A gap analysis is mainly a determination of the degree of conformance of your organization to the requirements of a specification or standard. A gap analysis is mainly a document review or a “show me the evidence” activity, evidence which usually will come in the form of a record or document. During a gap analysis, only very minor auditing is done; rather, key process owner or project stakeholders provide evidence that they have met the requirements set forth in the specification or standard.
Gap analysis is often conducted at the beginning of an organization’s journey seeking compliance to a chosen specification or standard. However, it may also be conducted after some development of processes for achieving compliance has taken place. The main reason why gap analysis is conducted at the beginning of the development phase or after some development has occurred is because the organization wants to know where it stands in regard to meeting the standard, and it wants to know specifically what it must do to close the gaps. Basically the organization wants to know where the holes are—whether few or many—and what it needs to do to close those holes and get closer to fully meeting the requirements.
This leads us into the reporting aspect of gap analysis. A good gap analysis report usually presents a clear summary of where the major gaps exist between the company’s documentation and the chosen requirements. It should also show a detailed account of each requirement and the degree of compliance, with corresponding actions that should be taken to close these gaps. Here lies a major difference between an audit report, for example, and a gap analysis report: The gap analysis report has some inherent advice to it, which makes it suitable to be accomplished by consultants or experts in the chosen specification or standards. A gap analysis will seldom be performed by a registrar or company providing certification because they are not allowed to provide the advice, due to an inherent conflict of interest.
An internal audit is an activity that also seeks to determine the degree to which your organization conforms to the requirements of a specification or standard or to your own organizational requirements. This audit is performed in more than one dimension, through review of documentation evidence and also by questioning employees.
An internal audit is usually conducted after development of processes (e.g., a quality management system) has been completed and some implementation has occurred. The reason is that internal auditors will be questioning individuals to assess their knowledge of the system. If implementation is not underway, it may be hard to prove that employees are actually using the system and are knowledgeable of their roles in meeting the specification or standard or of the organization’s own requirements.
Internal audit reports usually present the lead internal auditor’s summary on the overall impression of the organization’s degree of conformance and a list of findings. Good reports include not just nonconformities, but also observations, noteworthy efforts, and even opportunities for improvement. I always like to point out at least one noteworthy effort to my clients because it gives the report a positive note. I also believe that if there are no specific efforts to praise, the organization should at least be lauded for committing the resources and time to meet the requirements of the specification or standard. There is not much advice in an internal audit report; however, “opportunities for improvement” and observations, when presented correctly, should give the organization enough fuel for action and follow up.
The last issue about internal audits is who conducts them. As the word “internal” says, internal audits should be conducted by internal employees, although this is easier said than done. In large organizations the task is easier because there are departments whose sole function is to perform audits throughout the business units and locations. However, in small organizations, this is a real problem. First, we are dealing with the issue of independence. If you have one auditor who audits the whole facility, who audits his area? If the same auditor also audits his area, then you will not be able to prove that the audit is unbiased.
The other big question is how effective are your audits? Internal auditors who only perform audits once or twice a year do not truly have a chance to polish their auditing skills, and therefore you may not be getting good value from your audits. That’s when hiring an independent consultant sometimes works in your favor: They are independent, bring a lot of expertise from other organizations, and have excellent up-to-date auditing skills. However, if you decide to have your employees perform your audits, make sure you keep them current in auditing techniques by providing continuing education on auditing at least once a year.
A pre-assessment is usually the ante to an external, registrar, or certification audit. If you want a pre-assessment of your organization, chances are your system has been conforming to the chosen specification or standard for at least three months, you have conducted a full internal audit of your organization, and all the findings reported in the internal audit report have been remedied and are closed. You are basically ready but want to have a last look before you bring the big boys in.
A pre-assessment is therefore a rehearsal of an external audit, and consequently there is plenty of document review as well as actual questioning of employees. As with the internal audit, the pre-assessment’s objective is to seek the degree of conformance of your system to the chosen specification or standard. It can also be your green light to go for the certification audit, or maybe a yellow light if some fine tuning is necessary. The pre-assessment report will not give advice but should show if there are any nonconformities and allow the organization to close those out prior to the certification audit. The better you are prepared for a certification audit, the more you increase your chances of obtaining certification or being recommended for certification on the day of your external audit.
Pre-assessments can be conducted by consultants, registrars, or competent individuals who are experts in the certifications or standards chosen by your organization.