Done well, a gap analysis produces a prioritized list of everything the QMS needs before a certification body or FDA investigator reviews it. Done poorly, it produces a false sense of readiness that leads to findings during the actual audit.

This guide covers how to conduct a gap analysis that gives an accurate picture: what to assess, how to score what you find, and how to build a remediation plan that closes gaps in the right order.

What a gap analysis is, and what it is not

A gap analysis is a comparison. On one side is the requirement: the specific clause of ISO 13485, the section of 21 CFR Part 820, or the combination of both. On the other side is the current state: what the organization actually has in place, whether that is a documented procedure, a record, a defined process, or trained personnel.

The output is a list of gaps, which are areas where the current state does not fully meet the requirement, along with a description of what needs to change to close each one.

A gap analysis is not an audit. An audit evaluates whether a defined quality system is being implemented as documented. A gap analysis evaluates whether a quality system exists that could satisfy the relevant requirements. The distinction matters because a company new to ISO 13485 may not yet have a quality system to audit. The gap analysis defines what that system needs to include.

When to conduct a gap analysis

The most common triggers for a gap analysis are:

Initial certification pursuit. A company that has not previously been certified to ISO 13485 and is preparing for Stage 1 and Stage 2 audits with a certification body conducts a gap analysis to understand what needs to be built or formalized before the external audit.

Standard revision. When ISO 13485 was updated from the 2003 to the 2016 version, certified organizations that had been operating under the previous standard needed to assess which new requirements applied to them and what their existing systems covered. The same logic applies to regulatory updates like FDA's transition from the old QSR to QMSR.

Regulatory expansion. A medical device company that was previously operating under FDA jurisdiction only and is now preparing to sell in the EU needs to assess whether its existing QMS satisfies ISO 13485 requirements in addition to QMSR. The gap analysis identifies what the FDA-compliant system already covers and what additional requirements the European standard adds.

Post-acquisition integration. When a regulated company acquires another, the acquiring entity typically conducts a gap analysis of the acquired company's QMS to determine how far it is from the acquirer's standard and how long integration will take.

Pre-inspection preparation. Companies preparing for FDA inspection frequently conduct a gap analysis against the QMSR requirements most commonly cited in 483 observations, to identify and correct vulnerabilities before investigators arrive.

How to structure the gap analysis

The most effective gap analysis structure maps directly to the clause structure of the relevant standard. For ISO 13485, this means working through each section of the standard: Section 4 (quality management system), Section 5 (management responsibility), Section 6 (resource management), Section 7 (product realization), and Section 8 (measurement, analysis, and improvement). For FDA QMSR, the structure follows the subparts of 21 CFR Part 820.

For each clause or requirement, the analysis team documents:

• The specific requirement, stated in plain language
• The current state: what exists (procedure, record, process, or nothing)
• The gap: what is missing or insufficient
• A severity rating: critical, major, or minor
• The remediation action required to close the gap
• An owner and target date for remediation

This structure produces a gap analysis document that doubles as a project plan. The same table that describes each gap also assigns responsibility and timelines, so the transition from assessment to remediation does not require a separate planning step.

Severity classification for gaps

Not all gaps carry the same weight. Classifying each gap helps the organization prioritize remediation and communicate risk to leadership.

Critical gaps are requirements that have nothing in place to address them. A medical device company that has no documented design control process and no design history files for its products has a critical gap against ISO 13485 Section 7.3. Critical gaps will result in major nonconformances during a certification audit and will typically prevent certification until they are closed.

Major gaps are requirements that have partial coverage but where the existing practice does not fully meet the requirement. A company that has a CAPA procedure but does not consistently complete effectiveness checks has a major gap. During an audit, this would likely result in a major nonconformance finding requiring corrective action before or shortly after certification.

Minor gaps are requirements where the intent is met but the documentation or implementation is incomplete in ways that an auditor would note but that would not prevent certification. A procedure that covers the right activities but lacks revision history documentation is a minor gap.

This classification should be calibrated to the specific certification body or regulatory framework. Different certification bodies weight findings differently. In FDA inspections, certain requirements, including deviation CAPA procedures, design controls, and complaint handling, attract higher scrutiny than others and should be treated as higher severity even when gaps appear minor.

How to conduct the gap analysis review

The review process has three phases: document review, process walkthrough, and record review.

Document review compares the organization's existing procedures, work instructions, and forms against the requirements of the standard. This phase answers the question: does the organization have documented processes that address each requirement? Document review is typically done by the quality team using a gap analysis template that lists each clause and its requirements.

Process walkthrough validates whether what the documents describe actually happens in practice. A procedure that exists but is not followed is a major gap, even if the document review phase would have rated it as covered. Process walkthroughs involve interviewing personnel who perform the activities and observing work where possible. The questions to ask are simple: how do you do this step, where is this documented, and what record proves it was done?

Record review examines whether the records required by the standard and the organization's own procedures actually exist, are complete, and meet retention requirements. Record review often surfaces gaps that document review misses, particularly in areas like training records, audit findings and responses, and management review minutes.

The most common gaps by standard area

Based on the typical distribution of findings in certification audits and FDA inspections, certain areas consistently show higher gap rates than others.

Design controls (ISO 13485 Section 7.3 / 21 CFR Part 820.30). Organizations that have been designing products informally, without documented design plans, design inputs, design outputs, design reviews, verification, and validation, typically face significant remediation work in this area. Design controls are the most complex area of both standards and the most frequently cited in FDA 483 observations.

Risk management (ISO 14971). ISO 13485 requires that risk management be applied throughout product realization. Organizations that have not maintained a formal risk management process, or that have risk management documentation that does not connect to design controls and post-market surveillance, typically have major gaps here.

Supplier controls (ISO 13485 Section 7.4). Many organizations have purchasing processes but do not have documented supplier evaluation criteria, a maintained approved supplier list, or periodic re-evaluation of supplier performance. The gap between having suppliers and having a compliant supplier qualification program is often larger than organizations expect.

CAPA effectiveness verification. As described above, effectiveness checks are among the most frequently cited gaps in both ISO 13485 audits and FDA inspections. Organizations that close CAPAs at implementation without verifying that the correction worked consistently have findings in this area.

Management review. Organizations that hold management reviews but do not cover all required agenda items, or that hold them infrequently relative to their QMS risk level, typically have minor to major gaps in this area.

Building the remediation plan from gap analysis output

Once gaps are classified and documented, the remediation plan defines how and when each gap will be closed. The plan should sequence remediation in the order of severity, with critical gaps addressed first, but it also needs to account for dependencies.

Document control infrastructure needs to exist before any other procedures can be properly controlled. Training management needs to be in place before personnel can be trained on new procedures. Risk management needs to be operational before design controls can be fully validated. Getting the sequence right prevents situations where a team writes ten new SOPs and then discovers the document control system to manage them does not yet meet the standard.

For organizations with a target certification date, work backward from the date of the Stage 2 audit. Allow at least 90 days before the Stage 2 audit for all major gaps to be closed and for the quality system to have generated at least one cycle of records in each process area. Certification bodies typically want to see evidence that the QMS has been operating, not just that the documents exist.

How Cloudtheapp supports gap analysis and QMS remediation

One of the most common challenges organizations face after a gap analysis is managing the remediation work. Gaps become action items, action items need owners and deadlines, and the quality team needs visibility into which gaps have been closed and which are still open.

Cloudtheapp's platform provides the QMS infrastructure that most gap analyses identify as missing: structured document control, audit management, CAPA workflow, supplier qualification, training management, and built-in analytics. Organizations using Cloudtheapp as the foundation for their QMS remediation can close document control, record management, and CAPA-related gaps with a single platform deployment rather than building custom solutions for each area.

With 60+ applications available across quality, safety, and compliance, Cloudtheapp lets organizations deploy the specific modules needed to address their highest-priority gaps first, then expand as remediation progresses.

Request a demo to see how Cloudtheapp accelerates QMS remediation and positions organizations for certification audit success.

What happens after the gap analysis

The gap analysis is the beginning of the certification process, not the end. After remediation is complete, most certification bodies recommend a pre-assessment or Stage 1 audit to verify readiness before the formal Stage 2 certification audit. For FDA QMSR, a mock inspection using the same assessment framework as the gap analysis gives the quality team a final checkpoint before investigators arrive.

The gap analysis document itself should be retained as a quality record. It provides evidence that the organization conducted a systematic assessment of its QMS, identified deficiencies, and took action to correct them. For certification bodies and FDA investigators alike, a well-documented gap analysis and remediation history demonstrates that the quality system was built intentionally, not assembled reactively.

Summary

A gap analysis for ISO 13485 or FDA QMSR certification answers a specific question: where is the current QMS short of what the standard requires? The answer produces a prioritized list of remediation actions, each with a severity rating, an owner, and a timeline.

The three-phase review process, document review, process walkthrough, and record review, is necessary because documents alone do not reveal whether processes are actually working. The most common gaps cluster around design controls, supplier qualification, risk management, CAPA effectiveness, and management review, but the specific gap profile for any organization depends on its product type, history, and regulatory context.

Organizations that approach the gap analysis as an honest assessment of current state, rather than as a documentation exercise, get the most value from it. The findings are only useful if they are accurate.

This post created by and appeared first on Cloudtheapp