Glossary
Gap analysis
A structured comparison between what a standard requires and what the organisation actually has in place, requirement by requirement.
- Gap assessment
It is the first task in any compliance project and the one most degraded by haste. A useful gap analysis does not sort each requirement into “met” or “not met”, but into four states: implemented and evidenced, implemented without evidence, partial, and absent.
The distinction between the first two is what decides the real effort. A control that works but leaves no trace is, to an auditor, exactly the same as a control that does not exist — with the difference that closing it takes weeks rather than months.
It also pays to date each assessment and note the source behind it: which document was read, who was interviewed, which system was queried. Without that, the analysis expires the moment someone asks why a requirement moved from “partial” to “implemented” with no change in between.