ISO 9001 gap analysis: what Sterling examines, what you receive, and what happens next

Readiness check, gap analysis and Stage 1: three different things

The readiness check is Sterling's free online tool: ten minutes of structured questions that return a score and your first priorities, based only on your own answers. The gap analysis is the first stage of a Sterling engagement, in which our consultants examine the evidence for themselves. Stage 1 is the certification body's readiness review, held after implementation, internal audit and management review, to decide whether you can proceed to the Stage 2 certification audit; the guide to the Stage 1 and Stage 2 audits explains it.

What the gap analysis examines

Findings are grouped under the requirement clauses of ISO 9001:2026, 4 to 10, from context of the organisation to improvement.

Documents

Policy and objectives, process descriptions, procedures, forms and contract templates, and how each is approved, versioned and made available. The test is whether the documented information the standard requires exists and is controlled, not how thick the folder is.

Practice

Work as it is done, which often differs from work as written: enquiry and requirement review, design where you carry it out, purchasing, production or service delivery and release, and what really happens when something goes wrong.

Records

The proof that processes ran: order reviews, supplier evaluations, inspection and release, calibration where measurement matters, training, complaints, corrective actions, performance figures and customer feedback. A missing record usually outweighs a missing document, because records take months to accumulate and cannot accurately be backdated.

People

Leadership on direction, quality objectives, risks and opportunities and resources; process owners on their own processes; and staff on how they know what to do and what they do when work does not conform.

Sites

Every location in the intended scope, including warehouses, project sites and outsourced processes. Similar sites are sampled; sites that work differently are each examined. The intended scope is tested as well, and the ISO 9001 scope guide covers how to word it.

How the evidence is gathered

The techniques are those of a management system audit, as ISO 19011 describes them, used long before any certification body arrives.

1. Desk review. You send existing documents and a few recent records, which we read before the fieldwork so that time with your people is spent on practice.
2. Opening meeting. Leadership confirms the purpose, intended scope and schedule, and describes the customers and the pressures on delivery.
3. Interviews and walk-throughs. We trace real cases with the people who handled them: an order from enquiry to invoice, a supplier from selection to evaluation, a complaint from receipt to closure.
4. Sampling of records. Samples are small and deliberate, spread across products, customers, shifts and sites, and include the awkward cases, because a sample of good examples alone proves nothing.
5. Closing meeting. Preliminary findings are discussed before the report is written, so it holds no surprises.

Findings describe the system, never individuals, so people speak openly about how work really happens.

What you receive

A gap report organised by clause

For each requirement area, the report states what is in place and working, what exists but is incomplete or not followed, and what is missing, with the evidence seen. Practices worth keeping are named, so implementation builds on them.

A prioritised action plan

Every gap becomes an action with an owner, a date and the resources it needs. Items whose evidence takes longest to build come first, such as supplier evaluation, customer satisfaction measurement, internal audit and management review; gaps that affect customers now come next, then quick corrections. Decisions that only management can take are listed separately.

An effort and timeline estimate

The time your people will need, by role; the share of the work Sterling carries under each route; how long the system must run before the certification audits; and a realistic window for Stage 1 and Stage 2, subject to the certification body's availability. Most organisations need three to six months in all, and the ISO 9001 timeline guide explains what moves that range.

Who needs to be in the room, and for how long

Times are typical for a single site.

A small single-site organisation usually needs one day of fieldwork; a mid-sized business with design activity, several departments or shift work needs two to three, and each further site adds time. The report follows within about two weeks. When a gap analysis underestimates the work, it is usually because the people who do that work were not in the room.

What happens next: Design™ or Drive™

The report is walked through with leadership, the action plan is agreed and the route is chosen. Both routes follow Sterling OS™ and run in Effivity; they differ in how much of the implementation Sterling carries.

• Design™, guided implementation. Your people do the work, supported by Sterling's templates, workshops and coaching. It suits teams with a capable coordinator and time to give.
• Drive™, fully managed implementation. Our consultants carry the agreed work alongside your process owners, who still own and run their processes. It suits organisations with limited capacity or a firm customer deadline.

The kick-off confirms the engagement team, a weekly working session, the deliverables and the decision owners, and the plan's milestones are tracked in Effivity, included with the engagement, at no additional cost. The ISO 9001 implementation plan guide follows the project from there.

What a gap analysis is not

• Not a certification audit. There is no pass, no fail and no certificate; only an accredited certification body certifies, after its own Stage 1 and Stage 2.
• Not the readiness check. The online tool reflects your answers; the gap analysis reflects the evidence, and the two can disagree.
• Not your internal audit. ISO 9001 requires your own audit programme on a running system, which the ISO 9001 internal audit guide covers.
• Not document writing. It tells you what to write and what only needs recording; the ISO 9001 documentation guide sets out what is required.
• Not a transition review. Holders of an ISO 9001:2015 certificate need the narrower exercise described in the ISO 9001:2026 transition guide.

ISO 9001 gap analysis: questions buyers ask