Pre-Assessment Audits: Gap Analysis Before Certification

A pre-assessment audit shows how far an organisation's existing arrangements meet a management system standard before the certification audit begins, and itmad provides pre-assessment audits and gap analysis with local auditors and a travelling team. A pre-assessment is diagnostic and not corrective: itmad reports what is missing and does not design the solution. itmad operates across the Middle East, Asia and Europe. Last reviewed: October 2026.

Why do a pre-assessment

A pre-assessment is optional, but organisations that skip one often should not have. A major non-conformity at Stage 2 stops the certification decision, and closing it means corrective action, evidence that the action worked and, in some cases, a return visit.

What the review looks at

The review checks whether the policies, procedures and records that the standard requires exist, and whether they describe what the organisation actually does and not what a template said. It tests whether the documented arrangements are applied on site, which is where most gaps appear: the system exists on paper and stops at the office door. Auditors talk to the people responsible for each process, because arrangements that nobody can describe will not survive a certification audit.

The review also tests whether the intended certification scope is accurate, achievable and wide enough to cover what clients will expect, and whether the system has run long enough to produce the evidence that a certification auditor will ask for: internal audits, management review and corrective actions closed out. The result is a clause-by-clause gap report that shows, for each relevant clause, what is in place, what is missing, and roughly how much effort closing the gap will take.

Findings that delay certification most

Three gaps account for most delayed certifications, and all three are avoidable. Internal audits have not yet been carried out, or were carried out by people auditing their own work. Management review has not yet been held, or was held without the inputs the standard requires and with no decisions recorded. And the system was put in place too recently to have produced evidence, because certification auditors need to see it operating over time, not a folder assembled the week before.

Diagnostic, not corrective

itmad is a certification body, so a pre-assessment reports what is missing without designing the solution. It does not recommend how to structure procedures and it does not write anything for the organisation. ISO/IEC 17021-1 prohibits a certification body from consulting on the system that it certifies, and that restriction is what allows the same body to carry out both the pre-assessment and the certification audit without compromising the certification decision.

Organisations sometimes find the restriction frustrating. The alternative is worse: a certification body that helps to build a system and then certifies it has issued a certificate that means nothing to the client who asked for it.

When to commission one

A pre-assessment helps ahead of a first certification, where nobody in the organisation has been through the process; before a transition to a revised edition of a standard; where an earlier certification audit produced major non-conformities; after a significant organisational change such as new sites, acquisitions or a changed scope; where certification is tied to a contract award date that cannot slip; and before adding a standard to an existing certified system.

Getting the timing right

Done too early, a pre-assessment finds gaps in a system that is still being built, which reveals little. Done too late, it leaves no time to act on the findings. The useful window opens once the system is implemented and has run long enough to produce records, and leaves enough time to close what is found: typically two to three months before the certification audit, and longer where internal audits and management review have not yet been held.

Standards covered

Pre-assessment is available against the standards that itmad audits, including ISO 9001, ISO 14001, ISO 45001, ISO 22000 and HACCP, ISO 27001, ISO 22301, ISO 50001, ISO 37001 and ISO 22716, and for integrated systems that cover more than one standard at once.

Frequently asked questions

What is a pre-assessment audit?

A pre-assessment audit shows how far an organisation's existing arrangements meet a management system standard before the certification audit begins. It produces a gap report showing what is in place, what is missing and the effort needed to close each gap.

Is a pre-assessment audit mandatory?

No, but skipping one is often a mistake. A major non-conformity at Stage 2 stops the certification decision, and closing it means corrective action, evidence of effectiveness and sometimes a return visit.

When should a pre-assessment take place?

Once the system is implemented and has run long enough to produce records, with enough time left to close what is found. That is typically two to three months before the certification audit, and longer where internal audits and management review have not yet been held.

Does a pre-assessment design the solution?

No. It reports what is missing and does not design the solution, recommend how to structure procedures or write anything for the organisation. ISO/IEC 17021-1 prohibits a certification body from consulting on the system that it certifies.

What do pre-assessments find most often?

Internal audits not yet carried out or done by people auditing their own work, management review not yet held or held without the required inputs and decisions, and a system too recently implemented to have produced evidence. All three are avoidable.

Which standards can be pre-assessed?

Those that itmad audits, including ISO 9001, ISO 14001, ISO 45001, ISO 22000 and HACCP, ISO 27001, ISO 22301, ISO 50001, ISO 37001 and ISO 22716. Integrated systems that cover more than one standard can be pre-assessed together.