I was at a plant preparing for IATF 16949 certification. The quality manager showed me his documentation with pride: four binders, each over three hundred pages. Procedures, work instructions, forms, records. Colour-coded tabs, corporate logos on every cover.
"We have everything," he said.
I opened a procedure at random. It had been written three years ago, referenced withdrawn standards, described processes that no longer existed on the shop floor, and bore the signatures of people who had left the company two years ago. The silence that followed my question about practical implementation was one I have heard in hundreds of audits.
That distance between what is written and what actually happens is precisely where Gap Analysis does its work.
What Gap Analysis Actually Measures
Gap Analysis is a systematic comparison of your current state ("as-is") against a defined target state ("to-be"). In the context of quality management, it measures what your QMS currently does against what it must do — whether driven by ISO 9001, IATF 16949, AS9100, customer-specific requirements, regulation, or your own strategic targets.
It is not a checklist exercise. It is a diagnostic tool that tells you not just whether a gap exists, but how large it is, where exactly it sits, and what is causing it.
When to Run a Gap Analysis
The most common trigger is preparation for certification or recertification to a standard. Before investing in consultants or project teams, a Gap Analysis tells you exactly where you stand against the requirements.
Standard transitions are another critical trigger. When ISO 9001 moved from the 2008 to the 2015 version, many companies discovered their existing systems did not address organisational context, risk-based thinking, or organisational knowledge. The gaps were significant.
Post-merger integration is a third scenario. Two companies join; each brings its own QMS, culture, and processes. Gap Analysis maps the overlap, the holes, and the areas requiring a greenfield build.
Finally, there is customer audit preparation. When a key OEM audits your facility, a Gap Analysis simulating their checklists can be the difference between approved supplier status and a 90-day conditional deadline.
The Six-Step Method
A defensible Gap Analysis follows a disciplined sequence. Skip any step and the output degrades from actionable intelligence to opinion.
The Gap Analysis Sequence
- 011. Define the reference frameIdentify the standard, CSR, regulation, or strategic benchmark you are measuring against.
- 022. Decompose into auditable questionsTranslate each clause into specific yes/no questions with verifiable evidence.
- 033. Gather evidenceCollect documents, conduct interviews, and observe the process at the gemba.
- 044. Score each requirementRate against a fixed scale: conforms, partially conforms, does not conform, not applicable.
- 055. Quantify and visualiseAssign severity and build a heat map so management sees priorities at a glance.
- 066. Build the action planAssign owners, deadlines, and verification methods. This is a living document, not a file-and-forget output.
Translating Clauses Into Verifiable Questions
Take ISO 9001:2015, clause 7.1.6 — Organisational Knowledge. A weak analyst writes: "Does the organisation manage knowledge?" A competent one decomposes the clause into six or more verifiable questions.
- Has the organisation defined its knowledge base?
- Is it documented?
- Does it include lessons learned from past projects?
- Does it incorporate feedback from customers and suppliers?
- Is it updated when organisational context changes?
- Is it shared across relevant functions?
One clause yields six to ten concrete questions. This is why a proper Gap Analysis cannot be done in an afternoon. It requires deep knowledge of the standard and the discipline to avoid leading questions.
The Evidence Rule
Trust only verified evidence. What someone tells you in a meeting room is a claim. What you observe at the workstation and confirm in the records is evidence. Previous audit findings, process data, and direct observation on the floor — that is your evidence base.
Scoring and Prioritisation
Use a simple, consistent scale. Each requirement receives one of four ratings, each triggering a defined response.
| Rating | Meaning | Required Action |
|---|---|---|
| Conforms | Fully meets requirement; evidence available | None |
| Partially conforms | Exists but has deficiencies | Improvement |
| Does not conform | Missing or in contradiction with requirement | Corrective action |
| Not applicable | Requirement does not apply to the organisation | Justification documented |
For every gap, assign severity: low, medium, high, or critical. Then assess remediation difficulty in terms of time, cost, and resources required. Priority is the intersection of severity and difficulty. Visualise this on a heat map — red for critical, yellow for medium, green for minor. Management sees instantly where the fires are.
Case Study: The Twelve-Year Certificate
A mid-sized automotive supplier — 350 employees, precision steel components for two major OEMs — was transitioning from ISO 9001:2008 to the 2015 version. Management was convinced the transition was a formality. They had held the certificate for twelve years.
The Gap Analysis took three weeks and identified 37 gaps. Twelve were critical: a complete absence of risk-based thinking, no analysis of organisational context, and no organisational knowledge base. Eight were medium — incomplete process measurement monitoring, inadequate supplier evaluation. Seventeen were low-level documentation deficiencies.
The most revealing finding was around risk. The company had no systematic approach to risk identification or management — something the 2015 standard treats as fundamental. Yet they had experienced three serious incidents in the past year that were direct consequences of unidentified risks: a critical supplier failure, a heat treatment process defect, and an unplanned CNC machine downtime.
They had held a certificate for twelve years, but their QMS had effectively been frozen since 2008.
The action plan ran for six months. At the end, they passed certification with zero major nonconformities. More importantly, their QMS became a functional system. The cost of quality dropped measurably. Internal problem response time shifted from weeks to days.
The Five Failure Modes
I have seen Gap Analysis fail in predictable ways. Each failure mode is avoidable if you recognise it early.
How Gap Analysis Goes Wrong
What teams do
- One quality manager works alone with a checklist.
- Audits the documentation, not the realisation process.
- Focuses on records and procedures; ignores leadership, culture, and awareness.
- Produces a report with no action plan, owners, or deadlines.
What works
- Cross-functional team brings different perspectives and eliminates blind spots.
- Verifies at the gemba whether written procedures are actually followed.
- Evaluates soft requirements with the same rigour as hard documentation.
- Every gap has an owner, a deadline, and a defined verification method.
Gap Analysis is not an event. It is a process. Standards evolve, regulations change, your business grows. What was compliant last year may be a gap today.
From Compliance to Strategic Transformation
The best organisations do not run Gap Analysis only for certification. They use it as a strategic instrument for annual self-assessment, benchmarking against industry best practice, and measuring distance from three-year strategic targets.
When Gap Analysis stops answering "What does the auditor want?" and starts answering "How do we get better?", the QMS becomes what it was always meant to be: a tool for continuous improvement.
I returned to that plant from the opening story three months after the Gap Analysis. The quality manager did not show me binders this time. He took me to the line. He pointed to a new visual board at the workstation — their risk management system, visible to every operator. The thick binders were in the archive. The new manual was thin, but people actually used it.
That is the difference between documentation and a system. Gap Analysis is the bridge between them.