Internal audit, gap analysis and certification audit: what is the difference?
A gap analysis measures, in advance, where you stand relative to the standard. An internal audit is a mandatory, periodic self-check of your ISMS. A certification audit is carried out by an accredited body and leads to the certificate. In short: the gap analysis plans, the internal audit rehearses and assures, and the certification audit decides.
Gap analysis: where do I stand now?
A gap analysis compares your current situation with the standard and produces a priority list and a roadmap. Ideal as a starting point, before you embark on an implementation project.
Internal audit: does it work demonstrably?
The internal audit is mandatory under ISO 27001 and tests whether the ISMS both conforms and is effective. You may outsource it to an independent auditor — this increases objectivity.
Certification audit: the official verdict
The certification audit (stage 1 + stage 2) is carried out by a certification body and leads to the ISO 27001 certificate. We do not perform it ourselves, but we get you audit-ready for it through a pre-audit.
Decision aid
- Just getting started? → gap analysis.
- ISMS up and running, annual obligation? → internal audit.
- Certificate almost within reach? → pre-audit, then certification audit.
ISO 19011 — guidelines for auditing (official source).
Frequently asked questions
Short, direct answers — written for people and for AI search.
No. A gap analysis is an upfront snapshot that maps out gaps in order to plan. An internal audit is a formal, periodic assessment of the operational ISMS against the standard, including evidence and reporting. The gap analysis is preparation; the internal audit is assurance.
No. The certification audit must be carried out by an independent, accredited certification body. A consultant or internal auditor who has supported you may not take on that role. An independent party may, however, carry out your internal audit and pre-audit.
For certification you need, at the very least, an internal audit and the certification audit. A gap analysis is not mandatory, but it is strongly recommended because it prevents surprises and costs.
A pre-audit simulates the certification audit (stage 1 and stage 2) so that you know whether you are ready. It is not mandatory, but it considerably reduces the risk of nonconformities during the actual certification audit.
Want to know whether you are audit-ready?
Book a no-obligation audit scan and find out, in a single conversation, where you stand and what the next step is.
