Free ISO & GRC Gap Assessment Tools
Find out how ready you are for certification — in five minutes, with a scored report you can act on. Each tool below covers the mandatory and critical requirements of its standard, asks the questions an auditor would, and gives you an instant readiness score, area-by-area analysis and prioritised actions.
Built by the consulting team behind 8,100+ client engagements in 60+ countries — lead auditor–qualified (BSI, TÜV SÜD). High-level screening, not an audit; your report appears instantly on screen and downloads as a PDF.
Choose your standard — 22 free tools
ISO 9001:2026 transition check
Scores your ISO 9001:2015 system against the new and changed requirements of ISO 9001:2026, with the clause reference for each and the items certification bodies test first weighted double. Instant readiness report and priority actions.
Start the ISO 9001:2026 gap check →ISO 9001 core requirements (2015 baseline)
Documented information, operations, suppliers, audits and improvement — the core requirements retained in ISO 9001:2026 that every certification audit tests. Certified to 2015? Run the ISO 9001:2026 transition check as well.
Start the ISO 9001 gap check →ISO/IEC 27001:2022
Risk assessment, the Statement of Applicability and the Annex A controls auditors sample first — access, incidents, backups, suppliers.
Start the ISO 27001 gap check →ISO 27001 Annex A — all 93 controls
The full control estate, theme by theme — A.5 to A.8 — with N/A justifications captured the way a real SoA requires, a priority gap register and a draft Statement of Applicability you can download.
Start the Annex A gap analysis →ISO 14001:2026 transition check
Scores your ISO 14001:2015 system against the new and changed requirements of ISO 14001:2026, with the clause reference for each and the items certification bodies test first weighted double. Instant readiness report and priority actions.
Start the ISO 14001:2026 gap check →ISO 14001 core requirements (2015 baseline)
The aspects register, compliance obligations, operational controls and monitoring evidence that carry an EMS through audit; all retained in ISO 14001:2026. Certified to 2015? Run the ISO 14001:2026 transition check as well.
Start the ISO 14001 gap check →ISO 45001:2018
Hazard identification with workers, legal compliance, contractors, emergencies and incident learning — where OH&S audits are decided.
Start the ISO 45001 gap check →ISO 22301:2019
The BIA, resourced strategies, usable plans and a real exercise programme — would your continuity arrangements survive a real disruption?
Start the ISO 22301 gap check →ISO 13485:2016
Device files, design controls, process validation, traceability and vigilance — the requirements notified bodies test on every visit.
Start the ISO 13485 gap check →ISO 22000:2018
PRPs, the hazard study chain, CCP/OPRP control, traceability and recall — where FSMS certification is won or lost.
Start the ISO 22000 gap check →HACCP (Codex, Rev. 2020)
The 12 steps and 7 principles — hazard analysis, CCP determination, validated limits, monitoring discipline and verification.
Start the HACCP gap check →ISO/IEC 17025:2017
Impartiality, competence records, metrological traceability, method validation, QC and the decision rule assessors now test on every visit.
Start the ISO 17025 gap check →ISO/IEC 42001:2023
The AI risk process, system impact assessments, the Statement of Applicability and per-system lifecycle documentation.
Start the ISO 42001 gap check →ISO/IEC 17020:2012
Independence for your body type, the inspector competence spine, documented methods and report traceability.
Start the ISO 17020 gap check →ISO 15189:2022
The sample path assessors walk — collection, receipt, verification, IQC and EQA, critical results and the LIS.
Start the ISO 15189 gap check →ISO 50001:2018
The energy planning chain — energy review, SEUs, EnPIs, baselines, data collection and demonstrable performance improvement.
Start the ISO 50001 gap check →IATF 16949:2016
Product safety, special characteristics, PFMEA-to-control-plan linkage, supplier development and the three-layer audit programme.
Start the IATF 16949 gap check →API Spec Q1 (10th Edition)
The Q1 triad — risk, MOC and contingency planning — plus design records, validated processes and the ten-year records regime.
Start the API Q1 gap check →BRCGS Packaging Materials (Issue 7)
Weighted to the fundamental clauses — the HARA chain, culture plan, internal audits, traceability testing and process control.
Start the BRCGS gap check →SOC 2 (AICPA TSC)
The system description, controls matrix, CC-series controls and the month-by-month period evidence a Type II lives or dies on.
Start the SOC 2 gap check →PCI DSS v4.0.1
Scope confirmation, data-flow diagrams, targeted risk analyses, MFA, the quarterly scan regime and daily log review.
Start the PCI DSS gap check →HIPAA (Security & Privacy)
Built from OCR's first-request list — the risk analysis, remediation evidence, BAAs, addressable decisions and breach documentation.
Start the HIPAA gap check →GDPR · ESG · ISO 20000 · 27701 & more
We implement and audit across 20+ standards and frameworks — data privacy, sustainability and ESG, IT service management, integrated systems and sector schemes among them. Tell us what you need and we'll assess it with you.
Talk to a consultant →What a gap assessment tells you
Every ISO standard contains a set of explicitly mandatory requirements — documents that must exist, records that must be retained, processes that must demonstrably run. Certification audits are decided against those requirements, clause by clause. A gap assessment compares your current system against that list and answers three questions with evidence rather than opinion: where do you already conform, which gaps would become audit nonconformities, and what should you fix first.
Organizations that skip this step usually discover their gaps during the certification audit itself — the most expensive possible moment. Organizations that start with a gap assessment walk into Stage 1 knowing what the auditor will find, because they found it first.
How it works
Answer the questions
15–20 plain-language questions on the mandatory and critical requirements of your standard. Critical items are flagged. About five minutes.
Get your instant report
Overall readiness score, area-by-area breakdown, analyst-style interpretation and a prioritised action list mapped to clauses — on screen immediately, downloadable as PDF.
Close the gaps
Book a complimentary consultation. A lead auditor–qualified consultant walks through your results and recommends the fastest defensible route to certification.
Need more than a self-assessment?
Our consultants run comprehensive, clause-by-clause gap analyses on site or remotely — every mandatory document and record assessed against the standard, with a branded findings report and a sequenced action plan. Then we close the gaps with you: Design™ — we develop the system, your team implements under our coaching — or Drive™ — fully managed implementation, end to end.
Book a complimentary consultation →Prefer to talk? info@iso-certification.ph · +63 977 815 1204
Frequently asked questions
What is an ISO gap assessment?
An ISO gap assessment compares your current management system against the mandatory requirements of an ISO standard and shows where you conform and where gaps remain. It is the standard first step before an implementation project or a certification audit, because it turns "are we ready?" into a scored, prioritised answer.
How long does the self-assessment take?
About 5 minutes (about 10 for the ISO 9001:2026 and ISO 14001:2026 transition checks). Each tool asks 15–20 expert-built questions covering the mandatory and critical requirements of the standard, and your scored report appears instantly on screen — no waiting for an email.
Is it really free, and is it an audit?
It is completely free and there is no obligation. It is a high-level screening, not an audit or a certification decision: it tells you where you stand and what to fix first. A certification decision can only come from an accredited certification body after a formal audit.
What do I get in the report?
An overall readiness score, a breakdown by area, an analyst-style interpretation of what your specific answers mean, and a prioritised action list mapped to the standard's clauses. You can download the report as a PDF.
What happens after the gap check?
If you want to close the gaps, book a complimentary consultation. Our lead auditor–qualified consultants walk through your results and recommend the right route: Design™, where we develop the system and your team implements under our coaching, or Drive™, a fully managed implementation end to end.