Introduction
A gap analysis is a systematic assessment of the difference between your current environmental management system (EMS) and the requirements of the ISO 14001 standard. It’s your starting point for certification—a roadmap showing you where you stand and where you need to focus effort.
A well-executed gap analysis typically takes 2–6 weeks and costs AUD 0–4,000 (depending on whether you do it internally or hire a consultant). The output is a prioritised list of gaps and a remediation plan that guides your implementation timeline.
This guide walks you through the methodology, shows you how to score gaps, provides a worked example with a 30-row template, and explains how to convert results into action.
What Is a Gap Analysis and Why Does It Matter?
A gap analysis answers the question: How ready are we for ISO 14001 certification?
It is not an audit. An audit is performed by an independent third party and determines whether you’re compliant. A gap analysis is typically done internally (or by a consultant you hire) to understand your starting position and plan remediation before you engage a certification body.
Why Conduct a Gap Analysis?
- Avoid surprise audit failures: Identify major gaps before Stage 2 audit
- Plan resources: Know upfront what staff time, budget, and external support you’ll need
- Set realistic timelines: Understand which gaps are quick fixes vs. requiring cultural or structural change
- Prioritise effort: Focus on high-impact areas first (e.g., significant environmental aspects, legal compliance, management review)
- Build leadership buy-in: Present a data-driven readiness assessment to secure resources and commitment
When to Run a Gap Analysis
Pre-Certification
Most organisations conduct a gap analysis 3–6 months before engaging a certification body, giving them time to remediate major gaps before Stage 1 audit.
Pre-Surveillance Audit
If you’re already certified, a gap analysis before Year 1 or Year 2 surveillance helps ensure you’re maintaining compliance and identify any drift.
2026 Transition
If you’re certified under ISO 14001:2015, a gap analysis against the 2026 changes (due by May 2029) helps you assess transition effort and plan updates.
Gap Analysis Methodology
A robust gap analysis involves four components:
1. Document Review
Collect and review:
– Your environmental policy
– EMS procedures and work instructions
– Environmental aspects and objectives register
– Legal and regulatory compliance checklist
– Management review minutes (last 12 months)
– Internal audit reports
– Training records and competency assessments
– Records of incidents, nonconformities, and corrective actions
– Communication logs (internal and external)
– Contractor and supplier management procedures
Compare each document against the equivalent ISO 14001 requirement. Is it complete? Current? Approved? Accessible to staff?
Red flags during document review:
– Templates with blank fields or no approval signatures
– Outdated revision dates (more than 12 months old)
– No evidence of review or update cycles
– References to old standards or obsolete processes
– Missing procedures (e.g., no emergency preparedness procedure, no competence assessment method)
2. Interviews
Interview staff at multiple levels:
– Senior management: Leadership commitment, strategic direction, resource allocation
– EMS coordinator/manager: Day-to-day system ownership, challenges, improvement ideas
– Department heads: Operational controls, training, communication
– Frontline staff: Awareness, training adequacy, engagement with EMS
Sample interview questions:
– “What’s the company’s environmental policy? Can you tell me what it means?”
– “How do you know what legal environmental requirements apply to you?”
– “What significant environmental aspects does your department manage? How?”
– “If you found a spill or breach, what would you do?”
– “How often do you receive environmental training? What was the last topic?”
– “How does management review environmental performance?”
What to listen for:
– Gap between what documentation says and what staff actually do
– Weak understanding of environmental aspects and significance
– Lack of awareness of roles and responsibilities
– Concerns about resource constraints
3. Site Walk
Physically walk key operational areas:
– Observe how documented controls are actually implemented
– Check signage (e.g., waste segregation, spill kits, emergency procedures)
– Review records (e.g., training certificates, maintenance logs, calibration records)
– Identify undocumented processes or informal workarounds
– Take photographs of control implementation (e.g., waste storage areas, hazardous substance inventory)
Typical observations:
– Waste bins not segregated as per procedure
– Emergency contact numbers not posted
– Staff not wearing required PPE despite training records
– Old versions of procedures in use on the shop floor
– Records stored haphazardly, difficult to retrieve
4. Records Review
Systematically review:
– Training records: Do they show all staff have received relevant training? Are records current?
– Internal audit records: Is there a schedule? Have audits been completed? Are findings documented and closed?
– Management review records: Are meetings held annually? Are minutes recorded? Are decisions documented?
– Incident and nonconformity records: Are environmental incidents logged? Are corrective actions tracked to closure?
– Competence assessment records: Is there evidence that competency requirements are defined and assessed?
– Communications: Are there records of internal and external environmental communication?
Common gaps in records:
– Internal audit schedule exists but audits haven’t been performed
– Training log shows staff names but no details of topic, date, or assessment
– Management review held but minutes are sketchy; decisions not documented
– Incidents reported but no investigation or corrective action follow-up
– Records scattered across multiple locations or digital systems; no centralised register
Traffic-Light Scoring System
Rate each clause and key requirement on a three-point scale:
| Colour | Status | Meaning | Action |
|---|---|---|---|
| Green | Compliant | Documented, implemented, staff aware; minor refinements only | Document as current state; plan annual review cycle |
| Amber | Partially Compliant | Documentation or implementation gaps; clear path to remediation | Plan remediation; assign owner, target date, resources |
| Red | Non-Compliant | Major gaps; substantial work needed; risk of audit failure | Prioritise; consider external support; extend timeline |
Scoring at the Clause Level
ISO 14001 has 10 main clause groups (Clause 4–10):
| Clause | Title | Score |
|---|---|---|
| 4 | Context of the organisation | Green / Amber / Red |
| 5 | Leadership | Green / Amber / Red |
| 6 | Planning | Green / Amber / Red |
| 7 | Support (resources, competence, communication, documentation) | Green / Amber / Red |
| 8 | Operation | Green / Amber / Red |
| 9 | Performance evaluation (monitoring, internal audit, management review) | Green / Amber / Red |
| 10 | Improvement (nonconformity, corrective action, continual improvement) | Green / Amber / Red |
Common Gaps by Clause
Here’s a table of the most frequently observed gaps during gap analyses:
| Clause | Requirement | Common Gap | Remediation |
|---|---|---|---|
| 4 | Context of the organisation | External/internal context not formally documented | Complete context analysis; document interested parties and their concerns |
| 5.1 | Leadership commitment | No evidence of management engagement with EMS | Hold quarterly EMS steering meetings; review in board papers |
| 5.2 | Environmental policy | Policy generic or outdated; doesn’t reflect current operations | Revise policy to address top 3–5 environmental priorities; get signed approval |
| 5.3 | Environmental objectives | Objectives not aligned to significant aspects or policy | Establish objectives for each significant aspect; ensure SMART criteria |
| 6.1 | Legal compliance | Compliance register incomplete; no procedure for new regulations | Create comprehensive register of all applicable laws; assign owner; establish update process |
| 6.2 | Significant aspects | Aspects identified but controls not documented or implemented | Document controls for each significant aspect; train staff on how to apply them |
| 6.3 | Planning for change | No procedure for managing environmental implications of change | Create change management process; require EMS assessment before major changes |
| 7.1 | Resources | EMS budget unclear; roles not assigned | Allocate specific budget; define EMS roles in job descriptions |
| 7.2 | Competence | No competence assessment; training records incomplete | Define competence requirements; assess staff; plan training; document all records |
| 7.4 | Communication | No formal communication plan; staff unaware of EMS | Create communication calendar; hold induction, toolbox talks, posters, newsletter items |
| 7.5 | Documentation | Procedures missing or incomplete; control system inadequate | Develop all required procedures; implement document control (version, approval, accessibility) |
| 8.1 | Operational planning and control | Controls not documented; contractors operate independently | Write work instructions for each significant aspect; require contractors to comply |
| 8.2 | Emergency preparedness | No emergency procedures; no drills; staff unaware | Develop procedures; conduct annual drills; post contact numbers; brief new staff |
| 9.1 | Monitoring and measurement | No targets or baseline data; irregular monitoring | Define baseline; set targets; establish monitoring schedule; train operators |
| 9.2 | Internal audit | Audit programme not comprehensive; findings not tracked | Create annual audit schedule; ensure all clauses covered; track CA to closure |
| 9.3 | Management review | Meetings held infrequently; decisions not documented | Formalise agenda; hold annually minimum; document input, discussion, decisions |
| 10.2 | Corrective action | Nonconformities raised but root causes not investigated | Implement CAPA process; require evidence of closure; verify effectiveness |
| 10.3 | Continual improvement | No evidence of improvement initiatives; objectives stagnant | Track improvement suggestions; demonstrate progress on objectives; celebrate wins |
Worked Example: 30-Row Gap Analysis Template
Here’s a practical template for a medium-sized manufacturing organisation. You can adapt the rows and add more detail specific to your sector:
| # | Clause | Element | Current State | Gap | Status | Owner | Target Date | Notes |
|---|---|---|---|---|---|---|---|---|
| 1 | 4.1 | Understanding context | Internal/external context draft started | Not formalised; no interested parties analysis | Amber | EMS Manager | 30 Apr | Meet with finance, operations, sales to gather input |
| 2 | 4.4 | Legal compliance register | Register exists but outdated (last updated Jan 2024) | Missing 2024–2026 regulations; no assignment of ownership | Red | Compliance Officer | 31 May | Conduct full legislative review; assign one owner per area |
| 3 | 5.1 | Leadership commitment | MD attends quarterly ops meetings | No formalised EMS steering committee; budget not ringfenced | Amber | MD / EMS Manager | 31 May | Establish steering committee; present EMS budget for board approval |
| 4 | 5.2 | Environmental policy | Policy exists but last updated 2020 | References old operations; doesn’t highlight waste/emissions | Amber | EMS Manager | 30 Apr | Revise to align with current priorities; obtain MD signature |
| 5 | 6.1a | Environmental aspects identification | Aspects identified for core processes | External contractors’ impacts not considered; lifecycle not assessed | Amber | Operations Manager | 31 May | Extend assessment to contractors, supply chain, product lifecycle |
| 6 | 6.2 | Significant aspects determination | Top 5 aspects identified | Significance criteria not documented; annual review not scheduled | Amber | EMS Manager | 30 Apr | Document assessment methodology; schedule annual review meeting |
| 7 | 6.2a | Controls for significant aspects | Waste segregation and energy procedures drafted | Procedures not approved; staff training not started | Amber | Ops Manager | 31 May | Finalise procedures; conduct staff briefing; update SOP posters |
| 8 | 6.3 | Objectives and targets | Three objectives set for 2026 | Not linked to significant aspects; no baseline data | Amber | EMS Manager | 30 Apr | Link each objective to a significant aspect; measure current baseline |
| 9 | 6.5 | Change management | No formal change procedure | Risk of environmental implications not assessed for changes | Red | Operations Manager | 30 Jun | Create change request form; require environmental check before approval |
| 10 | 7.1 | Resources | EMS coordinator role created (0.5 FTE) | Budget for training, software, consultant not allocated | Amber | Finance Manager | 31 May | Develop 2026 EMS budget proposal; present to CFO |
| 11 | 7.2 | Competence—EMS coordinator | Coordinator has 3 years EHS experience | No formal competence assessment; training plan not developed | Amber | HR Manager | 30 Apr | Define competence requirements; assess gaps; enrol in ISO 14001 course |
| 12 | 7.2 | Competence—Operational staff | Staff trained on waste handling in 2022 | No record of assessment; refresher due | Red | Training Manager | 31 May | Conduct competence assessment; deliver refresher training; document records |
| 13 | 7.4 | Internal communication | Team briefing on EMS in January | No follow-up; no two-way communication mechanism | Amber | EMS Manager | 31 May | Launch monthly EMS newsletter; create suggestion box; post FAQs on intranet |
| 14 | 7.4 | External communication | Website mentions sustainability vaguely | No formal process for external stakeholder engagement | Amber | Marketing Manager | 30 Jun | Create external communication plan; publish EMS policy on website |
| 15 | 7.5 | Document control | Three key documents drafted and approved | No version control system; no document register | Red | EMS Manager | 30 Apr | Implement document control procedure (version, approval, archive); create register |
| 16 | 7.5 | Records management | Environmental records kept in multiple spreadsheets | No centralised filing system; retention periods not defined | Amber | Admin Manager | 31 May | Establish document management system; define retention; migrate records |
| 17 | 8.1 | Operational controls—Energy | Weekly meter readings taken | No target; no improvement action; readings not analysed | Amber | Facilities Manager | 30 Apr | Set energy target based on 2025 baseline; analyse trends monthly; plan efficiency project |
| 18 | 8.1 | Operational controls—Waste | Segregation bins in place | No monitoring of disposal routes; contractor not audited | Amber | Operations Manager | 31 May | Audit waste contractor compliance; verify disposal routes; set target to reduce waste |
| 19 | 8.1 | Operational controls—Water | No monitoring | No baseline or target; potential for significant impact | Red | Facilities Manager | 30 Jun | Conduct water audit; set baseline and reduction target; install metering |
| 20 | 8.2 | Contractor management | Contractor induction checklist exists | No requirement for contractor to follow EMS procedures | Amber | Operations Manager | 30 Apr | Update induction to include environmental requirements; require signed acknowledgment |
| 21 | 8.2 | Contractor compliance—Hazardous substances | Contractor delivers chemicals; SDS available | Contractor not briefed on spill procedure; no emergency contact details | Red | Operations Manager | 31 May | Brief contractor on spill response; provide emergency contacts; review quarterly |
| 22 | 8.3 | Emergency preparedness | Spill kit available | No procedure documented; staff not trained; no drill scheduled | Red | Safety Manager | 31 May | Write emergency procedure; conduct annual drill; photograph response; keep training record |
| 23 | 9.1 | Monitoring and measurement—Air quality | No monitoring (potential impact near neighbours) | No baseline or target; risk of complaint | Red | Facilities Manager | 30 Jun | Conduct baseline survey; set target; establish routine monitoring or invest in control |
| 24 | 9.1 | Performance indicators | No KPIs defined | No way to track progress against objectives | Red | EMS Manager | 30 Apr | Define 3–5 KPIs per objective; establish baseline; monthly reporting |
| 25 | 9.2 | Internal audit schedule | Ad-hoc audits only; no plan | No assurance of clause coverage; audit skills not developed | Red | EMS Manager | 30 Apr | Create annual audit schedule; train 2–3 internal auditors; assign audit leads |
| 26 | 9.3 | Management review meeting | Held annually (Nov) | Input incomplete; decisions not documented; no follow-up on actions | Amber | MD | 30 Apr | Formalise MR agenda; gather input from audits, KPIs, complaints; document outcomes |
| 27 | 10.1 | Nonconformity procedure | Incidents logged on safety spreadsheet | Environmental nonconformities not tracked separately; no CAPA template | Amber | Safety Manager | 31 May | Create EMS nonconformity form; establish tracking log; assign ownership |
| 28 | 10.2 | Corrective action | Some CAs raised but not tracked to closure | Evidence of root cause analysis and effectiveness review missing | Amber | EMS Manager | 31 May | Implement CAPA tracker; require evidence of closure; verify effectiveness |
| 29 | 10.3 | Continual improvement | Waste reduction idea raised by staff but not progressed | No formal suggestion scheme; improvement ideas not tracked | Amber | EMS Manager | 31 May | Establish improvement register; review quarterly; celebrate wins; communicate results |
| 30 | All | Overall EMS integration | Some procedures exist but not integrated | No cross-functional ownership; limited awareness below supervisor level | Amber | EMS Manager | 30 Jun | Schedule cross-department meetings; integrate into business planning; align incentives |
Turning Results into a Remediation Plan
Once you’ve scored all gaps, create a remediation plan:
- Filter for red items: These are your highest priority. Plan to address reds within 3 months.
- Group by theme: Cluster related gaps (e.g., all documentation gaps, all training gaps, all operational control gaps) to identify systemic issues.
- Assign ownership: Clearly state who is responsible for closing each gap (e.g., “Operations Manager will develop hazardous substance procedure”).
- Estimate effort: For each gap, estimate the staff hours and external budget needed to remediate.
- Prioritise: Consider effort vs. impact. Quick wins (low effort, high impact) go first; complex structural changes go later.
- Set dates: Assign a realistic target date for each gap closure.
- Define success: What evidence will prove the gap is closed? (e.g., “Approved document + staff training records + evidence of implementation during site walk”)
Sample remediation priority matrix:
| Gap | Effort (hours) | Impact (1–5) | Priority | Target Date |
|---|---|---|---|---|
| Document control system | 20 | 5 | High | 30 April |
| Staff awareness training | 16 | 5 | High | 30 April |
| Change management procedure | 12 | 4 | High | 31 May |
| Legal compliance register | 30 | 5 | High | 31 May |
| Water baseline and target | 8 | 3 | Medium | 30 June |
| Competence assessment forms | 10 | 4 | High | 30 April |
| Internal audit schedule | 6 | 4 | High | 30 April |
| Emergency preparedness drill | 4 | 4 | High | 31 May |
| Air quality monitoring | 40 | 3 | Medium–Low | 30 June |
Gap Analysis for 2026 Transition
If you’re already certified under ISO 14001:2015, a transition gap analysis assesses the gap between your current system and ISO 14001:2026.
Key differences to assess:
| Area | 2015 | 2026 | Gap Assessment |
|---|---|---|---|
| Climate change | Not explicitly required | Explicit requirement to assess climate risks and opportunities | Do you have a climate risk assessment? Do objectives address climate? |
| Lifecycle perspective | Life cycle thinking; not mandatory | Mandatory to consider lifecycle and value chain | Are significant aspects evaluated across the full lifecycle? |
| Change management | Reactive | Proactive and planned change management required | Do you have a formal change management process? Is it preventive? |
| Leadership scope | Senior management focus | Extended to all leadership roles and levels | Is environmental responsibility embedded in all leadership job descriptions? |
| Emergency preparedness | All credible scenarios | Clarified focus on scenarios with environmental consequences | Are your emergency procedures focused on environmental impact? |
| External providers | Communicate requirements | Determine, implement, maintain controls over external providers | Do you audit suppliers? Are environmental requirements documented in contracts? |
| Operational control documentation | Must be documented | Emphasis on documented procedures for all significant aspects | Is every significant aspect linked to a documented control or procedure? |
Run a transition gap analysis 12–18 months before your recertification audit to plan updates systematically.
DIY vs. Consultant: When to Use Each
| Factor | DIY | Consultant |
|---|---|---|
| Cost | Low (staff time only) | AUD 2,000–4,000 + fees |
| Timeline | Longer (staff capacity constraints) | Faster (dedicated resource) |
| Objectivity | Risk of bias; gaps may be minimised | Independent perspective; identifies blind spots |
| Expertise | Risk of missing subtle requirements | Expert knowledge of ISO 14001 and common gaps |
| Staff awareness | High (staff involved in assessment) | Medium (requires post-assessment engagement) |
| Best for | Organisations with EHS expertise and capacity | Organisations new to ISO 14001 or complex sectors |
Hybrid approach: Many organisations conduct the gap analysis themselves with consultant support for specific technical areas (e.g., legal compliance, significant aspects determination).
8 Frequently Asked Questions
1. Who should conduct the gap analysis?
Ideally, a team including your EMS manager, operations lead, facility/maintenance manager, and HR. Consider engaging a consultant if you lack internal expertise.
2. How long should a gap analysis take?
2–6 weeks depending on organisation size and starting position. Small organisations: 2–3 weeks. Large or multi-site: 4–6 weeks.
3. What if we score everything as green?
That’s unusual and suggests either you have a very mature system or the assessment may lack rigour. Consider bringing in a consultant for an objective review.
4. Can we skip the gap analysis and go straight to certification?
Technically yes, but it’s risky. You’ll likely receive major non-conformities at Stage 2 audit, costing time and money to remediate. A gap analysis upfront prevents surprises.
5. How often should we repeat the gap analysis?
Before major certification events (Stage 1 audit, surveillance audit, recertification, or 2026 transition). Also periodically (e.g., every 2 years) to check that gaps remain closed.
6. What’s the difference between a gap analysis and an internal audit?
A gap analysis compares your system to the standard and identifies what’s missing. An internal audit verifies that your system is documented and working as intended. Gap analysis is pre-certification. Internal audit is an ongoing requirement.
7. Should we address all gaps before Stage 1 audit?
No. Red gaps should be mostly closed. Amber gaps can have a remediation plan. Green gaps are fine as-is.
8. How do we ensure the gap analysis is comprehensive?
Use a structured template (like the 30-row example above). Interview multiple levels of staff. Walk the site. Review documents and records. Don’t rely on a desk review alone.
Conclusion
A gap analysis is your baseline assessment. It tells you where you stand, guides your remediation effort, and builds confidence that you’re ready for certification. Invest 2–6 weeks and AUD 0–4,000 upfront to avoid much larger costs and delays during the certification audit process.
The output—a scored assessment, a prioritised remediation plan, and clear ownership—is the foundation of your certification journey.
Recent Comments