Carrying out an ISO gap analysis: how to run a baseline assessment for ISO 9001, 14001 or 45001

What is an ISO gap analysis or baseline assessment?

A gap analysis, in practice also called a baseline assessment, places the current situation of your organisation next to the requirements of a standard such as ISO 9001, ISO 14001 or ISO 45001. For each requirement you establish what is already in place, what is partly arranged and what is missing. The result is not a score or a certificate, but a list of shortfalls that you can prioritise and turn into actions.

The concept itself is explained briefly under GAP analysis in the glossary. This guide is about carrying one out: which steps you take, what a result looks like and where it goes wrong. A gap analysis is a snapshot. It shows how far you are at the moment you look, not whether your system keeps working in practice.

When do you carry out a gap analysis for ISO 9001 or ISO 45001?

The best moment is before you start, because the result determines how much work implementation takes and where you begin. Anyone who only discovers after months of building that an essential part is missing, such as an overview of legal requirements or a risk analysis, loses time. Four moments lend themselves to a gap analysis:

A change to a standard is a current example. ISO 9001 appeared in a new edition in September 2026. Under the transition rules of the accreditation world, existing certificates must be transferred by the end of September 2029 at the latest. Ask your certification body when and how it plans the transfer.

• Before implementation: to know what you already have and where to start, as described in the guides on introducing ISO 9001 and implementing ISO 45001
• Before the certification audit: as a check on the last points, so there is still time to put things right
• When a standard changes: to see which new or tightened requirements affect your system
• When you expand: with an extra standard, a new site, an acquisition or a new activity in the scope

Carrying out a gap analysis: the seven steps

A gap analysis follows a fixed sequence. The seven steps are listed briefly below; the three headings after that work them out, with the questions you ask at each step. Agree in advance who does which step and when, so the analysis does not stall in a full diary.

• Choose the standard and the scope
• Put a team together and decide on your rating scale
• Assess each requirement with a simple scale
• Collect the evidence and record it
• Prioritise the findings
• Draw up an action plan with an owner and a deadline
• Reassess and track progress

Steps 1 and 2: scope, standard, team and rating scale

First decide what the analysis covers: which standard, which sites, which processes and activities. A company with two locations and outsourced maintenance includes those parts as well if they fall under the system. If you want to introduce several standards, look at which requirements overlap, because ISO 9001, 14001 and 45001 share the same basic structure.

Then put the team together. Involve management, which sets the scope and must free up the actions later, the process owners, who know how the work really runs, and one or two people from the shop floor. For an ISO 45001 gap analysis, the safety adviser or prevention officer belongs in the team too, and a representative of the workforce if you have one.

Finally, choose a scale that everyone reads the same way. Three levels are enough: meets (there is a way of working and evidence), partly (there is something, but it is incomplete or cannot be demonstrated) and missing (not arranged). Add not applicable, always with a reason. A scale of five or ten levels mainly produces discussion.

Steps 3 and 4: assess per requirement and collect evidence

Go through the requirements one by one. Ask three questions for each: is there a way of working, is it followed in practice and can you show it? A requirement only counts as met when all three are true. If there is a procedure but nobody follows it, the verdict is partly.

Record for each verdict what it is based on. Note what is already there, what is missing and where the evidence is, with version and date. Talk to the people who do the work, because a document says how something is meant to work and not how it goes. A verdict without evidence cannot be checked in the next round. Evidence comes from four directions:

• Documents: policy, procedures, work instructions and forms
• Records: completed checklists, audit reports and minutes of the management review
• Conversations: what employees tell you about their own work
• Observation: what you see yourself on the shop floor or the building site

Steps 5 to 7: prioritise, action plan and reassessment

Not every gap weighs the same. Sort the findings on two questions: how big is the risk if it stays open, and how much effort does it take to fix? Whatever touches a legal requirement, the safety of people or the core of the standard comes first. Points that take little effort you pick up straight away.

Turn every gap you pick up into an action with an owner, a deadline and a description of what done means. Put the action in the same list as your other improvement actions, so it does not disappear into a separate file. Spread the work: ten big actions at once rarely succeed.

Then reassess. Schedule the reassessment straight away, for example after three to six months, and do it only for the requirements that were open. That shows progress and tells you when you are ready for the internal audit.

Example of a result (illustrative)

Below is an abridged example of a baseline assessment for ISO 9001 at a fictional installation company with thirty employees. All details are illustrative. Each line shows the requirement, the verdict, what is going on and the first action.

In the summary you add up the verdicts, in this example twice partly, three times missing and once met, and you name the points that must come first. Here those are the risk register and the audit programme, because the management review and the certification audit build on them.

• Clause 4.1 Context: partly. There is a SWOT analysis from two years ago, but it is not linked to risks. Action: update it and discuss it with management, owner managing director, within four weeks.
• Clause 5.2 Policy: met. The policy is set, current and known to employees. No action needed.
• Clause 6.1 Risks and opportunities: missing. There is no register; risks only live in the heads of the process owners. Action: first risk session, owner quality coordinator, within six weeks.
• Clause 7.2 Competence: partly. Certificates are kept in a spreadsheet, but the requirements per job are not recorded. Action: record job requirements, owner HR, within two months.
• Clause 9.2 Internal audit: missing. An audit has never been planned. Action: draw up an audit programme and train auditors, owner quality coordinator.
• Clause 9.3 Management review: missing. Action: schedule the first review after the first internal audit, owner managing director.

How it differs from an internal audit and a certification audit

The three look alike, but have a different purpose. A gap analysis is a diagnosis of what still has to be done, without a verdict on a certificate. An internal audit periodically checks whether the system works. A certification audit is the assessment by an external body.

A gap analysis at a certification body is often called a pre-audit. Ask what the body does and does not deliver, because it has to stay impartial and cannot tell you how to fix a shortfall. If you choose an adviser, check that they look at your own practice and do not just work through a standard list.

• Gap analysis: before implementation or when a standard changes, by yourself, an adviser or a pre-audit, with an action plan as the result
• Internal audit: according to an audit programme, by independent internal auditors, with findings and measures
• Certification audit: by an external body, for the certificate and the periodic checks, with findings you handle within the set deadline

Common mistakes with a baseline assessment

A baseline assessment does not lose its value because of the assessment itself, but because of what is missing around it: verdicts that cannot be traced, a scope that is too large or a result that is not used afterwards. These mistakes make a baseline assessment useless, with what to do about each:

Treat the baseline assessment as the starting point of a plan and not as an end product. Discuss the result with management, include the actions in the annual plan and schedule the reassessment before the report is finished. That keeps things moving after the analysis.

• Wanting too much at once: the whole standard, all sites and all processes in one week. Start with a defined scope and expand
• Not recording evidence: a verdict such as 'I think this is arranged' cannot be checked at the reassessment
• Judging too leniently: a half-arranged requirement gets met because the result then looks better. When in doubt, choose partly
• Looking only at documents and not checking whether employees work with them in practice
• Letting one person do the analysis, so management and process owners do not recognise the result and do not support it
• Doing nothing after the baseline assessment: the report disappears into a folder and the actions have no owner or deadline

How BrydgeOne supports this

With the GAP analysis module you carry out a baseline assessment or reassessment per standard. You assess requirement by requirement with meets, partly, does not meet or n/a, record what is already in place, what is missing and what evidence exists, and turn a shortfall into an action or CAPA with an owner, deadline and priority in one click. You see progress in key figures and can export the analysis as a PDF.

Standards framework is the register where those assessments are updated, with evidence per control and a readiness overview per framework. BrydgeOne works with its own framework, the BOCF, and readiness is explicitly not a statement about certification. The Audit-ready check shows per standard what is still missing, in order of severity, and Actions gathers the follow-up in one list. That way BrydgeOne helps you collect and maintain evidence; the assessment remains with you and the certification body.