What is an ISO 9001:2026 gap assessment?
A gap assessment compares the applicable requirements of the published 2026 edition with the organisation’s actual QMS. Its purpose is to identify necessary changes and uncertainty before the external assessment. It is not the same as a document count or a prediction that certification will be granted.
Use authorised access to the final standard published on 16 September 2026. Public summaries can direct attention to changed topics, but they do not provide all the assessment criteria. Keep exact requirement references in your internal assessment without reproducing the copyrighted standard in public materials.
The transition guide explains where gap assessment fits. The method below is an original practical approach for producing conclusions that process owners can challenge and act on.
Define scope and assessors first
Confirm the QMS scope, locations, relevant outsourced activities and important interfaces. Determine who will assess each area and whether they understand both the requirement and the process. Involve process owners as evidence providers without relying solely on their self assessment.
For a multisite system, consider where practices genuinely differ. A central policy may be common while implementation depends on local scheduling, staffing or systems. The sample should reflect meaningful differences rather than selecting only the easiest site to visit.
Clarify whether the exercise covers only changed expectations or also known weaknesses in the current QMS. Both can matter to readiness, but labelling them separately helps leaders understand the origin and priority of the work.
Build a requirement and evidence matrix
A useful record contains a requirement reference, interpretation note, affected processes, evidence examined, conclusion, rationale, owner and proposed verification. The layout is optional. Its value comes from traceability between criteria and evidence.
Do not start by searching for a document with the same title as a highlighted topic. Start by asking what the requirement means for the organisation’s work. Then identify the controls and evidence that address it. One process may support several requirements, and one requirement may depend on several processes.
Record the evidence sufficiently precisely to support review. A description such as checked management review is weak. A better entry identifies which review, which decision and what follow up was examined, while protecting confidential information appropriately.
Sample processes from trigger to result
Follow a real transaction, change or customer issue through its stages. Ask who decides, how information is passed, which controls apply and what shows whether the intended result was achieved. This makes gaps at handovers easier to see.
For example, a maintenance business may recognise an opportunity to reduce repeat visits. The assessment can trace how that opportunity was selected, assigned, implemented and evaluated. If the business lists ideas but nobody can show what happened next, further investigation is needed.
Include a difficult or unusual case where appropriate. A process that works only for straightforward orders may fail when customer requirements change. Sampling cannot prove every transaction is conforming, but thoughtful selection makes the conclusions more useful.
Classify conclusions honestly
Use clear categories such as demonstrated conformity, action required, insufficient evidence and optional improvement. These are suggested assessment labels, not official ISO grading terms.
Demonstrated conformity means the criteria and sampled evidence support the conclusion. Action required means there is a defined gap. Insufficient evidence means more investigation is needed before making a reliable judgement. An improvement idea may be worthwhile even when a requirement is already met.
Avoid giving every issue a percentage score that suggests mathematical precision. A single critical gap may matter more than several well documented areas. Explain significance through customer impact, process consequences and certification readiness rather than averaging away the problem.
Turn a gap into a verifiable action
State the gap, required outcome, owner, resources, dependencies and acceptance evidence. Consider whether the cause is unclear responsibility, unsuitable workflow, missing competence, ineffective information or a different system issue. Selecting a document revision before understanding the problem can produce superficial closure.
Suppose a team cannot demonstrate that decisions on quality concerns are implemented. The action should address how decisions become controlled work and how results are reviewed. Writing another statement of commitment may leave the original weakness untouched.
The transition plan template provides fields for this handover. Keep optional enhancements distinguishable so they do not compete invisibly with work necessary for conformity.
Challenge and verify the conclusions
Have relevant process owners review factual accuracy and have a competent reviewer challenge unsupported interpretations. Resolve disagreements against the published requirement and evidence. A consultant’s preference or a provider’s marketing summary should not become an invented obligation.
After implementation, verify using operating evidence. The original assessor’s recommended solution is not itself proof that the solution worked. Internal audit and management review can provide further evaluation and decisions about remaining gaps.
Keep the assessment current when processes or external arrangements change. Present the certification body with an honest picture of readiness. A useful gap assessment reduces surprises by exposing what is known, what needs action and what still requires evidence.