What is a gap assessment?

What it is

A gap assessment answers one question: if the registrar arrived tomorrow, what would they write up?

It is conducted like a real audit. Someone independent of your team reads your documented processes, walks the floor, interviews the people who do the work, samples records, and tests whether the system as described matches the system as run. The output is a list of gaps against specific clauses, each with the evidence behind it, ordered by what would sink you first.

It is not a proposal document dressed as an audit. The test of a real one is whether it tells you things you did not want to hear.

For a company that is already certified, the same exercise doubles as an independent internal audit ahead of surveillance, which is why it is often the first engagement in both directions.

When you will hear it

At the beginning of almost every prep project, because nobody can scope the remediation work without it.

In quotes from consultants, where it may also be called a readiness assessment or a pre-assessment. Registrars offer something they call a pre-assessment too, and that is a different thing: it is a limited look by the body that will certify you, and it cannot come with advice on how to fix what it finds.

What the auditor expects to see

For the assessment itself: access. The value is proportional to how much of the real operation the assessor gets to see. Curated document packets and a conference room produce a weak report.

Afterward, the registrar will not ask to see your gap assessment and you are not required to show it. What they see is whether the gaps closed. A company that ran an honest assessment and worked the list arrives at Stage 2 with the common findings already gone.

Common mistakes

Scoping it to documents only. A desk review of your procedures finds document problems. Most real findings live in the difference between the procedure and the floor.

Running it too late. A gap assessment three weeks before Stage 2 tells you what you will be written up for without leaving time to prevent it.

Treating the report as the deliverable. The report is a work list. Companies that file it and move on pay for the assessment twice.

Having it done by whoever will certify you. Not allowed, for good reason. Certification bodies cannot consult on the systems they certify.

FAQ

How long does a gap assessment take?

For a single site of 50 to 150 people, one to two days on site is typical, plus preparation and a written report. Larger or multi-process sites take longer.

What does it cost?

Published market figures cluster at roughly $2,500 to $5,000 for mid-market manufacturers, with a wider range at the extremes. Very few firms publish a fixed price, which makes comparing quotes harder than it should be.

Is it the same as an internal audit?

The activity is similar and one exercise can serve both purposes. The difference is intent: an internal audit is a clause 9.2 requirement you owe the standard every year, and a gap assessment is a one-time baseline before certification.

Can our own quality manager do it?

They can, and should be doing internal audits regardless. The limit is independence: it is hard to audit a process you designed, and an auditor from outside will ask the questions your team has stopped noticing.