Morgan Compliance Group
What Is an ISO Gap Analysis and Why Does It Matter?
An ISO gap analysis is a structured review that compares what a business currently does against the specific requirements of an ISO standard, such as ISO 9001, ISO 14001 or ISO 45001. It identifies what already conforms, what partially conforms, and what is missing entirely, and is used to build a realistic, prioritised implementation plan rather than starting implementation blind.
Book a Free ConsultationReviewed by Daniel Morgan, TechIOSH - Last reviewed 2026-09-24
A gap analysis works clause by clause through the relevant standard, reviewing existing policies, procedures, records and day-to-day practices against each requirement. The output is not a simple pass/fail list - it usually distinguishes between areas that fully conform, areas that partially conform and need strengthening, and areas with no current control at all.
Prioritisation is what separates a useful gap analysis from a generic checklist. Some gaps carry more risk or certification impact than others: a completely missing risk assessment process is a more urgent gap than a policy document that simply needs a review-date update. A well-run gap analysis reflects that difference in how it sequences recommended actions.
Gap analyses are particularly valuable where a business is integrating multiple standards - for example, ISO 9001, ISO 14001 and ISO 45001 together - since many clauses overlap (leadership, documented information, internal audit, management review), and a combined gap analysis avoids duplicating work across separate reviews.
A gap analysis is also useful outside first-time certification. Businesses changing consultant, preparing for recertification, or responding to a difficult previous audit often commission a gap analysis to get an honest, independent view of where the system currently stands before deciding next steps.
It is worth being clear about what a gap analysis does not do: it does not certify anything, and it does not guarantee that addressing every identified gap will result in certification, since that decision always sits with an independent certification body assessing the system once it is fully implemented and operating.
Frequently asked questions
How long does a gap analysis take?
This depends on business size and complexity, but a gap analysis for a single-site business is often completed within a few days of review time, with a written report following shortly after.
Does a gap analysis guarantee certification afterwards?
No. It identifies the current position and what needs to change. Certification is a separate, independent decision made by a certification body once the system is fully implemented and demonstrably operating.
Can a gap analysis cover more than one ISO standard at once?
Yes. Where a business is considering an integrated management system, a gap analysis can be run across multiple standards together, which is often more efficient than separate reviews.
Is a gap analysis useful if we already have some certification experience?
Yes, particularly when changing consultant, preparing for recertification, or after a difficult previous audit, since it gives an independent, current view rather than relying on assumptions from the last cycle.
What does the output of a gap analysis actually look like?
Typically a written report identifying each requirement, its current status, and a prioritised list of actions needed, which then forms the basis of an implementation plan.
Do we need a gap analysis before every recertification?
Not necessarily, but it is a useful step where significant changes have occurred in the business, the standard has been revised, or previous audits identified recurring issues.
Related
How we can help
Explore ISO Management Systems for practical support.
Need ongoing advice? See Monthly Safety Support.
Not Sure Where to Start?
Book a free consultation and explain what your business is trying to achieve. Morgan Compliance Group will help identify the most practical next step.
Book a Free Consultation