ISO 9001:2015 Gap-Assessment Checklist
Use this checklist to assess your quality management system against each clause of ISO 9001:2015, from context (clause 4) to improvement (clause 10). It is a starter template — adapt it to your scope, context, and risk appetite. It does not constitute a formal audit, a certification assessment, or any guarantee of compliance.
Requirements are paraphrased in plain English — refer to your licensed copy of ISO 9001:2015 for the full text.
Context of the organisation
External and internal issues relevant to your purpose and QMS are identified, and you have a way of reviewing them as they change.
The interested parties relevant to the QMS, and their requirements, are identified and kept under review.
The QMS scope is documented, names the products and services covered, and justifies any requirement you treat as not applicable.
Your processes are defined with inputs, outputs, sequence, criteria, resources, owners and the risks they carry.
Leadership
Top management takes accountability for the QMS and visibly supports it — not just the quality manager.
Customer and applicable statutory requirements are understood, and risks to conformity and customer satisfaction are addressed.
A quality policy appropriate to your context is documented, communicated, understood and available to relevant parties.
Responsibilities for the QMS, its processes and reporting on its performance are assigned and communicated.
Planning
Risks and opportunities are identified, actions are planned and integrated into processes, and their effectiveness is evaluated.
Objectives are measurable and consistent with the policy, with what, who, resources, when and how results are evaluated.
Changes to the QMS are carried out in a planned way, considering purpose, consequences, resources and responsibilities.
Support
You have the people, buildings, equipment and working environment needed to run your processes and achieve conformity.
Measuring equipment is suitable, calibrated or verified where traceability matters, identified, and protected from invalidating adjustments.
The knowledge needed to run your processes is identified, maintained and available — including how you capture it when people leave.
Competence requirements are defined per role, people are competent, gaps are addressed, and evidence of competence is retained.
People know the quality policy, relevant objectives, their contribution, and the implications of not conforming.
Internal and external communications relevant to the QMS are planned: what, when, with whom, how and who communicates.
Documents and records are identified, reviewed, approved, version-controlled, protected and available where needed.
Operation
Processes for providing products and services are planned with criteria, resources and the records needed to show they ran as planned.
Customer communication, determining requirements, and reviewing them before committing to supply are in place, including changes.
If you design products or services, the design process is planned and controlled — or the exclusion is justified in your scope.
Criteria for selecting, evaluating, monitoring and re-evaluating external providers are applied, with records of the results.
Work is carried out under controlled conditions: instructions, suitable equipment, monitoring at the right stages, competent people.
Outputs are identified and traceable where needed; customer property is protected; post-delivery activities and changes are controlled.
Release happens only after planned checks are completed, with records of conformity and who authorised release.
Nonconforming outputs are identified and controlled to prevent unintended use, with records of the nonconformity and action taken.
Performance evaluation
You have decided what to monitor and measure, how and when, and when results are analysed and evaluated.
You monitor how customers perceive whether their needs and expectations have been met, and act on it.
Data is analysed to evaluate conformity, customer satisfaction, QMS performance, risk actions and provider performance.
An audit programme covers the QMS at planned intervals, with objective auditors, criteria, scope, reports and follow-up.
Top management reviews the QMS at planned intervals against the required inputs, and records decisions and actions.
Improvement
Opportunities for improvement are identified and acted on to meet requirements and enhance customer satisfaction.
Nonconformities are corrected, root causes found, corrective actions taken and checked for effectiveness, with records retained.
The suitability, adequacy and effectiveness of the QMS improve over time, informed by analysis and management review.