Gap Analysis Audit

A gap analysis is the systematic determination of the distance between an organisation's current practices and the requirements of the standard or scheme it is aiming for. It is preparatory work done before entering a certification audit.

The aim is to see in advance the nonconformities that would arise in the certification audit and to plan the necessary preparation, time and resources realistically. Entering a certification audit unprepared wastes both time and money.

• Organisations planning to move to a new standard
• Certified companies about to transition to a new version of a standard
• Suppliers whose customer requires a new scheme
• Organisations that received a nonconformity in a certification audit
• Businesses planning to integrate multiple standards

The criteria are every requirement of the target standard or scheme (e.g. ISO 9001, ISO 27001, FSSC 22000, IATF 16949). The analysis is carried out clause by clause; the current state is compared against each requirement.

• Scanning the target standard clause by clause
• Determining current practice against each requirement
• Assessing the scope and adequacy of existing documentation
• Identifying gaps in records and evidence
• Gaps in process ownership and responsibility
• Identifying resource and competence needs
• Overlap with existing other systems and integration opportunities
• Classifying the gaps by significance and difficulty
• Estimating the time needed to achieve compliance
• A prioritised action plan and roadmap

• ISO 19011
• The target standard itself

1. 1Defining the Purpose and ScopeIt is set out in writing which decision the assessment will feed into and which areas it will cover.
2. 2Information RequestThe documents, records and data to be examined are listed and requested.
3. 3Review of Documents and DataThe information provided is examined; inconsistencies and gaps are identified.
4. 4Site Visit and InterviewsWhere necessary an on-site review is carried out and the relevant people are interviewed.
5. 5AnalysisFindings are compared with the target criteria or risk framework; gaps and risks are prioritised.
6. 6ReportingFindings, risks and recommendations are reported in a form suited to decision-making; critical findings are highlighted separately.

Findings are reported as a GAP, not a nonconformity, and each is tied to the relevant clause of the target standard. Gaps are prioritised by how hard they are to close and the risk they pose to blocking certification.

• Purpose, scope and limits of the assessment
• List of documents and data examined
• Criteria or reference framework applied
• Findings and gaps
• Prioritisation of risks
• Recommendations and estimated workload
• Information constraints and assumptions

A gap analysis is a preparatory exercise, not an audit; it does not produce an accredited certificate and does not substitute for a certification audit. No gaps being found in the analysis does not mean the certification audit will produce no nonconformities: an audit is sampling-based, and a different auditor may focus on different areas. Also, under the impartiality rule, the party that carries out the gap analysis and consultancy cannot conduct the same organisation's certification audit.

Accreditation differs with the type of audit. Third-party audits underpinning management system certification are carried out under ISO/IEC 17021-1 and those underpinning product certification under ISO/IEC 17065; these scopes are subject to accreditation. First- and second-party audits, and audits governed by a scheme owner's own rules (such as SMETA or amfori BSCI), do not fall within accredited certification; they are conducted following the ISO 19011 guidance and produce a report. EUROLAB holds internationally recognised accreditation under ISO/IEC 17021-1 and ISO/IEC 17065, granted by accreditation bodies that are signatories to the IAF multilateral recognition arrangement; which audits can be offered within accredited scope is confirmed in writing at the quotation stage.

• Due Diligence Audit