A gap analysis is a comparison of a company's current state against the requirements of a standard, showing what you already have and what is missing. It is done at the start, before the certification date is even decided, and its output is a list of nonconformities with an estimate of the effort required and a proposed course of action. This is precisely why it tends to be the best-spent money in the whole project – companies often find they already meet half the requirements through existing processes and are only missing records, or, conversely, that they lack the basics and certification needs to be postponed by six months. The analysis is carried out by going through the individual requirements with the people who actually perform the activity in question, not by reading policies. It should not be carried out by the same body that will later perform the certification, to avoid a conflict of interest.
Source: iso.org
See also: AI management system, Certification audit, Statement of Applicability.
