is not solved by adding a sentence to a procedure alone.
- Criteria: Identify the actual applicable procurement, monitoring and measuring controls.
- Evidence: Sample purchase records, certificates, acceptance reviews and measured device use.
- Exposure: Evaluate possible effects on inspection accuracy and customer products.
- Plan: Procurement Manager owns acceptance criteria; Quality develops verification; production identifies affected instruments.
- Milestone: Apply controls to the next representative supplier deliveries and review their operation.
- Ready to close: A verifier confirms that required reviews took place and meaningful evidence exists.
Example project decision
Prioritize as significant if supplier control failure could undermine product acceptance. Record interim checks when appropriate, adjust the documented process and sample evidence of actual use. If a nonconformity is identified, manage it through the organization’s corrective action process; a “completed document” alone does not establish effective closure.
10. Planning Mistakes That Make Gap Reports Look Better Than Reality
01 Scoring without criteria
A high percentage becomes meaningless if the assessment does not reference applicable requirements and traceable samples.
02 Document only grading
A documented procedure is treated as full implementation without checking operation or outcomes.
03 No named owner
Actions are assigned to “the ISO team” with no accountable role or resource commitment.
04 Risk blind sequencing
Cosmetic document updates displace significant customer, safety, security or compliance exposure.
05 Calendar led assurance
Audit and management review are scheduled before controls have operated long enough for representative evidence.
06 Premature closure
Tasks are marked complete without verifying the required deliverable and any relevant effectiveness.
Professional judgment matters
No percentage, grade, heatmap color or questionnaire can substitute for the relevant standard, actual process evidence and competent evaluation. Escalate any legally binding requirement through the organization’s appropriate compliance process.
11. Frequently Asked Questions
Questions frequently raised by implementation leaders, management system owners and internal auditors.
Is a gap analysis required before ISO certification?
Organizations need to determine conformity with applicable requirements, but a separately named gap analysis project is not universally mandatory. It is a practical planning approach whose form and depth depend on context.
Can our team use one evidence grading scale across multiple ISO standards?
A common internal scale can aid planning, provided the underlying assessment always preserves each standard’s distinct requirements, scope and evidence expectations.
What makes a gap high priority?
Consider applicable obligations, severity of consequences, customer exposure, potential recurrence, process dependencies, likelihood and the strength of current controls. Avoid ranking only by an arbitrary numerical total.
Does a policy or procedure count as sufficient evidence?
A controlled document may support design or intended practice, but may not demonstrate operating effectiveness. Determine what evidence is appropriate for the actual requirement and process.
Should every gap be recorded as a nonconformity?
No. Distinguish unmet applicable requirements supported by evidence from improvement opportunities, emerging risks and items outside the defined criteria.
Who should own a gap closing action?
A person or role with authority over the relevant process and deliverable. Distinguish responsibility for action implementation from approval or verification roles where needed.
Are RACI charts and stage gates mandatory ISO documents?
No universal requirement mandates these specific project management tools. They can provide useful governance, clear ownership and controlled readiness decisions.
Is a high readiness score evidence of certification approval?
No. Scores are internal indicators with methodological limitations. Third party certification, where pursued, involves the independent certification body’s evaluation against relevant requirements.
How long should an ISO gap analysis project take?
There is no universal ISO project duration. Base milestones on scope, baseline maturity, resources, process cycles, known obligations and the evidence required to demonstrate implementation.
When can a gap or action be closed?
When specified action outputs are implemented and verified against appropriate completion or effectiveness criteria, with residual concerns handled in accordance with applicable requirements.
12. Official Sources, Related Knowledge & Next Steps
Use primary ISO publications when deciding the assessment criteria; use the ISO Toolkits tools to support professional planning and readiness conversations, not to generate automatic certification decisions.
Official references and editorial verification
- ISO 19011:2026: Guidelines for auditing management systems: Principles and methods for planning, performing and evaluating management system audits.
- ISO 31000:2018: Risk management: Guidelines: General principles and a risk management framework.
- ISO/TC 176: The process approach in ISO 9001: Explanatory background on process management and PDCA, referring to the 2015 edition.
- ISO Standards: Confirm the current publication status and edition of the relevant standard.
Continue learning and use practical tools
METHOD Evidence Quality in a Risk Based Gap Assessment →
Learn how to judge whether an assessment finding is supported by actual operational evidence.
PLAN Budget Risks That ISO Project Plans Often Miss →
Review staffing, resource and dependency risks that can undermine delivery.
EFFORT How to Estimate ISO Implementation Effort →
Explore a realistic way to scope effort before promising a delivery date.