A gap analysis compares what an organisation currently does against what a standard requires, and produces a prioritised list of what is missing, what exists but needs work, and what is already adequate.
Why it comes first
Until scope is defined and the current state is understood, nobody can tell you what certification will cost — not a consultant, not a certification body. Any figure offered before that is an assumed effort multiplied by an assumed rate.
A properly scoped gap analysis converts an unknown into a plan with a timeline and an effort estimate, at a fixed and modest cost, before larger commitments are made.
What a good one produces
- A clear scope recommendation, with the personnel count that will drive audit days
- Requirement-by-requirement current state
- What is missing, ranked by effort and by risk
- What already exists and can be used as-is — usually more than expected
- A realistic timeline with decision points
- An honest go or no-go
What a bad one produces
A checklist of every clause marked red, and a proposal to build everything from scratch. Most organisations already do much of what the standard requires; they simply do not record it in a form an auditor can trace. Distinguishing a genuine process gap from an evidence gap is most of the value.
Not the same as a pre-assessment
A pre-assessment is an optional service from a certification body, conducted closer to the audit, that samples readiness. A gap analysis is a consulting activity at the start. Certification bodies cannot consult on the system they audit, which is why these are different services from different providers.