By Kevin M. Hyams | Publisher: NORVA Solutions
Gap analysis can place real pressure on the people responsible for compliance assessment work.
In practice, I often see teams move too quickly from identifying applicable requirements into detailed testing, extensive evidence requests and lengthy remediation discussions before they have properly level-set where the organisation actually stands.
The result is often predictable. Time is spent assessing areas that are already working, evidence is requested before the real issues are understood, and management receives a long list of findings without a clear sense of what matters most.
I wrote this article because a gap analysis should help clarify the situation, not complicate it.
Done properly, a gap analysis helps organisations identify what appears to be missing, where risk remains, and where attention should be focused before significant assessment effort is invested.
If this article helps you create a clearer, more proportionate and more defensible path through compliance assessment work, it has served its purpose.
Every effective compliance assessment starts with one simple question:
Are we meeting the requirements that apply to us?
After scoping determines what applies and maturity assessment establishes current readiness, gap analysis asks a different question:
What appears to be missing, incomplete, unsupported or in need of attention?
That question matters because detailed assessment work can be expensive.
Good gap analysis helps an organisation:
This is the third article in NORVA's six-part series on practical compliance assessment.
In this article, we examine the third phase: Gap Analysis.
A compliance gap analysis is a structured comparison between:
The objective is simple.
To identify the gap between the organisation's current position and the position it needs to reach.
Many compliance, audit and assurance methodologies use gap analysis as an important level-setting activity before detailed testing begins.
That is because it helps distinguish between:
Gap analysis is not detailed control testing.
Nor is it final assurance.
It is a focused review designed to identify where to direct attention before deeper assessment work begins.
A practical compliance assessment can be viewed as six connected phases:
Gap analysis sits between maturity assessment and detailed validation for a reason.
The assessment should first understand:
Only then does it make sense to determine what requires attention before moving into deeper testing.
This sequencing is consistent with many leading compliance, audit and governance methodologies.
Many teams approach gap analysis by asking:
What controls are missing?
That is useful, but it is not the best question.
A more practical question is:
What is preventing us from confidently saying we meet this requirement and can support the answer?
That broader question often reveals that the issue is not necessarily a missing control.
The issue may be:
Understanding the difference matters.
Not every problem requires a new control.
Sometimes it requires better documentation, clearer accountability or stronger evidence.
One of the strongest themes in industry guidance is that gap analysis should occur before detailed assessment work becomes too expensive.
Without a gap analysis, organisations often:
Gap analysis helps avoid that.
It provides an early assessment of likely weaknesses before deeper validation begins.
In practical terms, it helps answer:
That level-setting exercise can significantly improve assessment efficiency.
One of the most valuable benefits of gap analysis is its support for proportionality.
Not every identified issue deserves the same response.
Some gaps may have a limited impact and can be addressed through normal process improvement.
Others may affect:
The purpose of gap analysis is not to create the largest possible list of findings.
The purpose is to identify the findings that matter.
This helps organisations apply effort proportionately and focus resources where risk justifies attention.
A useful gap analysis typically considers:
Are all applicable requirements addressed?
Does the policy position support what is being assessed?
Are required activities actually happening?
Are key controls present and reasonably designed?
Is ownership clear?
Can practices be explained and supported?
Can the organisation demonstrate the position it relies upon?
Can management understand and explain the outcome?
Taken together, these questions provide a better picture of where attention is needed.
A useful gap analysis should help management understand:
This is important because management rarely needs hundreds of individual findings.
Management needs a clearer view of what matters.
Good gap analysis helps create that view.
Gap analysis often reduces assessment costs by helping avoid unnecessary work.
Without it, organisations can easily spend significant time:
Gap analysis helps direct activity toward areas that genuinely require attention.
The result is often:
This is particularly valuable for teams operating with limited compliance resources.
Many audit findings and regulatory observations do not arise because organisations were unaware of requirements.
They arise because weaknesses were not identified early enough.
Gap analysis helps reduce that risk.
It creates an opportunity to identify:
before auditors, inspectors or regulators identify them.
That makes the assessment process more proactive and more defensible.
Gap analysis is only useful if it is applied with discipline.
Common problems include:
A useful gap analysis is selective and evidence-aware.
It should identify what appears to be missing while recognising that detailed validation may still be required later.
One of the most useful distinctions in the NORVA methodology is that each phase answers a different question.
How ready do we appear to be?
What appears to be missing?
Can management demonstrate that the controls actually operate effectively?
This distinction is important.
Many methodologies combine these activities.
Separating them helps make the assessment clearer, more structured, and easier to explain.
Gap analysis should not depend on disconnected working papers, informal observations or memory.
A practical assessment tool should help users:
This is one of the principles behind the NORVA Solutions Compliance Assessment Toolkit.
NORVA's Excel-native smart templates help users assess, document and prioritise gaps in a structured way while maintaining a clear relationship between requirements, controls, evidence and reporting.
The objective is not to replace professional judgement.
It is to help users apply judgement more consistently and document it more clearly.
Before moving from gap analysis into detailed control assessment, the team should be able to answer:
If the answer is yes, the organisation is generally in a stronger position to move into the next phase.
Gap analysis is not about creating a long list of deficiencies.
It is about creating clarity.
When done well, it helps organisations identify what appears to be missing before moving into deeper testing, evidence collection, and remediation.
That makes the assessment more focused, more proportionate and often more cost-effective.
Scope tells us what applies.
Maturity assessment tells us where we stand today.
Gap analysis tells us what appears to need attention.
Only then does it make sense to begin detailed control validation.
That sequence helps organisations answer a clearer question:
We know what applies. We understand where we stand. We know what needs attention.
That is a stronger starting point for every compliance assessment.
I hope that helps.
If it applies, assess it. If you rely on it, document your evidence.
The NORVA Solutions Compliance Assessment Toolkit is designed to help compliance teams and advisory firms identify, document and prioritise compliance gaps using structured, Excel-native smart templates.
The toolkit helps users:
Supported by editable, principle-based policies and NORVA's Assessment Runtime Engine, the toolkit helps organisations turn gap analysis into a structured, repeatable, and evidence-based process.
If your team needs a more practical way to level-set compliance status before detailed assessment begins, NORVA may be worth exploring.