A gap assessment is a clause-by-clause walk of ISO 9001:2015 against how the shop runs today. Each requirement lands in one of three buckets: we do this and can prove it, we do this but nothing is written down, or we do not do this. That list is the project plan for a first certificate. Six to nine months is typical for a first certification; the gap list tells you which months are writing, which months are operating, and which months are waiting on a registrar.
This is not a public-surface scan of your website. A scan reads public pages only. It cannot open controlled files, training records, calibration logs, internal-audit reports, or management-review minutes. Use the scan for the public surface. Use this walk for the system.
It is also not the eight-step certification process. Gap assessment is step one of that process. This page is only the how: how to sort, what first-timers miss, and when “we do this” is a lie you will pay for at Stage 2.
Three buckets, not a score
Do not average the standard into a percentage. A shop can “meet” 80 percent of clauses and still fail Stage 1 if clause 9.3 and clause 10.2 have no records. Sort every shall-statement in clauses 4 through 10 into exactly one bucket. Write the evidence next to it: a form, a log, a calendar, a named person — or write “none.”
| Bucket | What it means | What you do next |
|---|---|---|
| We do this and can prove it | The work happens and a dated record exists | Leave it. Confirm the record would survive an auditor sampling last month. |
| We do this but nothing is written down | Operators know the practice; an outsider cannot sample it | Write the procedure or form that captures the work you already do. Do not invent a bigger process. |
| We do not do this | The activity does not exist, or it exists as a hallway habit with no owner | Decide: start the process, or justify that the clause does not apply (rare, and only when true). |
How to walk clauses 4 through 10
Sit with the person who runs production, purchasing, and shipping — not only the person who will own the binder. Read each requirement in clauses 4–10. Ask “when did this last happen, who did it, and what would I hand an auditor?” If the answer is a story with no file, it is bucket two. If the answer is a shrug, it is bucket three.
- Clause 4 — context, interested parties, scope. Scope is a short statement of site, products, and processes. Exclusions need a justification. Build-to-print shops often exclude clause 8.3; they cannot exclude 9.2 because audits look like work.
- Clause 5 — leadership, policy, roles. Policy on the wall is not enough. Auditors ask operators what it means. Roles must match who signs, who releases, who stops a bad part.
- Clause 6 — risks, objectives, change. Objectives need measures and a plan. “Quality is important” is not an objective.
- Clause 7 — resources, competence, awareness, documented information. Calibration and training records live here. So does document control: the current revision on the floor, not a shared drive of drafts.
- Clause 8 — operations, purchasing, production, release, nonconforming output. Most shops already do some of this. The gap is usually the record of who released, who evaluated the supplier, and what happened to the bad part.
- Clause 9 — monitoring, internal audit, management review. First-timers are almost always empty here.
- Clause 10 — improvement and corrective action. A pile of emails is not clause 10.2. You need nonconformity, cause, action, and a check that it worked.
The two gaps that stop Stage 1
Registrars differ in tone. They do not differ much on this: if management review (9.3) and corrective action (10.2) have no records, Stage 1 often becomes a “not ready” letter. Those records only exist if the processes ran. A template with blank minutes is not a record. Schedule the first management review and the first internal audit as soon as the documents describe them, then keep the minutes.
Internal audit (9.2) is the third member of that cluster. You cannot hold a serious management review without audit results as an input. Treat 9.2, 9.3, and 10.2 as one clock, not three independent chores.
What a public-surface scan is not
A website scan is a useful first look at what the public surface evidences against ISO 9001:2015. Certificates mentioned on a homepage, a quality policy posted as marketing, a careers page that names ISO 9001 — those are public-surface signals. They are not clause 7.2 competence records. They are not clause 8.7 dispositions. They are not clause 9.3 minutes.
If the scan is low, your public surface is quiet. If the scan is high, your public surface already talks about quality. Neither result closes a gap on this list. Do not paste a scan score into a registrar application as a gap assessment.
Turn the list into a plan
- Count bucket-three items in clauses 9 and 10 first. Those start the record clock.
- For bucket-two items, write the smallest procedure or form that captures the work you already do. Do not add a department you do not have.
- For true exclusions, write the justification in the scope. Recheck it with someone who knows whether design, installation, or servicing exists.
- Name one owner per remaining gap. A list with no owner is a wish.
- Request registrar quotes while the list is still ugly. Lead time is part of the plan, not a prize for finishing the binder.
The first-time certification article places this plan on the three clocks (documents, records, registrar). The process article places it as step one of eight. This page stops when the list is sorted and owned.
False “we do this” answers
- “We talk about quality every morning.” That is not management review unless the clause 9.3 inputs and outputs are on a dated record.
- “We fix problems.” That is not corrective action unless cause, action, and verification are recorded.
- “Everyone is trained on the job.” That is not competence evidence unless you can show the requirement, the training or experience, and who decided the person is competent.
- “Suppliers have been with us for years.” That is not clause 8.4 unless you evaluated them against defined criteria and kept the evaluation.
- “We would never ship a bad part.” That is not clause 8.7 unless nonconforming output is identified, dispositioned, and recorded.
Sources
- ISO 9001:2015 — Quality management systems — Requirements. The gap walk is against this text, not against a vendor checklist.
Frequently asked questions
Do we need a consultant to run a gap assessment?
No. A competent operations manager and the ISO 9001:2015 text can sort the three buckets. Hire help if you lack time or want a second set of eyes on exclusions. Do not hire someone to invent processes you will not run.
Is a public-surface scan a gap assessment?
No. The scan reads public-surface signals only. It cannot inspect controlled QMS documents, implementation records, internal audits, management reviews, or competence evidence. Keep it as a website screening, not as clause coverage.
How long should a first gap assessment take?
A focused walk of clauses 4–10 with production and purchasing in the room is usually days, not months. Writing the missing procedures is a different clock. Do not stretch the sort into a six-month study.
What if we already have a template binder?
Sort the binder the same way. If a procedure promises a meeting you do not hold, that is bucket three disguised as bucket one. Auditors audit the promise. Rewrite or delete it before Stage 1.