ISO 9001:2026 Gap Assessment Checklist: Moving From the 2015 Edition
A transition to ISO 9001:2026 starts with a gap assessment: a structured comparison of the quality system you run today against the requirements of the new edition. Done well, it tells you which procedures and forms need to change, which arrangements already work, and how much effort the transition will take before your certification body arrives.
Done badly, it turns into a rewrite of documents that were never the problem. Most organizations with a working ISO 9001:2015 system need targeted changes, not a new QMS.
This checklist walks through the assessment clause by clause. For each area it lists the questions to ask, the evidence an auditor is likely to look for, and the documents most often affected. For a summary of what changed in the 2026 edition and the transition dates, read our ISO 9001:2026 Guide first.
Before you start: set up the assessment
A gap assessment is only as good as its inputs. Before you open the standard, gather:
Your licensed copy of ISO 9001:2026. Summaries, including this one, paraphrase the requirements. The gap assessment must be made against the actual text.
Your current quality manual or system description, procedure list and form list, ideally a master list with clause references.
The last full cycle of records: one management review, the internal audit program and recent audit reports, the corrective action log, supplier evaluations and quality objective results.
Your certification body's transition arrangements, in writing: when they can audit to the 2026 edition and how the transition audit will be combined with surveillance or recertification.
Decide who will do the assessment. A quality manager can run it alone in a small company, but the findings are better when the process owners for purchasing, production, design and sales answer the questions about their own areas.
Use a simple worksheet with five columns: requirement, current arrangement, evidence seen, gap (yes, partial or no), and action. Rate each gap by effort, so that a one-line change to a form is not planned the same way as a new process.
Clause 4: Context of the organization
What to check. The 2026 edition keeps the requirement to determine external and internal issues and the needs and expectations of interested parties. It also carries forward the 2024 climate change amendment: you must determine whether climate change is a relevant issue, and recognize that interested parties can have climate-related requirements. The new edition also makes clear that you decide which relevant requirements of interested parties will be addressed through the QMS.
Questions to ask:
Is there a current record of the climate change decision, and does it say why climate change is or is not relevant?
Does the interested parties analysis show which requirements the QMS will address, not just a list of who the parties are?
Has context been reviewed since the last management review, and is there evidence it feeds planning?
Evidence an auditor will look for: a dated context and interested parties analysis, the scope statement (clause 4.3) with any justified exclusions, and a link between identified issues and the risks and objectives that follow from them.
Documents most often affected: the context and planning procedure, the quality manual scope section and the interested parties register.
Clause 5: Leadership
What to check. This is the change most auditors will ask about. Under clause 5.1.1, top management is expected to promote a culture of quality and ethical behavior. A sentence in the quality policy is not enough. The auditor will want to see how leadership actually does this.
Questions to ask:
What does top management do that shows it promotes quality culture and ethical behavior? Examples include quality topics in leadership meetings, decisions where quality outweighed schedule or cost, an ethics or speak-up mechanism, and recognition of quality behavior.
Does the quality policy still fit the organization's purpose and context, and does it support the strategic direction?
Are responsibilities and authorities for the QMS assigned, communicated and understood, including who reports on QMS performance to top management?
Evidence an auditor will look for: interviews with top management, management review minutes that show leadership decisions, the quality policy, and an organization chart with QMS roles.
Documents most often affected: the quality policy, the organization and responsibilities procedure, and the management review agenda.
Clause 6: Planning
Clause 6 has three changes worth separate lines on your worksheet.
Risks and opportunities (6.1)
The 2026 edition separates actions to address risks (6.1.2) from actions to address opportunities (6.1.3). Risks and opportunities need to be determined, analyzed and evaluated, and actions on risks should be proportionate to their potential impact.
Questions to ask:
Does your method analyze and evaluate risks against stated criteria, or does it only list them?
Are opportunities treated as their own topic, with decisions on which ones to pursue?
Are actions proportionate, and is their effectiveness evaluated later?
If you use a single register that lists a few opportunities alongside risks, plan to split the treatment and add evaluation criteria. Our guide to risks and opportunities in ISO 9001:2026 covers this in detail.
Quality objectives (6.2)
Objectives must be consistent with the quality policy, measurable, monitored, communicated and updated, with a plan for what will be done, by whom, with what resources, by when and how results will be evaluated.
Questions to ask: Does each objective have an owner, a target, a deadline and a measurement method? Are the results reviewed at management review? Do any objectives address the risks identified in 6.1?
Planning of changes (6.3)
When you plan changes to the QMS, you now need to consider how the change will be communicated, how its effectiveness will be monitored and evaluated, and how the results will be reviewed.
Questions to ask: Does your change control form or QMS change plan ask about communication, effectiveness monitoring and review of results? Can you show one recent change where this was done?
Documents most often affected: the context and planning procedure, the risk register or risk procedure, the objectives register and the change control form.
Clause 7: Support
Awareness (7.3). People working under the organization's control must be aware of the quality culture and the expected ethical behavior, in addition to the quality policy, relevant objectives, their contribution and the implications of not conforming. Check your induction and awareness training content and how you record it.
Organizational knowledge (7.1.6). Knowledge must be retained, applied and shared as needed, not only made available. Check how lessons learned, key-person knowledge and tacit process knowledge are captured. A knowledge matrix, work instructions, lessons-learned records and cross-training plans are common evidence.
Competence (7.2). No major change is expected, but use the assessment to confirm that competence requirements exist for each role that affects quality, and that records show how competence was established.
Documented information (7.5). Some published summaries report that the "maintain" and "retain" wording has been simplified to follow the Harmonized Structure. The practical split between controlled documents and records still applies, so check that your document control procedure covers both.
Documents most often affected: the training and job description procedure, induction materials, the document control procedure and any knowledge management records.
Clause 8: Operation
Most of clause 8 is unchanged in substance, but check two areas:
Customer communication (8.2.1): the new edition adds contingency information for customers. Ask what you would tell customers if a disruption affected supply, and whether the process for that communication is defined.
Control of external providers (8.4): where relevant, you may need to tell suppliers about requirements for their interactions with your customers. This matters most when suppliers ship direct, provide field service or contact your customers.
While you are in clause 8, confirm that records still exist for the requirements that generate evidence: review of customer requirements, design and development where it applies, supplier evaluation and re-evaluation, traceability where required, customer property, review of production changes, release of products and services, and nonconforming outputs. Our post on ISO 9001:2026 required documents lists them.
Documents most often affected: contract review, supplier management and purchasing procedures.
Clause 9: Performance evaluation
Internal audit (9.2). Each audit now needs defined objectives, as well as scope and criteria. Many audit plans list scope and criteria but not objectives. Check your audit plan form and the last few audit reports.
Management review (9.3). Inputs now explicitly include changes in the needs and expectations of interested parties. Check your agenda form and the most recent minutes. Our guide to management review inputs and outputs shows a full agenda.
Monitoring and customer satisfaction (9.1). Confirm that you have decided what to monitor and measure, by which methods and when results are analyzed, and that customer perception is monitored.
Documents most often affected: the internal audit procedure and audit plan form, and the management review procedure and agenda.
Clause 10: Improvement
The former clauses 10.1 and 10.3 are combined into a single continual improvement requirement. Renumbering alone does not need a document change, but check any cross-references in your manual and master list.
Nonconformity and corrective action requirements are substantially unchanged. Use the assessment to sample a few corrective actions and confirm that root cause, action and effectiveness review are recorded. Our post on nonconformity vs corrective action explains where clauses 8.7 and 10.2 differ.
Turning findings into a transition plan
When the worksheet is complete, sort the gaps into three groups:
Document changes only. The process already works, but the procedure or form does not say so. Example: adding audit objectives to the audit plan form.
Process changes. Something new has to happen. Example: separating opportunity evaluation from risk treatment, or adding climate change to context review.
Evidence gaps. The process exists on paper but there are no records. Example: no record of how leadership promotes quality culture.
Then build the plan:
Confirm the audit window with your certification body.
Assign each action an owner and a due date, working back from the audit date.
Revise procedures and forms through your normal document control process, with a revision history entry that cites ISO 9001:2026.
Train the people affected, including the awareness topics in clause 7.3.
Run at least one internal audit and one management review under the revised process, so the auditor sees records, not just procedures.
Update the master list and clause cross-reference.
For a small manufacturer with a working 2015 system, this is typically a few weeks of part-time work spread over a few months, mostly to generate the records. Leave margin: audit slots fill up near transition deadlines.
Common mistakes
Rewriting everything. A full rewrite creates training load and new nonconformities. Change what the gap assessment shows.
Assessing against a summary. Summaries, including ours, paraphrase. Check every finding against the licensed standard.
Treating culture as a document. Clause 5.1.1 is about what leadership does. Plan evidence, not just policy wording.
Forgetting records. A revised procedure with no records under it will not satisfy the transition audit.
Leaving it late. Certification bodies need accredited auditors for the new edition, and availability can be tight in the first months and the last year.
Documents that help
If your system needs new or revised documents, A.P. Lyon's ISO 9001:2026 documents are editable Word and Excel files written for manufacturers. The QMS Context and Planning Procedure covers context, interested parties, risks, opportunities, objectives and planning of changes. The Management Review Procedure and Internal Audit Procedure are written to the 2026 inputs and audit objective requirements.
For a full system, the ISO 9001 QMS Base ($595), Standard ($995) and Complete ($1,295) packages include a quality manual structured on clauses 4 to 10 and a master list with a 2026 clause cross-reference, which makes the gap assessment itself faster.
The documents need to be adapted to how your organization works. They are a starting point, not certification.
Next steps
Read the ISO 9001:2026 Guide for transition dates, choose individual procedures in Build Your QMS, or contact A.P. Lyon about consulting if you would like an independent gap assessment against the 2026 edition.
Comments