ISO 9001 Gap Analysis: Why the Clock Already Started

Quality Management Systems · ISO 9001:2026 Transition

By Diana Lynn, President and Principal ISO Consultant, MSI · Updated October 4, 2026

An ISO 9001 gap analysis is a clause-by-clause comparison of your quality management system against every ISO 9001 requirement. On September 16, 2026, the requirement list changed. ISO published the sixth edition of the world’s most-used quality standard, and every ISO 9001:2015 certificate now carries an expiration date that no surveillance audit can extend.

Here is the uncomfortable part. Most quality managers already believe they know where their gaps are. MSI client experience suggests that belief is right about the documents and wrong about the evidence, and evidence is the one thing a transition cannot rush. This guide shows how to run an ISO 9001 gap analysis against the published 2026 text, score it honestly, and turn it into a plan your leadership team will actually fund.

Definition and Scope

What Is an ISO 9001 Gap Analysis Now That ISO 9001:2026 Is Published?

Measure. Score. Sequence.

The mechanics fit in one sentence and go wrong in a dozen ways. You take the standard clause by clause and ask two separate questions of each requirement. Does a documented arrangement exist that satisfies it? And is that arrangement actually operating, producing records, and known to the people who are supposed to follow it?

Those questions are separate on purpose. An ISO 9001 gap analysis that asks only the first one is measuring paperwork. A procedure that exists but nobody follows is more dangerous than a gap everybody knows about, because it creates a false sense of coverage while the known gap at least creates urgency.

The 2026 edition adds a second dimension. Until your transition audit closes, your certificate still names ISO 9001:2015, so your system must keep conforming to the old edition while it moves toward the new one. A useful ISO 9001 gap analysis therefore carries two edition columns, not one. MSI’s step-by-step method for the scoring itself is covered in the companion ISO 9001 gap analysis guide; this article focuses on running it against the published 2026 text.

Scope matters just as much. Scoring only the clauses you think changed is a spot check, not an ISO 9001 gap analysis. Requirements interact: weak competence records at Clause 7.2 surface as production findings at 8.5, and a vague quality policy at 5.2 produces objectives at 6.2 that nobody can measure. The same architecture applies across standards, which is why MSI’s parallel guides to the ISO 14001 gap analysis and the ISO 13485 gap analysis follow the same two-axis logic.

One structural note before going further. ISO 9001, ISO 14001 and ISO 45001 share the Harmonized Structure, the ten-clause backbone formerly called Annex SL. ISO 13485 does not, so its findings must be scored against its own architecture. MSI’s overview of how an ISO audit works covers the shared spine in more detail.

The Transition Clock

When Must Your ISO 9001 Gap Analysis Be Finished?

Published. Counting. Closing.

The dates are no longer forecasts. Global ACI’s published transition requirements for ISO 9001:2026 (document Global ACI-TECH-3-TR 2029-09-30 (M)) set a three-year transition. As of October 4, 2026, these are the milestones every certified organization plans against.

Now run the arithmetic almost nobody runs. Your registrar cannot transition you until it is accredited to the new edition, so most transition audits will land in 2027 and 2028. Before that audit, your revised arrangements need at least one internal audit and one management review carrying the 2026 requirements. Back that out and documentation must be substantially finished months earlier, and the ISO 9001 gap analysis that tells you what to change must come before all of it.

There is also a capacity reason to move now. Global ACI notes more than one million accredited ISO 9001 certificates, and certification counts are tracked in the ISO Survey. When that many organizations transition inside one window, qualified auditor days become scarce. Accreditation bodies such as ANAB oversee the registrars who will be booking those days. MSI’s analysis of the 2026 transition deadlines and its ISO transition planning calendar work through the back-scheduling in detail.

The 2026 Delta

What Changed in ISO 9001:2026 That an ISO 9001 Gap Analysis Must Score?

Culture. Change. Evidence.

The ten-clause backbone survives, so nobody needs to rebuild a system from scratch. The foreword of ISO 9001:2026 names the main changes: core management system terms added to Clause 3, quality culture and ethical behaviour introduced into the requirements, risks and opportunities separated, management of change strengthened, and Annex A expanded as informative text. ISO 9000 remains the normative reference for quality vocabulary.

The largest new item sits in leadership. Clause 5.1.1 i) requires top management to demonstrate leadership by promoting quality culture and ethical behaviour, and Clause 7.3 e) requires that persons doing work under the organization’s control are aware of it. No earlier edition contained either requirement, so every certified organization starts these lines of its ISO 9001 gap analysis at zero.

Status labels matter, because AI summaries and consultants alike blur them. A requirement uses “shall.” A NOTE is for consideration only and creates no obligation. Annex A is informative and adds no requirements. The table below labels each item scored in this ISO 9001 gap analysis, verified against MSI’s licensed copy of ISO 9001:2026.

Two items deserve a warning. The Clause 7.1.4 NOTE on social, psychological and physical work-environment factors dates from the 2015 edition; the only new sentence says some factors can be influenced by quality culture and ethical behaviour, and it is still a NOTE. Clause 6.3 existed in 2015 as well; what changed is the list of considerations. MSI’s full breakdown of the ISO 9001:2026 changes walks through each one, and ISO’s own ISO 9001 overview page summarizes the edition for leadership audiences.

Culture evidence is where most teams stall, because an auditor cannot grade a feeling. Expect the requirement to be examined through artifacts: management review decisions that weighed quality against cost and schedule, awareness gathered from people rather than a training matrix, and dated examples from every department. ISO 10010:2022, which ISO 9001:2026 cites for quality culture guidance, offers self-assessment tools. MSI’s guide to auditing quality culture under ISO 9001:2026 lists the evidence types, and its reference list of unethical business practices shows what erodes that culture fastest.

Original Asset

How Should You Score an ISO 9001 Gap Analysis Across Two Editions?

Two Axes. Two Editions. One Grid.

Use one consistent scale, applied the same way to every clause, so the result is a comparable picture rather than a mood. The Two-Edition Gap Scoring Grid below is built for this article to make that discipline concrete. Score each requirement once against ISO 9001:2015 and once against ISO 9001:2026, then let the decision rules assign the work.

Decision rules for the grid.

• 2015 score below 3: fix now. It is a current conformity issue, regardless of the transition.
• 2015 score of 3, 2026 score below 3: a transition item. Assign an owner and a date before your next management review.
• 2026 score of 0 on a new requirement: an evidence-over-time item. Start record generation immediately, because trend data cannot be created retroactively.
• Any score of 3 with no cited evidence: downgrade to 1 until the evidence is named.
• Five or more 2026 items below 2 in one clause: treat the clause as a structural project with its own plan, not a list of edits.

MSI’s free ISO 9001:2026 Transition Gap Analysis Checksheet applies the same documentation-versus-process split across 114 rows, so you can score the grid without building a spreadsheet. If you also want a scored view of what could delay the transition itself, the free ISO Transition Risk Scorecard pairs with MSI’s article on ISO transition risk assessment.

Start at the End

Why Should Management Review Launch Your ISO 9001 Gap Analysis?

Present. Mark. Decide.

Most teams run an ISO 9001 gap analysis in a back office and then try to sell the results upward. MSI recommends the reverse: start with management review, because it is where the transition must eventually prove itself. Clause 9.3.3 requires management review results to include decisions on improvement opportunities, needed changes to the QMS and resource needs, which is exactly what a transition needs.

The quickest start is an End in Mind management review. Build your next review on the 2026 input list. Put every piece of data you already have on the review slides, and mark anything missing as TBD with a date beside it. Those TBDs are the first draft of your ISO 9001 gap analysis, and leadership sees them in a meeting where they can assign owners and resources on the spot.

This approach produces two outputs at once. It surfaces gaps in the inputs required by Clause 9.3.2, including the new interested-party input at c) and the split risk and opportunity inputs at g) and h). It also creates a dated record of top management directing the transition, which is the kind of artifact that supports Clause 5.1.1. MSI’s ISO 9001:2026 executive briefing shows how to frame that first meeting for leaders who have not opened the standard.

Where Findings Concentrate

Which Clauses Produce the Most ISO 9001 Gap Analysis Findings?

Predictable. Repeated. Avoidable.

Across 200+ audits attended, MSI client experience suggests findings cluster in a small number of places. Nobody struggles with document control anymore. The work piles up in objectives nobody measures, corrective actions that never reached a cause, and management reviews that reported numbers without deciding anything. Weight your ISO 9001 gap analysis toward these clauses first.

Quality objectives at Clause 6.2

Clause 6.2.1 asks for objectives that are measurable, monitored, communicated, updated and available as documented information, and 6.2.2 requires what, resources, who, when and how results will be evaluated. “Improve customer satisfaction” is an aspiration, not an objective. Score each objective against all five planning elements.

Internal audit at Clause 9.2

Clause 9.2.1 requires internal audits at planned intervals, and registrars across the industry expect every requirement to be internally audited each year. Organizations that follow their procedures often believe they are compliant while skipping audits of whole clauses. Under 2026, each audit also needs defined objectives, criteria and scope at Clause 9.2.2 a).

ISO 19011:2026 was published in May 2026 and withdrew the 2018 edition with no transition period, so any audit procedure still citing ISO 19011:2018 cites a withdrawn document. MSI covers the fixes in the six edits ISO 19011:2026 requires, internal audit planning, the internal audit risk matrix and common internal audit mistakes. If your team is stretched, MSI’s internal audit services can carry the cycle, and MSI’s ISO Internal Auditor Workshop has been updated to 2026 content and is coming soon.

Corrective action at Clause 10.2

Clause 10.2.1 b) 3) requires determining whether similar nonconformities exist or could occur, and 10.2.1 e) requires updating risks and opportunities when necessary. Both steps are skipped constantly. A corrective action that repairs one instance and never asks where else the cause is live is incomplete on the face of the clause. MSI’s Catch. Correct. Continually Improve. corrective action course builds that discipline into the procedure.

External providers at Clause 8.4

Selection and evaluation criteria often exist on paper but were never applied to the suppliers actually in use. Score whether criteria, monitoring and re-evaluation are real for your top suppliers by spend and risk. MSI’s guides to the purchasing and supplier control procedure and the risk management procedure template show how supplier risk feeds the wider register.

Awareness and culture at Clause 7.3

Competence at 7.2 is usually documented; awareness usually is not, because it can only be demonstrated by asking people. Clause 7.3 e) reaches every person doing work under the organization’s control, not only leadership. Quality culture and ethical behaviour are every department’s issue, from receiving to the lab, and your ISO 9001 gap analysis should sample awareness in each one. MSI’s article on engagement of people shows what that evidence looks like.

Objectivity

How Do You Keep an ISO 9001 Gap Analysis Honest?

Evidence. Not Memory.

The hardest problem in any internal ISO 9001 gap analysis is not technical. The person scoring the system usually built it, and nobody grades their own work harshly. An inflated score does not remove work; it moves the work to a later date, when it costs more.

Name the evidence. Every score above zero cites a document number, a record range or a meeting date. A score with no citation is an opinion. Score implementation on the floor. Documentation is scored from the document; implementation is scored by watching the work and asking the person doing it.

Read it as a registrar would. For each requirement, ask what an experienced auditor would write against it. That reframing catches more than any checklist refinement. Get a second set of eyes on the clean scores. The gaps you found are not the risk; the requirements you scored as fully conforming without much thought are, because nobody looks at them again.

This is where outside calibration earns its fee. Sitting in 200+ audits teaches what registrars actually write findings against, which differs from the plain text in ways no checklist captures. MSI’s piece on QMS compliance versus certification explains why a certificate and a working system are not the same thing, and the American Society for Quality’s ISO 9001 resources offer a useful neutral reference for internal teams.

From Findings to Work

How Do You Turn an ISO 9001 Gap Analysis Into a Transition Plan?

Sort. Sequence. Ship.

A finished ISO 9001 gap analysis that lands as a forty-page list will be read once and shelved. The version that gets acted on sorts findings into three tiers and gives each tier a sequence and an owner.

Tier one: housekeeping. Outdated references, procedures naming roles that no longer exist, superseded forms, a withdrawn standard in a reference list. Real findings, cheap fixes, and the fastest visible progress an ISO 9001 gap analysis produces. Clear them in the first month.

Tier two: structural. A requirement with no arrangement behind it, or one that does not function, such as separate opportunity actions under Clause 6.1.3 or audit objectives under 9.2.2 a). These need scoping, ownership and a date, and they are the substance of the transition project. Manage the project itself under Clause 6.3, which now asks you to consider communication, effectiveness monitoring and review of results.

Tier three: evidence over time. Where the gap is that a process has not yet run under revised arrangements, no budget accelerates it. Culture evidence is the clearest example; you cannot produce a trend line retroactively. Every tier-three item must start early enough that records exist before the transition audit.

Certified to ISO 14001 too? Run one transition, not two

If you hold ISO 9001 and ISO 14001, the shared Harmonized Structure lets one scoring pass carry both standards. ISO 14001:2026 was published on April 15, 2026, and its transition closes on April 30, 2029, five months before ISO 9001’s. Plan the combined project against the earlier date. MSI’s guide to running the ISO 9001 and 14001 transition as one plan sequences the work.

Internal or External

Who Should Run Your ISO 9001 Gap Analysis?

Capability. Calibration. Candor.

Most organizations can run their own ISO 9001 gap analysis. Quality managers know their standard. The question is calibration and candor, not capability.

Run it internally when someone who did not build the system can score it, when you have recent certification audit experience to calibrate against, and when leadership has said unwelcome findings are wanted. Bring in ISO consulting support when the system’s owner would also be its scorer, when your last transition produced surprises, when the culture requirement leaves you unsure what evidence would satisfy it, or when the schedule is tight enough that one wrong priority costs a cycle.

MSI has 28 years of ISO consulting experience, with 80+ certifications supported, 200+ audits attended and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare and other regulated industries. That history is why MSI can tell you which findings registrars actually write. Organizations working toward first certification typically use SurePath; those maintaining an established system year-round use SureResults or SureResults Online for remote internal audits.

Not sure whether to bring in help yet? MSI’s timing test for an ISO 9001:2026 consultant walks through the decision, and MSI’s ISO consulting services page explains how engagements work. Leadership teams weighing how much to resource can watch MSI’s ISO Executive Decision Briefs for the concepts behind the decision, and the ISO 9001:2026 Leadership Commitment Workshop launches October 21, 2026, with a QuickStart ($49 value) for anyone who registers before release.

Proof of Progress

How Do You Measure Whether Your ISO 9001 Gap Analysis Worked?

Track. Trend. Prove.

An ISO 9001 gap analysis is only as good as the change it produces. Track four measures at every management review until your transition audit closes. The trend line becomes your evidence that the transition was managed as a planned change under Clause 6.3 rather than a last-minute edit.

Re-score once roughly six months before your transition audit to confirm the work landed. MSI also recommends adding the ISO 9001 gap analysis results as a standing management review item; the guidance in the NIST Baldrige Performance Excellence Program on measuring organizational performance is a useful companion for leaders building those trends. For governance context, see MSI’s article on ISO 9001:2026 for boardrooms.

Common Questions

ISO 9001 Gap Analysis: Frequently Asked Questions

Asked. Answered. Sourced.

How long does an ISO 9001 gap analysis take?

Is ISO 9001:2026 published, and what is the transition deadline?

Is an ISO 9001 gap analysis the same as an internal audit?

Does ISO 9001:2026 change the ten-clause structure?

Can one gap analysis cover ISO 9001 and ISO 14001 together?

What evidence satisfies the quality culture requirement?

Where should we start if we have only a few weeks?

Your Next Step

Which ISO 9001 Gap Analysis Resource Fits Where You Are?

Score. Write. Review.

Related Reading From MSI