By Kevin M. Hyams | Publisher: NORVA Solutions

Why I wrote this

Gap analysis can place real pressure on the people responsible for compliance assessment work.

In practice, I often see teams move too quickly from identifying applicable requirements into detailed testing, extensive evidence requests and lengthy remediation discussions before they have properly level-set where the organisation actually stands.

The result is often predictable. Time is spent assessing areas that are already working, evidence is requested before the real issues are understood, and management receives a long list of findings without a clear sense of what matters most.

I wrote this article because a gap analysis should help clarify the situation, not complicate it.

Done properly, a gap analysis helps organisations identify what appears to be missing, where risk remains, and where attention should be focused before significant assessment effort is invested.

If this article helps you create a clearer, more proportionate and more defensible path through compliance assessment work, it has served its purpose.

Summary

Every effective compliance assessment starts with one simple question:

Are we meeting the requirements that apply to us?

After scoping determines what applies and maturity assessment establishes current readiness, gap analysis asks a different question:

What appears to be missing, incomplete, unsupported or in need of attention?

That question matters because detailed assessment work can be expensive.

Good gap analysis helps an organisation:

• Identify where compliance weaknesses may exist
• Distinguish genuine gaps from documentation issues
• Prioritise remediation effort
• Reduce unnecessary testing and evidence collection
• Focus management attention on material issues
• Improve audit and regulatory readiness
• Create a clearer roadmap for assessment and improvement
• Reduce the risk of surprises later in the assessment process

This is the third article in NORVA's six-part series on practical compliance assessment.

In this article, we examine the third phase: Gap Analysis.

What is a compliance gap analysis?

A compliance gap analysis is a structured comparison between:

• what is required; and
• what currently exists.

The objective is simple.

To identify the gap between the organisation's current position and the position it needs to reach.

Many compliance, audit and assurance methodologies use gap analysis as an important level-setting activity before detailed testing begins.

That is because it helps distinguish between:

• controls that appear adequate;
• controls that need improvement;
• missing controls;
• missing evidence;
• incomplete implementation; and
• areas requiring remediation.

Gap analysis is not detailed control testing.

Nor is it final assurance.

It is a focused review designed to identify where to direct attention before deeper assessment work begins.

Where gap analysis fits within the six integrated phases

A practical compliance assessment can be viewed as six connected phases:

• Scope — identify what applies and assess inherent risk
• Maturity Assessment — understand current readiness and the assurance path
• Gap Analysis — identify what needs attention and what risk remains
• Risk and Control Matrix Assessment — test the controls management relies upon
• Documentary Evidence — support the assessment position with evidence
• Inspection-Ready Deliverables — produce usable reports and outputs

Gap analysis sits between maturity assessment and detailed validation for a reason.

The assessment should first understand:

• what applies;
• what currently exists; and
• what level of assurance is appropriate.

Only then does it make sense to determine what requires attention before moving into deeper testing.

This sequencing is consistent with many leading compliance, audit and governance methodologies.

The practical question behind gap analysis

Many teams approach gap analysis by asking:

What controls are missing?

That is useful, but it is not the best question.

A more practical question is:

What is preventing us from confidently saying we meet this requirement and can support the answer?

That broader question often reveals that the issue is not necessarily a missing control.

The issue may be:

• unclear ownership;
• incomplete implementation;
• undocumented practices;
• missing evidence;
• inconsistent execution;
• inadequate monitoring;
• weak reporting; or
• a genuine control deficiency.

Understanding the difference matters.

Not every problem requires a new control.

Sometimes it requires better documentation, clearer accountability or stronger evidence.

Why leading compliance programmes perform gap analysis before detailed testing

One of the strongest themes in industry guidance is that gap analysis should occur before detailed assessment work becomes too expensive.

Without a gap analysis, organisations often:

• test controls that obviously need remediation;
• collect evidence that is unlikely to support the current position;
• involve stakeholders before priorities are clear;
• perform unnecessary review activity;
• spend significant effort proving what they already know.

Gap analysis helps avoid that.

It provides an early assessment of likely weaknesses before deeper validation begins.

In practical terms, it helps answer:

• What appears to be working?
• What appears incomplete?
• What appears missing?
• What should be fixed first?
• What deserves deeper assessment?

That level-setting exercise can significantly improve assessment efficiency.

Gap analysis and the concept of proportionality

One of the most valuable benefits of gap analysis is its support for proportionality.

Not every identified issue deserves the same response.

Some gaps may have a limited impact and can be addressed through normal process improvement.

Others may affect:

• regulatory obligations;
• customer commitments;
• financial reporting;
• operational resilience;
• governance effectiveness; or
• management confidence.

The purpose of gap analysis is not to create the largest possible list of findings.

The purpose is to identify the findings that matter.

This helps organisations apply effort proportionately and focus resources where risk justifies attention.

What should a practical gap analysis examine?

A useful gap analysis typically considers:

Requirements

Are all applicable requirements addressed?

Policies

Does the policy position support what is being assessed?

Processes

Are required activities actually happening?

Controls

Are key controls present and reasonably designed?

Responsibilities

Is ownership clear?

Documentation

Can practices be explained and supported?

Evidence

Can the organisation demonstrate the position it relies upon?

Reporting

Can management understand and explain the outcome?

Taken together, these questions provide a better picture of where attention is needed.

What management gains from a gap analysis

A useful gap analysis should help management understand:

• where compliance appears strong;
• where weaknesses are emerging;
• where remediation is required;
• where additional assurance may be necessary;
• where risk remains elevated;
• where priorities should be focused.

This is important because management rarely needs hundreds of individual findings.

Management needs a clearer view of what matters.

Good gap analysis helps create that view.

Why gap analysis reduces assessment cost

Gap analysis often reduces assessment costs by helping avoid unnecessary work.

Without it, organisations can easily spend significant time:

• collecting evidence too early;
• testing low-priority areas;
• reviewing controls that will require redesign anyway;
• producing reports before priorities are understood.

Gap analysis helps direct activity toward areas that genuinely require attention.

The result is often:

• less wasted effort;
• fewer unnecessary reviews;
• clearer remediation plans;
• better use of specialist resources;
• more efficient assessment delivery.

This is particularly valuable for teams operating with limited compliance resources.

Why gap analysis improves audit and inspection readiness

Many audit findings and regulatory observations do not arise because organisations were unaware of requirements.

They arise because weaknesses were not identified early enough.

Gap analysis helps reduce that risk.

It creates an opportunity to identify:

• weaknesses;
• incomplete implementation;
• missing documentation;
• evidence deficiencies; and
• remediation needs

before auditors, inspectors or regulators identify them.

That makes the assessment process more proactive and more defensible.

Where gap analysis can go wrong

Gap analysis is only useful if it is applied with discipline.

Common problems include:

• treating assumptions as facts;
• confusing documentation gaps with control failures;
• recording every issue as equally important;
• failing to consider risk and materiality;
• creating excessive findings that nobody can realistically address;
• moving directly from gap analysis into remediation without validation.

A useful gap analysis is selective and evidence-aware.

It should identify what appears to be missing while recognising that detailed validation may still be required later.

How gap analysis differs from maturity assessment and control testing

One of the most useful distinctions in the NORVA methodology is that each phase answers a different question.

Maturity Assessment

How ready do we appear to be?

Gap Analysis

What appears to be missing?

Risk and Control Matrix Assessment

Can management demonstrate that the controls actually operate effectively?

This distinction is important.

Many methodologies combine these activities.

Separating them helps make the assessment clearer, more structured, and easier to explain.

How the assessment tool should support gap analysis

Gap analysis should not depend on disconnected working papers, informal observations or memory.

A practical assessment tool should help users:

• compare current and target states;
• identify gaps consistently;
• distinguish between different types of gaps;
• prioritise findings according to risk;
• link observations to requirements;
• preserve assessment rationale;
• connect findings to remediation activities;
• create a structured path into detailed assessment work.

This is one of the principles behind the NORVA Solutions Compliance Assessment Toolkit.

NORVA's Excel-native smart templates help users assess, document and prioritise gaps in a structured way while maintaining a clear relationship between requirements, controls, evidence and reporting.

The objective is not to replace professional judgement.

It is to help users apply judgement more consistently and document it more clearly.

A practical gap analysis checklist

Before moving from gap analysis into detailed control assessment, the team should be able to answer:

• Have we confirmed the applicable requirements?
• Have we established current readiness?
• Have we identified apparent gaps?
• Have we distinguished between control, process, documentation and evidence gaps?
• Have we assessed significance and risk?
• Have we prioritised remediation needs?
• Have we identified areas requiring deeper validation?
• Have we documented management rationale?
• Have we avoided treating every issue as equally important?
• Does management understand the key findings?
• Does the gap analysis create a reliable foundation for detailed control testing?

If the answer is yes, the organisation is generally in a stronger position to move into the next phase.

Conclusion:  Identify what needs attention before investing effort

Gap analysis is not about creating a long list of deficiencies.

It is about creating clarity.

When done well, it helps organisations identify what appears to be missing before moving into deeper testing, evidence collection, and remediation.

That makes the assessment more focused, more proportionate and often more cost-effective.

Scope tells us what applies.

Maturity assessment tells us where we stand today.

Gap analysis tells us what appears to need attention.

Only then does it make sense to begin detailed control validation.

That sequence helps organisations answer a clearer question:

We know what applies. We understand where we stand. We know what needs attention.

That is a stronger starting point for every compliance assessment.

I hope that helps.

If it applies, assess it. If you rely on it, document your evidence.

Make Gap Analysis Easier

The NORVA Solutions Compliance Assessment Toolkit is designed to help compliance teams and advisory firms identify, document and prioritise compliance gaps using structured, Excel-native smart templates.

The toolkit helps users:

• compare requirements against current practice;
• identify gaps consistently;
• prioritise remediation effort;
• link findings to evidence;
• preserve assessment rationale; and
• move smoothly into detailed control assessment where required.

Supported by editable, principle-based policies and NORVA's Assessment Runtime Engine, the toolkit helps organisations turn gap analysis into a structured, repeatable, and evidence-based process.

If your team needs a more practical way to level-set compliance status before detailed assessment begins, NORVA may be worth exploring.