Blog Our Guide to an ISO Gap Assessment

The main purpose of a Gap Assessment

The main purpose of the Gap Assessment is to help an organization identify any gaps in meeting the requirements of their chosen ISO standard(s). Once identified, you can prepare an action plan to meet the outstanding requirements and put in place the necessary processes or documented information to evidence compliance.

A Gap Assessment checklist will help ensure you have:

• Covered the main requirements of the relevant standard and have evidence that you are compliant
• Identified the recommended documents and mandatory procedures

What are the benefits of conducting an ISO Gap Assessment?

An ISO Gap Assessment allows an organization to:

• Identify any gaps in meeting the requirements of your chosen standard(s)
• Identify areas that are compliant and ensure evidence of this is available
• Analyse the strengths and weakness of the management system for continual improvement
• Provide evidence of the progress of the management system to key stakeholders
• Have an idea of the resources (time and manpower) that may be required to become fully compliant
• Create a plan of action with SMART goals to fully implement the standard(s) and be certification ready (if this is your end-goal)

How to do an ISO Gap Assessment

There are various methods organization’s use to conduct a gap assessment depending on time, budget, and knowledge within the business.

Some organization’s use the actual Standard document itself, and this can be purchased from the ISO website. Another option is CertiKit’s Enhanced Gap Assessment tool, these are BSI-licensed products and include the exact wording of the standard broken down into a useful excel spreadsheet and dashboard for ease of use. These can be purchased from our website and are available as instant downloads for the following standards: ISO27001, ISO14001, ISO45001, ISO9001, ISO20000, ISO22301 and ISO27701.

There are also free tools out there too, which included an overview of the requirements and these can be downloaded from various websites, but make sure you check for accuracy as they may not cover key requirements.

You can also get an ISO consultant to conduct a Gap Assessment on your organization’s behalf, this will often allow you to identify the gaps with more accuracy if you don’t have ISO expertise within the business. These vary from company to company, CertiKit offer this service for the following standards: ISO27001, ISO9001, ISO14001, ISO45001 and ISO22301, and provide a comprehensive report on compliance with a detailed action plan to meet the requirements of the standard(s).

Regular Gap Assessments are key

The Gap Assessment process should be repeated at regular intervals throughout implementation to identify outstanding gaps in compliance. Using your gap assessment as an ongoing checklist for compliance will ensure you’ve got a real-time view of the position of your management system.

Once you have completed the implementation and are into the embedment and pre-certification phase, the Gap Assessment is replaced by an Internal Audit which is then used to check that you are compliant to the areas of the standard that are required, ready for the certification audit.

Is a Gap Assessment the same as an Internal Audit?

No. During a Gap Assessment, an organisation’s processes and procedures are analysed and compared to the requirements of the ISO standard. During an Internal Audit, the organisation’s functioning is also analysed and compared to the standard. The difference is that for the internal audit, evidence is required to ensure that the mandatory requirements and practices are being carried out in the way they have been documented.

Ongoing Gap Assessment for continual improvement

The Gap Assessment is a useful tool for both pre-certification and ongoing improvements. It is significant in the ISO implementation process as it allows organizations to focus their resources on actions that will have the most impact and will (hopefully) speed up the journey to compliance to their chosen standard.

More ISO Resources

CertiKit is a provider of ISO toolkits, consultancy and internal auditing services, and has helped more than 4000 organizations worldwide with their compliance.

For more guidance on implementing the ISO standard of your choice, go to our guidance pages where you can find more specific information about each standard and more downloadable resources.

More ISO Guidance