Are you considering certification against an ISO standard or another standard, but are you unsure whether your management system has been sufficiently established and implemented? An ISO gap analysis provides insight into the extent to which your current management system meets the agreed requirements of the relevant standard.
The gap analysis takes place before the formal certification process. During the assessment, the auditor determines which standard requirements are supported by relevant evidence and which aspects may require further establishment or implementation. This gives your organization a clearer understanding of its current position before applying for certification.
A gap analysis can be performed against various ISO standards and other management system standards. The applicable standard, the proposed scope and the depth of the assessment are agreed with your organization in advance. See below which standards can be included in a gap analysis.
A gap analysis is a voluntary assessment. It does not replace the formal certification audit and does not guarantee that your organization will subsequently obtain certification.
Discuss your gap analysis with Brand Compliance
What is an ISO gap analysis?
An ISO gap analysis is an assessment that compares the current establishment and implementation of a management system with the agreed requirements of an ISO standard or another standard. This assessment is also referred to as an ISO baseline assessment. Its purpose is to identify the differences between the current situation within your organization and the requirements you intend to meet. Depending on the agreed scope and depth, the assessment may cover documented information, processes, responsibilities, management system activities and available evidence. The outcome provides a snapshot of the management system at the time of the assessment. Your organization can use the findings to determine which actions may be required before starting the formal certification process.
When is a gap analysis useful?
A gap analysis may be relevant when:
- your organization is considering certification but has not yet submitted a formal certification application;
- a management system has been established, but it is unclear to what extent it meets the applicable standard requirements;
- policies, processes and controls are in place, but documented information or evidence of implementation may not yet be complete;
- your organization wants an independent assessment before starting the certification process;
- your organization is implementing a management system standard for the first time;
- an existing management system is being extended to include an additional standard;
- multiple management systems are being integrated;
- your organization wants to identify areas requiring attention before applying for certification.
An ISO baseline assessment or gap analysis is not mandatory for certification. Organizations that consider their management system to be sufficiently established and implemented can apply directly for certification. Read more about the different stages in our step-by-step overview of the certification process.
For which standards can a gap analysis be performed?
A gap analysis can be performed against various ISO standards and other standards or certification requirements. Depending on the proposed scope, the assessment may cover:
- ISO/IEC 27001 for information security management systems;
- NEN 7510 for information security in healthcare;
- ISO 9001 for quality management systems;
- ISO 14001 for environmental management systems;
- ISO/IEC 19770-1 for IT asset management systems;
- ISO 22301 for business continuity management systems;
- ISO/IEC 27701 for privacy information management systems.
Additional standards, controls or scheme requirements may be included in the assessment when they fall within the services provided by Brand Compliance.
Does your organization have an integrated management system? Multiple standards can be assessed within a single gap analysis, provided that a combined assessment is practicable and the arrangements have been agreed in advance.
What can be assessed during a gap analysis?
The content of the gap analysis depends on the selected standard, the proposed scope and the agreed depth. The assessment may cover:
- the context of the organization and relevant interested parties;
- the proposed scope and boundaries of the management system;
- leadership, policies, roles and responsibilities;
- risks, opportunities and applicable requirements;
- objectives and the plans for achieving them;
- available resources, competence and awareness;
- internal and external communication;
- the control of documented information;
- the establishment and implementation of relevant processes and controls;
- monitoring, measurement and performance evaluation;
- completed internal audits;
- the management review;
- the treatment of nonconformities and continual improvement.
Not every aspect applies to every standard in the same way. The assessment criteria are therefore determined based on the requirements of the selected standard and the agreed scope.
How is a gap analysis performed?
A gap analysis consists of three main stages. The precise approach depends on the selected standard, the scope and the agreed depth.
Define
Brand Compliance agrees with your organization which standard and which proposed scope will be assessed. You can indicate which aspects should receive additional attention. It is also agreed whether the assessment will be performed on site, remotely or using a combination of both audit methods.
Assess
The auditor assesses the management system against the applicable standard requirements. Depending on the agreed extent of the assessment, documented information and available evidence are examined and interviews are conducted with management and employees.
Report
The findings, observations and conclusions are documented in a report. The auditor provides general information about the certification process and may estimate when your organization could be ready to start the certification process.
Is a gap analysis part of the certification process?
No. A gap analysis is a voluntary assessment performed before the formal certification process. It is not a certification audit and does not result in a certification decision or certificate.
The gap analysis does not replace:
- your organization’s internal audits;
- the management review;
- Stage 1 of the initial certification audit;
- Stage 2 of the initial certification audit;
- the independent certification decision.
The findings from a gap analysis do not guarantee that the management system will meet all applicable requirements during the certification audit. The management system may change between the two assessments. In addition, different samples may be selected and additional evidence may be assessed during the certification audit.
What is the difference between a gap analysis and a Stage 1 audit?
| Gap analysis | Stage 1 of the certification audit |
|---|---|
| Voluntary assessment | Mandatory part of the initial certification audit |
| Performed before the formal certification process | Performed as part of the formal certification process |
| Provides a snapshot of the current level of implementation | Assesses, among other aspects, whether the organization is ready for Stage 2 |
| The scope and depth are specifically agreed for the gap analysis | The audit objectives and audit activities follow from the certification requirements |
| Does not result in a certification decision | Produces audit results that become part of the certification file |
| Does not replace Stage 1 or Stage 2 | Is followed by Stage 2 when the certification process can proceed |
A gap analysis must therefore not be regarded as Stage 1 of the initial certification audit or as a replacement for the initial certification audit.
How much does an ISO gap analysis cost?
The duration and cost of a gap analysis depend on the proposed scope and the agreed depth. The following factors are considered:
- the selected standard or combination of standards;
- the proposed scope of the management system;
- the number of employees and locations within the scope;
- the nature and complexity of the processes;
- the complexity of the IT environment;
- the current level of implementation;
- the amount of documented information that must be assessed;
- the required depth of the assessment;
- whether the assessment is performed on site, remotely or using a combination of both methods.
Following an initial introductory meeting, Brand Compliance can determine the appropriate extent of the assessment and prepare a quotation.
Discuss your gap analysis
Would you like your management system to be independently assessed before applying for certification? During a non-binding introductory meeting, we discuss the applicable standard, the proposed scope, the required depth and the information needed to prepare a quotation.
Schedule a introductory meetingFAQ
An ISO gap analysis compares the current establishment and implementation of a management system with the agreed requirements of an ISO standard. The assessment identifies which standard requirements are supported by relevant evidence and which aspects may require further establishment or implementation.
The terms gap analysis and baseline assessment are often used for the same type of assessment. In both cases, the current situation is compared with the requirements of a standard. Brand Compliance uses the term gap analysis for this independent assessment performed before the certification process.
A gap analysis may cover ISO/IEC 27001, NEN 7510, ISO 9001, ISO 14001, ISO 22301 and ISO/IEC 27701, among other standards. Other standards or scheme requirements may be included when they fall within the services provided by Brand Compliance.
No. A gap analysis is a voluntary assessment performed before the formal certification process. An organization that considers its management system to be sufficiently established and implemented can apply directly for certification.
A gap analysis is a voluntary assessment performed before the certification process. Stage 1 is a mandatory part of the initial certification audit and assesses, among other aspects, whether the organization is ready for Stage 2. A gap analysis does not replace the Stage 1 audit.
No. The gap analysis provides a snapshot based on the agreed scope, selected depth, samples and available evidence. The outcome does not guarantee that all applicable requirements will be met during a subsequent certification audit.
No. The internal audit is a required management system activity and must be performed by or on behalf of the organization. A gap analysis performed by Brand Compliance does not replace the internal audit programme or the management review.
Brand Compliance can explain the findings and provide general information about the certification process. As an independent certification body, we do not design or implement processes, documents or controls to resolve identified gaps. Your organization determines which actions are required or engages an independent management system consultant.
Multiple management system standards can be combined when the management systems are integrated and a combined assessment is practicable. The standards, scope and depth are agreed in advance.
The duration depends on the selected standard, the proposed scope, the number of locations, the complexity of the organization, the available documented information and the required depth. Brand Compliance determines the expected assessment time after discussing these factors with your organization.
The information required depends on the selected standard and the agreed scope. This may include the proposed scope, policies, objectives, roles and responsibilities, process descriptions, risk assessments, treatment plans, procedures, records, internal audit results and management review results. Brand Compliance confirms in advance which information is required.
-
Bart Versluijs
Account Manager
-
Jade Reilink
Account Manager
