Normable Consulting
New: ISO 9001:2026 and ISO 14001:2026 transition gap analysis

Find the gaps before your certification auditor does.

Independent gap analysis and internal audit for ISO 9001, ISO 14001, ISO 45001, ISO 50001, ISO/IEC 27001 and TISAX. Done entirely remotely, with graded findings and an action plan you can start on the next day.

Request a scoping call See how a remote audit works
  • Fully remote, in English or Bulgarian
  • Fixed price, quoted after a free 30-minute call
  • Findings graded the way a certification body grades them
Working paperSample finding
Requirement
ISO 9001, 8.4 Control of externally provided processes, products and services
What was found
14 approved suppliers are listed. Selection and re-evaluation criteria are not defined, and 9 suppliers have no evaluation record.
Grade
Minor nonconformity
Action
Define the criteria, evaluate the nine open suppliers and record the outcome.

Illustrative sample. It is not taken from a real client.

100%

Remote, in any time zone

6

Standards, one auditor from first call to debrief

30 min

Free scoping call, then a fixed price

2 days

At most to hear back, counted in business days

Two ways to see where you stand

A gap analysis tells you how far you are from a standard. An internal audit tells you whether the system you have conforms and works. Most organisations need both, at different moments.

Gap analysis

Where you stand against the standard, and what to fix first.

I compare your current system with every requirement, using your documents, your records and conversations with the people who run the processes. You get a clear picture and a plan in an order that makes sense.

  • Clause-by-clause assessment: met, partly met or gap
  • Findings with the evidence behind them and the clause or control they relate to
  • Prioritised action plan, sequenced by effort and risk
  • A view of what a certification body is likely to raise
  • A debrief call and a round of follow-up questions

Best when you are building a system, planning a first certification, moving to a new edition of a standard or adding a second one.

Internal audit

The independent audit your standard requires.

ISO management system standards require internal audits at planned intervals, carried out objectively. In a small team nobody can audit their own work. I audit the system against the standard and your own procedures, and sample records to see whether controls really operate.

  • Audit programme and audit plan agreed with you
  • Audit report with findings graded major, minor or opportunity for improvement
  • Evidence reference for every finding
  • Input for your management review
  • Review of your corrective actions, so findings are closed with evidence

Best when you are heading for a Stage 2 audit, surveillance or recertification and need the internal audit on record.

Which one do you need?

AspectGap analysisInternal audit
Question it answersHow far are we from the standard?Does our system conform, and does it work?
Typical momentBefore you build or certifyOnce the system runs, then every year
EvidenceDocuments and conversationsRecords sampled, processes observed, people interviewed
OutputGap list and action planGraded findings and an audit report
Counts as the internal audit the standard requiresNoYes

Evidence, not opinion

Every finding rests on a record, a sample or a conversation. This is what I usually ask to see.

  • Risk registers
  • Access reviews
  • Supplier files
  • Change tickets
  • Training records
  • Incident logs
  • Backup restore tests
  • Calibration records
  • Legal registers
  • Management review minutes
  • Corrective action logs
  • Asset registers

The difference you will notice

An audit should leave you with fewer questions, not more paper.

The usual approach

  • Auditors on site, with travel and hosting to arrange
  • A long report that arrives weeks after the visit
  • Findings listed without a priority
  • The same checklist for every client
  • Hourly billing that grows as the work does

With Normable

  • Fully remote, scheduled in your working hours
  • Graded findings and an action plan, with a debrief call
  • Every finding ranked by risk and effort
  • Samples chosen for your processes and your risks
  • A fixed price, agreed before the work starts

Six standards, one auditor

Open a standard to see what I check, the gaps that come up most often, and where it fits.

ISO 9001Quality management: consistent products and services, and customers who stay.

What I check

  • Process approach and how processes interact
  • Risks and opportunities, and how they drive decisions
  • Customer requirements, design and development
  • Control of suppliers and of nonconforming outputs
  • Internal audit, management review and corrective action

Gaps that come up often

  • Processes are defined but not measured
  • Risks are listed once and never reviewed
  • Suppliers are approved without criteria
  • Management review is missing required inputs

Moving to the 2026 edition? A transition gap analysis shows what changes for you. Certificates issued to the 2015 edition stay valid during the three-year transition, until September 2029.

ISO 14001Environmental management: control of impact and legal compliance.

What I check

  • Environmental aspects and impacts, and which are significant
  • Compliance obligations and how you evaluate them
  • Operational control, including contractors and suppliers
  • Emergency preparedness and response
  • Monitoring, objectives and performance

Gaps that come up often

  • The aspects register is not connected to daily operations
  • The legal register is out of date
  • Emergency plans have never been exercised
  • Compliance is assumed, not evaluated

Moving to the 2026 edition? A transition gap analysis shows what changes for you. Certificates issued to the 2015 edition stay valid during the three-year transition, until April 2029.

ISO 45001Occupational health and safety: fewer incidents, and workers who are part of the system.

What I check

  • Consultation and participation of workers
  • Hazard identification and risk assessment
  • Hierarchy of controls, not just protective equipment
  • Contractors, incident investigation and legal requirements
  • Emergency preparedness

Gaps that come up often

  • Consultation exists on paper only
  • Near misses are not reported
  • Risk assessments are not updated after changes
  • Contractors sit outside the system
ISO 50001Energy management: lower energy use that you can prove.

What I check

  • Energy review and significant energy uses
  • Energy baseline and performance indicators
  • Objectives, targets and action plans
  • Measurement plan and data quality
  • Energy performance in design and purchasing

Gaps that come up often

  • The baseline is not adjusted for the variables that matter
  • Indicators are not tied to significant energy uses
  • Too little sub-metering
  • Improvement is claimed but not demonstrated
ISO/IEC 27001Information security: customers and partners who trust how you handle information.

What I check

  • Scope, context and interested parties
  • Risk assessment and risk treatment
  • The Statement of Applicability and the Annex A controls
  • Internal audit and management review
  • Evidence that controls actually operate

Gaps that come up often

  • Generic risk assessment that does not reflect the business
  • Statement of Applicability justified in a single line
  • Controls exist but leave no record
  • Backups never restored, access reviews never run

A customer asking for evidence of information security? A gap analysis shows how far you are and how long the road is. If you already hold ISO/IEC 27001, much of the groundwork for TISAX carries over.

TISAXAutomotive information security: the assessment carmakers ask suppliers for.

What I check

  • Scope and assessment objectives
  • Every control in the VDA ISA catalogue, scored by maturity level against your target
  • Supplier and third-party management
  • Physical security and prototype protection, where relevant
  • Data protection requirements, where relevant

Gaps that come up often

  • Scope set too wide or too narrow
  • Maturity claimed without evidence
  • No security requirements in supplier agreements
  • Weak physical protection of sites and prototypes

I prepare you for the assessment; I do not carry it out. The official TISAX assessment is performed by an audit provider approved by the ENX Association, and I do not issue TISAX labels. Most of the groundwork can be checked remotely; physical areas may need a live video walkthrough.

Holding more than one standard? ISO 9001, 14001, 45001, 50001 and 27001 share the same management system structure. One integrated audit covers context, leadership, risk, internal audit, management review and corrective action once, instead of five times.

How a remote engagement runs

Everything happens by video call and shared evidence. You do not need to host anyone, and nobody travels.

  1. Scoping call

    A free 30-minute video call. We agree the standards, scope, locations, people involved and timeline. You receive a fixed price in writing afterwards.

  2. Document and evidence review

    You share policies, procedures and registers. I prefer read-only access to your own systems under a named account; a secure link also works. An NDA is signed before anything is shared.

  3. Interviews and walkthroughs

    Video sessions of 45 to 60 minutes with the people who run the processes. You share your screen to show live records, tickets and settings, and I choose the samples. Physical areas are shown on a live video walkthrough.

  4. Report and debrief

    You receive a graded report and an action plan, then a debrief call and one round of follow-up questions. For an internal audit, I review your corrective actions once you have written them.

Independent, confidential, and straight about limits

Audit and build stay separate

I do not audit controls I helped design. If you ask for help closing gaps, we agree that scope in writing, and the work I touched is audited by someone else the next time.

Your material stays yours

An NDA and data-processing terms come first. Access runs through a named account, without subcontractors. When the work ends your files are deleted, apart from the final report, which I keep encrypted for a limited time.

No promises I cannot keep

A gap analysis or an internal audit is not a certification, and it does not guarantee one. Accredited certification bodies make that decision. I tell you where you stand, including when it is not good news.

When people call me

A first certification is coming up
A gap analysis shows what to fix. An internal audit before Stage 1 or Stage 2 shows that the system runs.
Stage 2 is a few weeks away
A focused internal audit of the areas the certification auditor will look at, with time left to fix what turns up.
Surveillance or recertification
The annual internal audit, done independently, with your corrective actions reviewed and closed.
Nobody on the team can audit it
Small teams cannot audit their own work. I act as your independent internal auditor.
A customer wants evidence
ISO/IEC 27001 or TISAX is demanded by a customer or carmaker. A gap analysis shows how far you are and how long it will take.
You run several standards
One integrated audit covers the shared requirements once, then goes deep on each standard.

Questions people ask

Not here? Ask in the form below and I will answer by email.

Is a remote internal audit acceptable?

Yes. The standards require internal audits to be planned, objective and evidenced. They do not require the auditor to be on site. A remote audit works well when you can show live records and systems. Where something needs a physical look, we use live video, and the report says what could not be verified.

Will this get us certified?

It prepares you, but it does not certify you and cannot guarantee a result. I am not a certification body. Certification decisions are made by accredited certification bodies.

Can you also write our procedures and fix the findings?

I can help close gaps, but I keep it separate from auditing. If I help build part of your system, we agree that scope in writing, and I do not audit those controls afterwards. For an internal audit, the usual route is that you write the corrective actions and I review them.

How do you handle our confidential information?

An NDA and data-processing terms are signed before anything is shared. I work through a named, read-only account with multi-factor authentication where possible, I use no subcontractors, and I delete your material when the engagement ends. The final report is the only thing I keep, encrypted, for a limited period.

What do you need to get started?

A named contact, your scope statement and key documents, three to six people for sessions of 45 to 60 minutes, and a way to see live records, either read-only access or screen sharing. The scoping call confirms the details.

How is the work priced?

As a fixed price per engagement, quoted in writing after the scoping call. It depends on the size of your organisation, the number of standards and the scope. There is no hourly meter running.

Which languages and time zones do you work in?

English or Bulgarian, for sessions and reports. I work from Bulgaria (Eastern European Time), so most of Europe is easy to schedule, and other time zones can be arranged. Sessions are held in your working hours.

Can you audit against several standards in one go?

Yes. ISO 9001, 14001, 45001, 50001 and 27001 share the same management system structure, so the common requirements are audited once. Each standard then gets its own deep dive. TISAX uses a different catalogue, but overlaps with ISO/IEC 27001, so it can sit alongside.

Tell me what you are working towards

Say which standards, how big your organisation is and when you would like to start. I reply within two business days, usually with a time for the 30-minute scoping call.

Which standards? Pick all that apply
What do you need?
No newsletters. I only use your details to reply.
Privacy notice

Who is responsible

Aria-M Ltd, trading as Normable Consulting. UIC 208476170, 6 Port Artur Str., 4004 Plovdiv, Bulgaria. Contact: contact@normableconsult.com.

What I collect

Only what you type into the enquiry form: your name, work email, company, the standards and service you choose, organisation size, start date and your message. This site sets no cookies and runs no analytics or advertising trackers. Its fonts are served from the site itself.

Why, and on what legal basis

To reply to your enquiry and prepare a proposal. The basis is taking steps at your request before a contract (Article 6(1)(b) GDPR), or my legitimate interest in answering business enquiries (Article 6(1)(f)).

Who receives it

The form is passed to my mailbox by FormSubmit (formsubmit.co), a form-to-email service. My mailbox is provided by GoDaddy (Professional Email). FormSubmit does not publish where it operates, so a transfer outside the European Economic Area is possible. If that concerns you, email me directly instead of using the form.

How long I keep it

Up to 12 months if we do not work together. If we do, for the engagement and for as long as the law requires, for example for accounting records.

Your rights

You can ask to see, correct, delete or restrict your data, object to its use, or ask for a copy. You can also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the authority in your own country.

Last updated November 2026.