ISO 9001 and Gap Analysis and Internal Audit

A) Stage 1 audit is mostly about the design of the management system. Is the system well designed? Does the system considers all the requirements in the management standard? Is the management system ready for a stage 2 audit? Nonconformities may be raised.

Stage 2 audit is mostly about implementation. This stage usually follows a few weeks after the Stage 1 audit. The auditor will check whether your management system has really materialized in your company, or if it is only there on paper. He will check this through observation and interviewing your employees, but mainly by checking your records. So, you need to make sure you are really complying with everything you have written in your policy and procedures. If there are no major nonconformities, the certification body will issue the certificate to your company.

You already know, from stage 1, that the system is designed according to the standard; however, now you want to know if the system is implemented, if documents are followed and mandatory records kept.

Checklist for stage 1 is different from checklist for stage 2 because the audit purpose is different.

B) Gap analysis and internal audit both activities play crucial roles in driving organizational improvement and ensuring the successful implementation of a management system. A gap analysis is primarily concerned with identifying gaps between an organization's current practices and the requirements of a management system, whereas an internal audit evaluates the adequacy and effectiveness of the implemented system (main difference), including compliance with standards and regulations. The checklist used in a gap analysis can be generic and have a column to report what exists already and the gaps. The checklist used with internal audits has a column to report what is actually being found and observed.

C) When you’re planning an audit you should try to minimize the disruption brought by the audit team while carrying out the audit. You don’t want to audit a role in the morning and after lunch of the first day and in the morning of the second day. So, consider this constraint while scheduling your audit plan. I prefer identifying departments in the audit plan because is something that everybody in the organization is aware about. Not everybody knows about processes and even less about the clauses of the standard. Remember, the audit plan is a communication tool. About the matrices, I like to write them while I prepare the checklist to be aware of the kind of questions I should ask.

You can find more information in the following documents:

• Should you use a gap analysis in your ISO 9001 implementation? - https://advisera.com/9001academy/blog/2016/05/17/use-gap-analysis-iso-9001-implementation/
• Checklist of ISO 9001 implementation & certification steps - https://advisera.com/9001academy/knowledgebase/checklist-of-iso-9001-implementation-certification-steps/