An ISO 9001 gap analysis run in July 2026 is a different exercise than one run in June, and the reason is five days old. On 9 July 2026, the ballot on ISO/FDIS 9001 closed. The technical text of the next edition is frozen. Publication is expected in September. Which means the standard you are measuring yourself against is no longer a moving target — and for the first time in a decade, you can score your quality management system against the edition that is coming rather than the one that is leaving.
Direct Answer: An ISO 9001 gap analysis is a clause-by-clause comparison of your existing quality management system against the requirements of ISO 9001 — scoring every requirement twice, once for whether it is documented and once for whether it is actually practiced. The output is a prioritized work list, not a grade. In 2026 it serves two purposes at once: readiness for first-time certification against ISO 9001:2015, and transition readiness against the ISO 9001:2026 text that is now settled and publishing in September.
Most people arrive at an ISO 9001 gap analysis from one of three places. A customer or a contract has made certification a condition of doing business, and you need to know how far away you are. You are already certified, the 2026 revision is landing, and you want to know what it will cost you. Or you have a system that technically passes audits but does not actually run the business, and you suspect the two are related.
This guide covers all three. It walks through what the exercise measures, what the 2026 revision changes about it, whether to score against 2015 or 2026, which clauses generate the most findings, how to score honestly, and how to read a result without flinching. MSI publishes a free ISO 9001 gap analysis worksheet you can use to run one yourself, today, without talking to anyone.
The Method
What Is an ISO 9001 Gap Analysis, Exactly?
Compare. Score. Prioritize.
The word “gap” does a lot of quiet work here. It implies a distance between two fixed points: where you are, and where the standard says you need to be. The second point is knowable — it is written down, clause by clause, in a document anyone can buy. The first point is the hard one, because almost every organization believes its quality management system is closer to the standard than it actually is.
That belief is not dishonesty. It is a structural feature of how quality systems decay. A procedure gets written, approved, and posted. People follow it for a while. Then the process changes, the procedure does not, and eighteen months later the document describes a business that no longer exists. Nobody lies about it. Nobody notices. An ISO 9001 gap analysis is the instrument that notices.
The mechanics are unglamorous and that is the point. You take the clauses of the standard — Clause 4 through Clause 10 in the current edition, which follows the Harmonized Structure shared across most modern ISO management system standards — and you walk each requirement against reality.
Direct Answer: A properly run ISO 9001 gap analysis scores each requirement on two independent axes. Documented asks whether the requirement is written down somewhere a person could find it. Implemented asks whether the organization actually does it, and could produce evidence on demand. A requirement can be fully documented and entirely unimplemented. That combination — a paper system — is the most common finding in first-time work, and a single-axis checklist will never catch it.
This two-axis discipline is what separates a real ISO 9001 gap analysis from a document-hunting expedition. A checklist that only asks “do you have a procedure for this?” will give you a comfortable score and an unpleasant certification audit. Registrars do not audit your binder. They audit your behavior, and they ask your people. Across 200+ audits attended, MSI has watched far more nonconformities come from the implemented column than the documented one.
It is worth being precise about what the exercise is not. It is not an internal audit — an internal audit tests a system that already exists against its own rules. It is not a pre-assessment, which is a registrar service performed by the body that will later certify you. And it is not a sales call. It is a measurement you can run on yourself, with the right structure, before anyone else is involved.
The 2026 Revision
What Does ISO 9001:2026 Change About an ISO 9001 Gap Analysis?
Frozen. Settled. Scoreable.
Until this month, anyone telling you to prepare for ISO 9001:2026 was asking you to aim at a target still being drawn. That objection has expired. The Final Draft International Standard went to ballot within ISO/TC 176/SC 2, and the ballot closed on 9 July 2026. At FDIS stage the technical content is settled; only editorial refinements remain possible. ISO expects the new edition to replace ISO 9001:2015 in September 2026.
Direct Answer: ISO 9001:2026 does not change the method of an ISO 9001 gap analysis. It changes the target. The ten-clause Harmonized Structure survives, the process approach survives, and risk-based thinking survives — this is an evolution, not a rewrite. What moves is emphasis: climate consideration formally absorbed into context, quality culture and ethical behavior written into leadership, and risks and opportunities separated into distinct sub-clauses. Those are the four places a 2026-aware scoring exercise should look first.
Here is what a scoring line looks like against each of the four, in plain terms.
Context and climate (Clause 4.1). The 2024 climate amendment is folded into the body of the standard rather than bolted on. The requirement is not to have a climate program; it is to have considered whether climate change is a relevant issue in your context, and to be able to show that you considered it. A 2026-aware ISO 9001 gap analysis scores this as a documented-consideration question, not an emissions question. MSI's guide to organizational context and structure covers what Clause 4.1 is actually asking for.
Quality culture and ethical behavior (Clause 5.1). This is the change with the longest lead time and the shortest paragraph. Top management is expected to promote a quality culture and ethical conduct — demonstrable, the revision notes, through shared values, attitudes, and observed behaviors. You cannot write a procedure that makes this true. MSI examined the implications in its analysis of the ISO 9001:2026 update on ethics and culture. If your scoring exercise treats this as a documentation line item, it will report green and be wrong.
Quality policy (Clause 5.2). The policy is expected to take the organization's context into account explicitly — which quietly rules out the framed generic statement that says nothing about your business. Score whether your policy could plausibly belong to your competitor. If it could, it is a gap.
Risks and opportunities (Clause 6.1). The 2026 edition breaks Clause 6.1 into sub-clauses that distinguish actions to address risks from actions to pursue opportunities. Most 2015-era systems collapsed the two into one register, and the opportunities column is usually empty or aspirational. That collapse is now visible. MSI's work on ISO standards for innovation and expansion is directly relevant to the half of the clause nobody filled in.
The Transition Clock
27 August 2025 — Draft International Standard released for public comment.
February 2026 — Technical consensus reached on Clauses 1 through 10.
9 July 2026 — FDIS ballot closes. Technical text frozen.
September 2026 — Publication expected. ISO 9001:2015 remains certifiable until this point.
Late 2026 – 2027 — Certification bodies train and are accredited to the new edition. First 2026-edition certificates are widely expected around the second half of 2027.
~September 2029 — Anticipated close of a three-year transition window, subject to confirmation by the accreditation framework.
Transition rules and timelines are set by Global Accreditation Cooperation Incorporated (Global ACI), the body that unified the former IAF and ILAC on 1 January 2026. Your registrar answers to an accreditation body such as ANAB, which answers into that peer-evaluation system. Nobody in that chain has discretion to extend your window — a point MSI develops in its guide to choosing an ISO registrar.
The Real Question
Should You Score Against 2015 or 2026?
Both. One Pass.
This is the question everyone asks in July 2026, and the framing is wrong. It assumes the two are different exercises. They are not. Because the revision is evolutionary, the overwhelming majority of the requirements are identical between editions — and the handful that moved, moved in ways you can score in the same pass.
Direct Answer: Score against both. Run your ISO 9001 gap analysis against ISO 9001:2015 — still the certifiable standard until publication — and add a fourth column flagging the clauses the 2026 edition sharpens. You get a certification-ready result today and a transition roadmap for free. Waiting until September to start does not buy you a better analysis; it costs you a running start on the only requirement that takes years rather than weeks.
That last point deserves weight. Documentation gaps close fast — a competent team can rewrite a procedure in an afternoon. Cultural requirements do not. If ISO 9001:2026 expects top management to demonstrate a quality culture through observed behavior, and your leadership currently demonstrates one through an annual all-hands slide, no amount of September urgency will close that. It is the one gap where an early start is the only start.
For organizations not yet certified, the calculus is simpler than it looks. Implement now, certify to 2015, and transition inside your normal surveillance cycle — because the changes are targeted refinements rather than a structural overhaul, a well-built 2015 system is the cheapest possible foundation for the 2026 edition. Delaying certification until the new edition publishes means delaying the operational benefits by a year and gaining almost nothing. MSI's guidance on planning an ISO 9001 implementation lays out that sequence, and its ISO certification program overview covers what a structured build actually involves.
“The organizations that transition smoothly in 2028 will be the ones that scored themselves in 2026. Not because they were faster. Because they knew what they were looking at.”
Execution
How Do You Run an ISO 9001 Gap Analysis Properly?
Structure. Evidence. Honesty.
Five moves, in order. None of them are complicated. The discipline is in refusing to skip the uncomfortable one.
1. Fix the scope before you score anything. Which sites, which product lines, which processes? An ISO 9001 gap analysis scoped to “the company” produces a result nobody can act on. Scoped to the certification boundary you actually intend to claim, it produces a work list. If you operate across multiple locations, MSI's guide to multi-site ISO certification covers how the boundary decision cascades.
2. Build the instrument before you look at anything. Every requirement of the standard gets its own row. Not every clause — every requirement. Clause 8.5.1 alone contains six separate shall-statements. A row-per-clause worksheet will let five of them hide. This is precisely why MSI publishes its free gap analysis worksheet at requirement granularity rather than clause granularity.
3. Score documented and implemented separately. Two columns, two independent judgments. Document reference in one, evidence reference in the other. If you cannot name the record, the process, or the person who would demonstrate it, the implemented column is not a yes.
4. Go and look. This is the step teams skip, and skipping it is what makes an ISO 9001 gap analysis worthless. Walk the floor. Ask the operator what happens when a part fails inspection, then compare the answer to the procedure. Ask the buyer how a supplier gets approved. The distance between the answer and the document is the gap. Everything else is bookkeeping.
5. Add the 2026 flag column. For each row, mark whether the coming edition sharpens the requirement. Climate consideration, quality culture, ethical behavior, quality policy context, and the risk/opportunity split. Five flags. That column is your transition plan, generated for free from work you were doing anyway.
Direct Answer: The step that decides whether an ISO 9001 gap analysis is worth running is step four: going to look. Scoring from a conference room using the document library measures your documentation, not your quality management system. Registrars interview the people doing the work. Any scoring exercise that does not do the same is measuring a different organization than the one that will be audited.
Where It Breaks
Which Clauses Fail an ISO 9001 Gap Analysis Most Often?
Predictable. Recurring. Fixable.
MSI client experience suggests the findings cluster in the same five places with unnerving regularity, across manufacturing, technology, medical device, government, healthcare, and other regulated industries alike. These are not exotic clauses. They are the ones that require the organization to have thought rather than merely filed.
Clause 4.1 & 4.2 — context and interested parties. Usually a one-page document produced during implementation and never revisited. The requirement is to monitor and review it. A context analysis with no revision history is a gap regardless of how good it was on day one.
Clause 6.1 — risks and opportunities. The most reliably weak clause in the standard. Registers exist; they are static, generic, and disconnected from anything that actually happens. Under the 2026 split, the empty opportunities half becomes conspicuous. MSI's treatment of ISO 9001 compliance in changing operations shows what a live risk register looks like.
Clause 7.1.6 — organizational knowledge. Almost universally under-addressed. The standard asks what knowledge the organization needs and how it maintains it. Most systems answer with a training matrix, which is a different question.
Clause 8.4 — externally provided processes. Supplier controls that consist of an approved-vendor list and nothing else. The clause requires criteria, evaluation, monitoring, and re-evaluation. Most organizations do the first and skip the rest.
Clause 9.3 — management review. The single highest-value clause to get right and one of the most commonly hollow. A management review that does not produce decisions and resource commitments is a meeting, not a review. MSI has written extensively on running an ISO management review and on crafting the procedure that makes it stick. Note that management review is required by ISO 9001, ISO 13485, ISO 14001, and ISO 45001 alike — it is not a quality-only obligation.
Direct Answer: The clauses that most often fail an ISO 9001 gap analysis are 4.1 and 4.2 (context and interested parties, written once and never reviewed), 6.1 (risks and opportunities, static and generic), 7.1.6 (organizational knowledge, answered with a training matrix), 8.4 (supplier controls, an approved list with no monitoring), and 9.3 (management review, held but producing no decisions). Four of the five require judgment rather than paperwork — which is exactly why a documentation-only checklist misses them.
Reading The Result
How Do You Turn an ISO 9001 Gap Analysis Into a Plan?
Sort. Sequence. Start.
A completed ISO 9001 gap analysis that sits in a shared drive has cost you two weeks and bought you nothing. The value is entirely in the sort. Every open row falls into one of three buckets, and the buckets do not carry equal weight.
Housekeeping. Documented, implemented, but the evidence is untidy. Records exist in three places, the revision log is thin, the form is out of date. Real work, low risk. These close in days and they should not be allowed to dominate a steering meeting.
Certification-blocking. A requirement with no documented process, or a documented process nobody follows. A registrar will find these. They set your realistic certification date, and they are the only rows that should drive your timeline.
Structural. The system itself is built wrong — processes defined around the org chart instead of around the work, or a QMS bolted onto a business that operates by exception. These take quarters, not weeks, and they are the rows that produce the actual business benefit. Under the 2026 edition, the culture and ethics requirements land squarely here.
Sequence by dependency, not by ease. Fixing supplier controls before you have defined how you evaluate risk means doing the work twice. This ordering problem — not the fixing itself — is the most common reason organizations report a certification timeline slipping, and it is the specific thing a seasoned ISO consulting partner earns their fee on.
Direct Answer: Turn an ISO 9001 gap analysis into a plan by sorting every open row into housekeeping, certification-blocking, or structural — then sequencing by dependency rather than by ease. Certification-blocking rows set your date. Structural rows deliver the business return. Housekeeping rows feel productive and should never be allowed to set the agenda.
Score Your QMS Against Every Clause — Free
MSI's ISO gap analysis worksheet is built at requirement granularity, with separate columns for documented and implemented, so nothing hides inside a clause. Run it yourself, at your own pace, and see exactly where you stand before you commit a dollar to anything.
Avoid The Traps
What Are the Most Common ISO 9001 Gap Analysis Mistakes?
Flattering. Fast. Useless.
Scoring it yourself, alone, in a room. The quality manager who built the system is the worst-positioned person to score it. Not through bad faith — through familiarity. Pair the exercise: one person who knows the standard, one who knows the process, neither of whom wrote the procedure.
Grading on a curve. “Partially compliant” is the most dangerous cell in any worksheet. It is where uncomfortable findings go to soften. A requirement is met or it is not. If you need a middle value, make it mean something specific — documented but unimplemented — not “we sort of do this.”
Using an ISO 9001 checklist on a different standard. This one is expensive. ISO 13485:2016 does not use the ten-clause Harmonized Structure — it deliberately retains its pre-Annex SL architecture. Running an ISO 9001 gap analysis instrument against a medical device QMS will mis-map half your rows. Use the purpose-built ISO 13485 gap analysis instead.
Treating it as a one-time event. The most useful organizations re-run a light version annually, before management review. It converts the exercise from a certification tollgate into a management instrument — which is the whole idea behind MSI's SureResults maintenance program.
Ignoring the 2026 column because the standard is not published yet. As of 9 July this objection no longer holds. The text is settled. Organizations that wait for the September publication to start looking will spend the autumn doing work they could be finishing.
Beyond Quality
Does an ISO 9001 Gap Analysis Cover Other Standards?
Sometimes. Not Always.
Partly — and the exceptions matter more than the overlaps. Because ISO 14001 shares the Harmonized Structure with ISO 9001, and ISO 45001 does the same, a single scoring exercise can genuinely cover an integrated management system across all three. The clause numbers line up. The evidence often overlaps. This is the entire economic argument behind an integrated management system.
Direct Answer: An ISO 9001 gap analysis extends cleanly to ISO 14001 and ISO 45001, because all three share the ten-clause Harmonized Structure — one exercise can score an integrated management system. It does not extend to ISO 13485, which retains a pre-Annex SL architecture and requires a purpose-built instrument. Scoring a medical device QMS with a quality-management worksheet will mis-map the requirements and produce a dangerously flattering result.
The Gap Analysis Guides
• ISO 13485 Gap Analysis — why the FDA QMSR made a certification gap into a regulatory one, and why an ISO 9001 checklist will actively mislead you.
• ISO 14001 Gap Analysis — the 2026 edition published in April, and the internal audit cycle, not the 2029 deadline, is the binding constraint.
• ISO 14001 + ISO 9001 Integration — how to add an EMS to an existing QMS without rebuilding either.
• Free Gap Analysis Tools — the worksheets themselves.
The five standards MSI implements sit in a deliberate relationship to one another. ISO 9001 is the foundation. ISO 14001 and ISO 45001 bolt on with minimal friction. ISO 13485 is architecturally its own animal. And ISO 7101, the healthcare quality management standard, is the newest addition to that map. Knowing which category you are in before you pick up a worksheet saves more time than any shortcut inside the exercise itself.
The Investment
What Does an ISO 9001 Gap Analysis Actually Cost?
Time. Not Money.
A self-run ISO 9001 gap analysis using a free worksheet costs you nothing but attention — typically two to five working days for a single-site organization, depending on how much walking-and-asking you are honest enough to do. The instrument is free. The discipline is not.
The real spend comes afterward, in closing what you found — which is precisely the argument for scoring first. Organizations that skip the analysis and go straight to implementation routinely report building documentation for requirements they already met, and missing the ones they did not. Running the exercise first protects the budget by pointing the money at the actual gaps.
MSI does not sell an assessment. The worksheet is free, and it stays free. Where MSI adds value is the step after: taking a completed scoring exercise and turning it into a sequenced, resourced roadmap that respects the dependencies. That is a planning session, and it starts with a phone call.
Next Step
You Have the Findings. Now Sequence Them.
A completed worksheet tells you what is open. It does not tell you what to do first, what depends on what, or which of those rows the 2026 edition just made more expensive. In one planning session, MSI turns your findings into a prioritized roadmap with a defensible certification date — drawing on 28 years of practice, 80+ certifications supported, and 200+ audits attended alongside clients.
Call 760-434-9141 — or explore SurePath, MSI's turnkey path from first score to certificate.
What Comes Next
After the ISO 9001 Gap Analysis: Building the System
Build. Audit. Certify.
The scoring exercise is the beginning of a sequence, and the sequence is well understood. Close the certification-blocking rows. Run the system long enough to generate records — this is the step nobody can compress, because a registrar needs to see the system operating, not merely existing. Conduct a full internal audit against the standard, using auditors trained to ISO 19011 principles. Hold a management review that produces decisions. Then invite the registrar.
That operating period is the reason an early ISO 9001 gap analysis is worth so much more than a late one. It is not that the scoring takes long. It is that everything downstream of it has a floor you cannot lower. Organizations that score in July have a genuine chance of certifying inside the year. Organizations that score in November are certifying next year, and telling themselves otherwise.
Building the internal audit capability is the highest-leverage investment in that chain, because it is the only one that keeps paying after the certificate arrives. MSI has trained 600+ professionals, and its ISO 9001 internal auditor training exists precisely so that the people who scored the gaps can be the people who keep them closed. The internal auditor and ISO overview programs cover the same ground for teams starting cold.
And if the whole vocabulary still feels like a foreign language — clauses, registrars, accreditation, surveillance cycles — MSI's ISO consulting decoder ring and its explainer on what ISO actually is are the right places to start before the worksheet.
Watch: What ISO 9001:2026 Asks of Leadership
The 2026 edition puts quality culture and ethical behavior on top management's desk, not the quality manager's. The ISO Executive Decision Briefs are short video sessions built for the people who have to sponsor that shift — what certification costs, what it returns, and what leadership is actually being asked to demonstrate.
Questions
ISO 9001 Gap Analysis: Frequently Asked Questions
Asked. Answered. Directly.
How long does an ISO 9001 gap analysis take?
A self-run ISO 9001 gap analysis typically takes two to five working days for a single-site organization. Multi-site or complex operations take longer, driven almost entirely by how much floor-level verification you do rather than by how many clauses you read.
Should I wait for ISO 9001:2026 to publish before running one?
No. Run your ISO 9001 gap analysis now against ISO 9001:2015, which remains the certifiable standard until publication, and flag the five requirements the 2026 edition sharpens. The FDIS ballot closed on 9 July 2026 and the technical text is settled, so those flags will not move. Waiting costs you a running start on the culture requirements, which are the only ones that take years.
What does an ISO 9001 gap analysis cost?
A self-run ISO 9001 gap analysis using a free worksheet costs only your team's time. MSI does not charge for assessments — the worksheet is free. The larger investment comes later, in closing what you find, which is exactly why scoring first protects the budget: it points the spend at real gaps instead of assumed ones.
Can I run one myself, or do I need a consultant?
You can absolutely run an ISO 9001 gap analysis yourself, and MSI publishes the worksheet so you can. The place outside help earns its keep is the step after: sequencing the findings by dependency, and pricing the ones that look small but are not. That is a planning session, not an assessment.
Does an ISO 9001 gap analysis work for ISO 13485?
No, and using one is an expensive mistake. An ISO 9001 gap analysis instrument is built around the ten-clause Harmonized Structure. ISO 13485:2016 deliberately retains its pre-Annex SL architecture, so the clause numbers do not correspond. Use the purpose-built ISO 13485 gap analysis instead. It extends cleanly to ISO 14001 and ISO 45001, which do share the harmonized structure.
How often should we repeat it?
Annually, in a lighter form, ahead of management review. Treating the ISO 9001 gap analysis as a one-time certification tollgate is how systems drift; treating it as a recurring management instrument is how they stay useful. Certified organizations should also run a fresh pass when a standard revises — which is now.
When will ISO 9001:2026 certificates actually be available?
Later than most people assume. After publication in September 2026, certification bodies must themselves be trained and accredited to the new edition — a process that historically takes several quarters. Widely expected first certificates land around the second half of 2027. That lag is another reason an ISO 9001 gap analysis against 2015 today, with 2026 flags attached, is the pragmatic move rather than the cautious one.
References & Authoritative Sources
• ISO — ISO/FDIS 9001, Quality management systems — Requirements
• ISO/TC 176/SC 2 — ISO 9001 revision update: FDIS ballot
• ISO/TC 176/SC 2 — Quality systems subcommittee
• ISO — Standards catalogue and the Harmonized Structure
• ISO — ISO 14001:2015 (withdrawn, replaced by ISO 14001:2026)
• ISO — ISO 14001 explained
• ISO — The ISO 14000 family
• Global Accreditation Cooperation Incorporated (Global ACI)
• ANAB — ANSI National Accreditation Board
• ASQ — ISO 9001 and related standards
• ASQ — ISO 14001 environmental management
• ASQ — ISO 19011 auditing management systems
• ASQ — What is a quality management system?
• ASQ — The Plan-Do-Check-Act cycle
• ASQ — Continuous improvement
• eCFR — 21 CFR Part 820, Quality Management System Regulation
About Management Systems International (MSI)
Diana Lynn is President and Principal ISO Consultant at Management Systems International (MSI), a veteran-owned, female-owned ISO consulting firm she co-founded in 1998. With 28 years of experience including extensive AS9100 work in MSI's early years, MSI's track record includes 80+ certifications supported, 200+ audits attended, and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare, and other regulated industries.
Today MSI implements ISO 9001, ISO 13485, ISO 14001, and ISO 45001, with an expanding focus on ISO 7101 healthcare quality.
