Explanation
You go through the requirements, assess for each one what you already have and what is missing, and record the differences (gaps). You do this based on documents, evidence and conversations with employees. The result is a list of shortcomings that you can prioritise.
You often use a gap analysis at the start of an implementation project, such as for ISO 9001 or VCA, or for a new version of a standard. That way you know what to put in order before the certification audit takes place. Each gap becomes an action with an owner and a deadline.
It differs from an internal audit. An audit tests whether your system works and is repeated periodically, while a gap analysis shows for one moment where you stand against a standard. They flow into each other: after the gap analysis comes implementation, then the audit.
Example from practice
A company that wants to introduce ISO 45001 for the first time compares its existing procedures and records with the requirements. If it turns out that the overview of legal obligations is missing, that becomes the first action.
© 2026 BrydgeOne. General information, not legal or other professional advice. No rights can be derived from this explanation.
