Gap analysis playbook

How to use this playbook

Work clause by clause. For each item, tick the status that matches today, note evidence you already have, and list the gap action with an owner and date.

• Obtain ISO 9001:2026 after 16 September 2026 and read it against your current QMS scope.
• Mark each row as Met / Partial / Gap — do not mark Met without named evidence.
• Raise CARs for Partial/Gap items so owners, due dates and verification are tracked.
• Confirm transition timing with your certification body before booking the transition audit.

ISO 9001:2015 remains the edition most certificates currently reference until you transition. Indicative transition windows are commonly discussed as ~three years after publication — verify with your accreditation / certification body.

Clause 5.1 — Quality culture & ethics

Auditors will look for demonstrated leadership behaviour and awareness — not only a signed quality policy.

• Quality policy / manual language shows how top management promotes quality culture and ethical behaviour (not a one-line claim).
• Management review inputs include culture / ethics / behavioural topics where relevant to your organisation.
• Awareness / induction content covers expected behaviour and how people escalate quality or integrity concerns.
• Evidence exists of leadership communication (toolbox talks, town halls, emails, minutes) — not only a signature block.
• Roles that influence quality outcomes know how culture expectations apply to their work.

Evidence to attach: policy revision, MR minutes, induction slides, communication records.
Gap actions: _______________________________________________

Clauses 4.1 & 6.1 — Climate & planning

Climate-related issues belong in organisational context and planning where they are relevant — not as a generic paragraph copied into every manual.

• Context register / PESTLE (or equivalent) considers climate-related external issues that affect your QMS scope.
• Interested-party needs/expectations capture climate-related requirements where customers, regulators or communities impose them.
• Planning (6.1) links climate-related issues to risks, opportunities and actions — or documents why not applicable with rationale.
• Actions have owners, due dates and review points (not orphan bullets in a Word appendix).
• Management review reviews climate-related issues and planning outcomes when they are material.

Evidence to attach: context register export, interested-party register, risk/opportunity records, MR minutes.
Gap actions: _______________________________________________

Clause 6.1 — Risk & opportunity linkage

The 2026 direction tightens how risks and opportunities are identified, separated and linked to actions.

• Risks and opportunities are recorded as distinct items (not one blended list).
• Each item links to actions, controls or opportunities pursued.
• Actions are tracked to closure with effectiveness / verification where required.
• Planning outputs are available for internal audit and management review sampling.
• Changes in context trigger a review of risks and opportunities.

Evidence to attach: risk/opportunity register, action logs, audit samples.
Gap actions: _______________________________________________

Documented information & system currency

• Quality policy, manuals and key procedures are revision-controlled and match current practice.
• Live registers (NCR/CAR, supplier, calibration, training, etc.) are the system of record — not parallel spreadsheets.
• Obsolete documents are withdrawn; people can find the current controlled copy.
• Transition-related document updates are planned with owners and issue dates.

Recommended transition sequence

1. Obtain ISO 9001:2026 after publication and map it to your scope.
2. Complete this gap analysis with named evidence and owners.
3. Update documented information and live registers where gaps sit.
4. Brief leadership and teams on culture / ethics expectations and any climate planning changes.
5. Internal audit against updated 2026-aligned criteria.
6. Management review that includes transition readiness.
7. Book the transition audit with your certification body.

Veridian IMS can host controlled registers, document control and audit workflows for this work. Certification outcomes remain with your certification body.