Before you write a single procedure, you need to know exactly where your organization stands against ISO 9001 — clause by clause. A structured gap assessment is the difference between an implementation that runs smoothly and one that discovers surprises during the certification audit. Drawing on assessments we have run across dozens of manufacturers, we walk through the complete process: how to prepare and scope the assessment, how to gather objective evidence through document review and floor interviews, how to score conformity against each clause of ISO 9001:2015, how to categorize gaps by severity and effort, and how to translate the results into a realistic project plan with owners and timelines. Includes the clause-by-clause checklist framework we use and the most common gaps we find in first-time implementations.
Preparing and Scoping the Assessment
Before you write a single procedure, you need an honest, clause-by-clause picture of where you stand against ISO 9001:2015. Preparation determines whether the assessment produces real insight or a superficial checklist. Start by defining scope: which sites, which processes, which products are included. Gather the inputs you will need — existing procedures, the quality manual if one exists, recent audit results, complaint data, and process metrics. Identify who you will interview across every function, from top management through operators.
Build your assessment around the structure of the standard itself: Clause 4 (context), 5 (leadership), 6 (planning), 7 (support), 8 (operation), 9 (performance evaluation), and 10 (improvement). Plan two to five days on site depending on complexity. Set expectations with the organization that this is a diagnostic, not an audit with consequences — you want honest answers, not defensive ones.
Gathering Objective Evidence
A credible gap assessment rests on evidence, not opinion. Use three complementary methods. Document review tells you whether required information exists and is controlled — but a perfect document proves nothing about practice. Interviews reveal whether the people responsible understand and actually follow the process. Floor observation shows whether the real work matches the documented work. The gaps between these three sources are the most revealing findings of all.
For each clause, ask what objective evidence would demonstrate conformity, then go find it. For Clause 8.5.1, that means watching production and checking whether controlled conditions, monitoring, and documented information are genuinely in place. For Clause 9.2, it means examining whether internal audits actually happen and whether they find anything. Capture specifics — record IDs, dates, part numbers — so every finding is traceable and defensible.
Scoring and Categorizing Gaps
Score each clause on a consistent scale: conforms, partially conforms, does not conform, or not applicable. "Partially conforms" is the most important and most common category — it captures the process that exists but is inconsistently applied, or the procedure that is written but not followed. For every score below full conformity, document the specific gap and the evidence behind it.
Then categorize gaps by two attributes that drive the plan: severity (how far from conformity and how much risk it carries) and effort (how much work to close). A missing internal audit program is high severity and high effort; an out-of-date document is often low severity and low effort. This categorization is what transforms a list of gaps into an actionable plan. The most common gaps we find in first-time ISO 9001 implementations cluster in risk-based thinking (6.1), operational planning and control (8.1), internal audit (9.2), and management review (9.3).
From Assessment to Project Plan
The assessment is only valuable if it becomes a plan. Take every gap, apply the severity and effort categorization, and sequence the work. Quick wins — high severity, low effort — go first to build momentum and demonstrate progress to leadership. The heavy, foundational gaps — building the risk-based process approach, standing up an internal audit program, establishing meaningful management review — must start early because they take the longest to embed and to generate the records a registrar will want to see.
Assign every action an owner, an effort estimate, and a realistic target date. Build in time for the system to actually run before the certification audit — auditors want to see evidence that processes have operated over time, not procedures written last week. The output is a resourced, sequenced project plan with clear accountability. That plan, grounded in a rigorous assessment, is the single best predictor of a smooth first-time certification.
