ISO 9001:2026 · METHOD
How to do an ISO 9001:2026 gap analysis
Written from the auditor's side of the table. Clause numbers are pointers; the wording is ours, not the standard's. Last checked against the published ISO 9001:2026 text: October 12, 2026.
Every certification body publishes a free ISO 9001 gap analysis checklist, and they are all the same document: a question per clause and a comments column. They find gaps and stop at exactly the point the work begins, because the work is deciding which gaps matter. In a transition year that decision has a rule: a modest gap on a requirement that changed outranks a large gap on one that did not. Here is the scoring that applies it.
The 0 to 3 scale
Score every sub-clause, 4.1 through 10.2, against the 2026 requirement as it reads in your licensed copy. Four scores, and the words matter more than the numbers:
| Score | Meaning | The test |
|---|---|---|
| 0 | Not addressed | The requirement is not met and no credible plan exists. |
| 1 | Partially addressed | Some elements exist; significant gaps remain. |
| 2 | Addressed, not evidenced | The practice exists, but the records would not survive an audit. |
| 3 | Conforming | Implemented and evidenced. An auditor could verify it today. |
Score 2 is the one that keeps a gap analysis honest. Most systems do most things; what they lack is the record that shows it. Scoring "we do that" as a 3 is how organizations arrive at the transition audit 90% ready on paper and exposed on the floor.
Weighting by what changed
A flat score treats every sub-clause the same. The auditor will not. The transition audit spends its time on the changes, so each row carries a weight set by how the 2026 edition changed it:
| 2026 change | Weight | Why |
|---|---|---|
| New | 3 | A requirement that did not exist in 2015. Nothing in your system was built for it. |
| Expanded | 2.5 | The requirement grew. The 2015 answer is now short by one or more items. |
| Reworded | 1.5 | Same intent, new words. Findings come from documents that still use the old ones. |
| Unchanged | 1 | The baseline. Still audited, but not where the audit day goes. |
| Removed | 0 | Out of scope. The finding, if any, is a document that still cites it. |
Readiness is the weighted score divided by the weighted maximum: every scored row's score times its weight, over three times the sum of the weights. A system that is perfect on the unchanged rows and scores 1 on the new ones reads much lower than a flat average would say, which is the point.
Severity and priority gaps
Severity is the distance from conforming, times the weight: (3 minus the score) times the weight. A new requirement scored 1 has severity 6. An unchanged requirement scored 1 has severity 2. The first is a priority gap; the second is a gap. Rank the action plan by severity and the first page of it is the transition audit's first day.
The rule of thumb that falls out of the arithmetic: any changed requirement scored 0 or 1 is a priority gap, and no unchanged requirement is, whatever its score. Severity 4 and above is the line.
Doing it in an afternoon
- Read the change list first. Every confirmed 2015 to 2026 change in plain words, with what to check in your own system. Scoring before reading it means scoring against the 2015 edition from memory.
- Score the changed rows first, New and Expanded, then Reworded. They carry the weight, and they are where the evidence is thinnest. Unchanged rows last, quickly.
- Write the evidence, not the opinion. Beside every score of 2 or 3, the record that proves it: the register name, the procedure number, the date of the last review. A score with no evidence beside it is a 1.
- Describe each gap in one line, as the auditor would write it: what the requirement asks for, what the evidence shows, the difference.
- Assign an action, an owner and a date to every gap, and a control level to every action: eliminate, substitute, engineer, separate, procedure, train. If the average lands on procedure and train, the transition is being documented, not implemented.
- Have the process owners check their rows. A gap analysis scored alone is scored against the manual. The auditor audits the floor.
Two worked rows
| Sub-clause | 2026 change | Weight | Score | Severity | Status |
|---|---|---|---|---|---|
| 4.1 context of the organization | Unchanged (the climate-change consideration from the 2024 amendment is now in the base text) | 1 | 2 | 1 | Gap |
| 6.1.3 opportunities | New (opportunities now determined, evaluated, acted on and reviewed separately from risks) | 3 | 1 | 6 | Priority gap |
The first row is a register that never recorded the climate-change determination as an explicit decision: one line to add. The second is a risk register with forty risks and no opportunities, which is the finding most organizations receive first in 2026 and which lands on leadership, since the leadership clause now asks top management to promote opportunity-based thinking. Same system, two gaps, one afternoon, and the ranking says which one to open on Monday.
What to do with the result
- The action plan, ranked by severity, with control levels. The first ten rows are the transition project.
- The management review input. Readiness overall and by clause, the gap counts and the open actions are a clause 9.3 input in their own right; paste them into the review pack, dated.
- The transition plan, working back from your recertification date rather than from the end of the window. Most deadlines are earlier than 2029.
- The document sweep, in parallel: the search strings that find every procedure still pointing at a clause number that moved.
The kit does the arithmetic
Fifty-seven sub-clauses with the 2015 requirement in plain words beside the 2026 change, the weights and severity computed, status and days-to-due flags, the change log with a what-to-check column, the gap map, the ranked action plan with control levels, the transition plan and a dashboard that reads the numbers back to you. Verified against the published text. $57, Excel, no macros.
See the Transition KitRead the change list firstQuestions
Is a certification body's free gap analysis checklist enough?
It finds gaps and stops there. A checklist cannot tell you that a modest gap on a requirement that changed in 2026 outranks a large gap on one that did not, and that is the judgment a transition audit tests. Score and weight, then rank.
How long does an ISO 9001:2026 gap analysis take?
An afternoon for a mature single-site system if the change log has been read first: fifty-seven sub-clauses at three to five minutes each. Multi-site systems and systems that have drifted from the manual take longer, mostly in finding the evidence.
Who should do it?
The quality manager scores; the process owners supply the evidence for their rows. A gap analysis scored alone in an office is scored against the manual, not against the floor, and the auditor audits the floor.
Do I need the standard to do a gap analysis?
Yes. The requirements are in your organization's licensed copy of ISO 9001:2026. A gap analysis tool describes each requirement in its own words as a pointer; the scoring is done against the text, and the auditor will expect you to have it.