ISO 9001 and ISO 14001 gap analysis and mock audits, without the mystery

Gap analysis or mock audit: which one do you need?

They answer different questions. A gap analysis compares what you currently do against every requirement of ISO 9001 and tells you what is missing: it assumes you are building or rebuilding. A mock audit (or pre-assessment) rehearses the certification audit itself: same sampling approach, same interview style, same finding classifications, but it assumes your system exists and tests whether it stands up. If you have never been certified, start with the gap analysis. If certification is booked and you want to find the nonconformities before the certification body does, book the mock audit.

What the day actually looks like

• Before the visit: we ask for your scope, your documented information (quality manual if you keep one, process maps, procedures), your last internal audit programme and your last management review minutes. Reading these first means the day on site is spent looking at reality, not paperwork.
• Opening conversation: half an hour with whoever owns the system, on what the business actually does and where it hurts.
• The floor, not the filing cabinet: we follow real orders through the process (enquiry, review, purchasing, production, inspection, release, complaint). ISO 9001 auditing is sampling; we sample the way a certification auditor samples.
• Records where they live: training matrices, calibration, supplier evaluations, nonconformity logs, in whatever system you keep them. Clean binders assembled for audit day impress nobody.
• Closing summary: you hear every finding before we leave. Nothing in the report is a surprise.

What the findings report looks like

Within five working days you get a written report, clause by clause, with each finding graded the way a certification body grades them: major nonconformity, minor nonconformity, or opportunity for improvement. Each finding states the requirement, the objective evidence, and a practical route to closure, written by an engineer who has run these processes, not only audited them. The report ends with a prioritised action plan ordered by what is most likely to hold up certification, not by clause number.

What the certification body asks for first

Whichever body you choose, the sequence is predictable. Before quoting they ask for your scope, headcount and number of sites. At Stage 1 they look for the skeleton: the scope statement, your process map, evidence that internal audits and a management review have actually happened, and your objectives. Stage 2 is the full audit against everything else. The most common reason for a difficult Stage 1 is simple: the internal audit programme and management review either have not happened yet or happened the week before, visibly for the auditor's benefit. Build the evidence trail months out, not days.

The gaps we find most often

• Internal audits that audit documents, not processes: a tick-sheet against procedures instead of following real work, so the programme finds nothing and proves nothing.
• Management reviews reconstructed from memory: held, perhaps, but with no inputs, no decisions and no actions recorded in the shape clause 9.3 lists.
• Supplier evaluation as certificate collection: every supplier "approved" on the same day, no criteria, no re-evaluation, no connection to the supplier problems the buyer complains about at lunch.
• Objectives that measure nothing: "maintain quality" is not an objective; on-time-in-full, right-first-time and complaint closure time are, and most businesses already track them without telling their QMS.
• The undocumented hero: the process runs on one experienced person's judgement, which works until they are on holiday during the audit, or resign.

None of these needs a consultant on retainer to fix. They need someone to find them honestly, write them down clearly, and leave your team with an ordered list, which is the entire design of our gap analysis.

What differs in an ISO 14001 gap analysis

The day runs the same way, but an environmental system is judged on different evidence. We spend more of it on two registers that ISO 9001 does not have. The aspects and impacts register: whether it covers what the site actually does, including abnormal and emergency conditions, and whether the significance ratings drive the controls and objectives. The compliance obligations register: whether it lists the permits, consents and legislation that genuinely apply, and whether compliance is evaluated rather than assumed.

Against the 2026 edition we also check the new and strengthened requirements: planning of changes, the broader view of environmental conditions, and control of externally provided processes. The dates are on the ISO 14001:2026 transition page, and our ISO 14001:2026 readiness checklist lets you test your own system first.

Costs, plainly

Our fees are fixed and published: a full-day gap analysis is £650, internal audit days are £650 (£375 for a remote half-day). The certification body's own fees are separate and depend on your size and scope. We help you scope and compare those quotes so the first invoice is not a surprise. Full details are on the services page.