PRACTICAL GUIDANCE
What this review is for
Turn a broad certification ambition into a clear evidence map. A gap analysis compares selected parts of your management system with the agreed standard and identifies what needs to happen next.
Who this is for. For teams starting a management system, taking over an inherited system, responding to a tender, or deciding whether certification is a realistic next step.
SERVICE SPECIFICATION
Scope and evidence
What the review covers
- Agree the standard, edition, business activities, locations and intended outcome before reviewing evidence.
- Map the processes you already use, including useful practices that are not labelled as ISO procedures.
- Review a proportionate sample of documents, operating records and explanations from process owners.
- Distinguish a missing arrangement from an arrangement that exists but lacks evidence of consistent use.
- Prioritise gaps by risk, dependencies and effort, with assumptions and areas outside the sample made visible.
Evidence to prepare
- An outline of the business, sites, services and proposed management-system scope.
- Existing policies, process maps and assigned responsibilities, where available.
- Examples of actual work: orders, projects, incidents, service reviews or control records.
- Your risk register, objectives, previous audit findings and management-review records.
- The exact tender requirement or customer request, including the certificate scope and deadline if specified.
What the review is intended to produce
- A scope statement showing what the review did and did not cover.
- An evidence map linking each reviewed topic to the material examined.
- A prioritised gap register that distinguishes absent, partial and evidenced arrangements.
- An action sequence with suggested owners, dependencies and practical completion evidence.
- A decision note on the next useful step: implementation work, internal audit or a later readiness review.
How the work is structured
Define the question
Use the audit brief to describe the outcome you need and the part of the organisation involved. A tender deadline is a planning input, not proof of readiness.
Review what exists
Select evidence that represents ordinary work, exceptions and recent changes. Interviews test how written arrangements operate in practice.
Agree the gaps
Check factual accuracy with process owners. Record uncertainties and unavailable evidence instead of treating them as satisfactory.
Build the action sequence
Put foundational work first, then identify the operating records needed to demonstrate that the changes work.
Service boundaries
- Certification audits are carried out by independent certification bodies, ideally accredited by UKAS. ISOaudit does not issue certificates and is independent of ISO, UKAS and certification bodies.
- A gap analysis is a sampled planning assessment. It is not a complete legal review, certification decision or substitute for an internal audit programme.
- This page describes a proposed service method. An audit brief records your needs; it does not place an order or confirm scope, availability or delivery terms.
The specification does not constitute an offer or an agreed engagement. Trading identity, price, availability, scope, liability and service terms must be confirmed before a paid engagement can be accepted.
Common questions
Do we need a complete manual before starting?
No. A useful starting review can work with the processes and records you already have. The brief should identify which areas are still being designed so absence is interpreted correctly.
Does a good readiness score mean we will pass certification?
No. Scores organise the discussion; a certification body makes its own decision using its own audit evidence. Unanswered questions and missing evidence should remain visible.
How is this different from an internal audit?
Gap analysis helps you plan development of a system. An internal audit evaluates implementation and effectiveness against agreed criteria within an audit programme. The two can inform each other but have different purposes.
FICTIONAL WORKED EXAMPLE
Fictional example: turning an undocumented handover into an action
A fictional growing business wants to understand its starting position before choosing a certification timetable. This educational scenario is not client work or a promised service outcome.
| Criteria to establish | Agree the standard, edition, processes and depth of the gap review. Separate applicable requirements from optional recommendations and the organisation's own preferences. |
|---|---|
| Evidence and sample | Trace selected customer handovers from acceptance to delivery, including exceptions. Record which records and explanations were reviewed and which areas remain outside scope. |
| What the evidence shows | Staff describe a useful handover check, but the fictional records do not show when it was used. The arrangement may exist while evidence of consistent operation remains incomplete. |
| Next step | Record the gap as not yet evidenced, identify a proportionate way to retain the operating record and assign an owner. Review subsequent work before describing the arrangement as established. |
A gap register supports planning. It is not a full internal audit or a prediction that a certification body will approve the system.
YOUR NEXT STEP
Make the scope concrete.
Describe your organisation, objective and constraints. Download the brief and review it before commissioning work.
Prepare an audit brief ↗SOURCES & REVIEW
Check the underlying information.
These are independent summaries and implementation suggestions, not the copyrighted standard text. Use an authorised copy of the applicable standard for its full requirements.
Reviewed 1 November 2026 · Next editorial review 1 December 2026 · Editorial policy
The displayed review date records an editorial source check. Named specialist review is still to be assigned for this private edition. The 2 November 2026 content update added an original fictional worked example and related guidance; source corrections are recorded in the project change log.