GAP ANALYSIS & COMPLIANCE ASSESSMENT · Aero Support Group FZCO · Updated 22 October 2026
What a gap analysis should answer
A useful gap analysis answers four questions for each applicable requirement:
- What does the requirement ask for, at the edition that will be audited?
- Where does the organisation’s documentation address it, at the level of a specific procedure?
- Is the procedure implemented, and is there evidence that it works?
- If not, why not: is the cause in governance, resources, process ownership or oversight?
Most gap reports stop at the first two questions. They confirm that a manual paragraph exists and miss the fact that nobody follows it. Auditors look for implementation, so the analysis has to look there too.
Frameworks we assess against
- IOSA: the IOSA Standards Manual (ISM), currently Edition 18, across the eight sections ORG, FLT, DSP, MNT, CAB, GRH, CGO and SEC, with the Edition 19 changes for audits from 2027.
- ISAGO: the GOSARPs in the ISAGO Standards Manual for headquarters and stations, together with the IATA Operational Portal gap analysis against IGOM, AHM and ICHM.
- EASA: Regulation (EU) No 965/2012 for air operators (including the management system under ORO.GEN.200), Part-145 and Part-CAMO under Regulation (EU) No 1321/2014, Part-TCO and Part-IS.
- UK CAA: the UK versions of the same regulations, including UK Part-TCO.
- FAA: 14 CFR Part 145 for repair stations.
- ICAO: Annex 19 safety management provisions for service providers, and USOAP protocol questions for civil aviation authorities.
Our method
1. Requirement baseline. We extract every applicable requirement at the edition that will be audited and record its applicability, with a justification for anything marked not applicable.
2. Documentation mapping. Each requirement is mapped to the specific procedure that addresses it. A reference to a whole chapter is treated as a gap, because an auditor will treat it the same way.
3. Implementation check. We sample records, interview the people who do the work and observe operations where possible. Documentation that exists but is not followed is recorded as a gap.
4. Root cause. For each gap we identify why it exists at system level: unclear process ownership, missing resources, weak oversight, or a manual written for a different organisation.
5. Prioritised plan. Gaps are ranked by safety significance and audit exposure, and grouped by root cause so that one corrective action can close several findings.
Types of engagement
- Full pre-audit gap analysis across all applicable sections or disciplines, before an initial or renewal audit.
- Targeted analysis of one area, for example the IOSA MNT section, an ISAGO station, or the Part-145 management system.
- Multi-framework analysis for organisations under several regimes, such as IOSA and EASA, or ISAGO and a national authority, so that overlapping requirements are handled once.
- Edition change analysis when a standard is revised, such as ISM Edition 19 or Annex 19 Amendment 2, to show what has to change and by when.
Deliverables
- A gap register, normally in Excel, with one row per requirement: reference, applicability, documentation reference, implementation status, evidence examined, root cause and recommended action.
- A management report summarising the significant gaps, their causes and the effort needed to close them.
- A corrective action roadmap, sequenced against the audit date.
- Where requested, an evidence request list for the next stage of preparation.
The register is built so that it can become the organisation’s compliance monitoring tool after the engagement, rather than a one-off report.
Conclusion
A gap analysis is only as good as its evidence and its explanation of why gaps exist. When it traces each gap to a cause the organisation can fix, the corrective action plan that follows is shorter and the audit holds fewer surprises. ASG builds gap analyses that management can act on and auditors can follow.
Frequently asked questions
It depends on the framework, the number of sections or stations and how quickly documents and people are available. A single IOSA section or ISAGO station takes far less time than a full multi-framework assessment. We agree the scope and schedule before we start.
Documentation review and many interviews can be done remotely. Checking implementation usually needs some on-site observation, so most engagements combine remote review with one or more site visits.
The manuals and procedures in scope, the organisational chart, previous audit reports and corrective action plans, training records, and samples of operational records. We send a tailored request list at the start.
It shows where the organisation stands against the standard at the time of the review. A mock audit closer to the audit date then tests whether the corrective actions have worked.
The gaps feed a corrective action plan with owners, dates and the evidence each action must produce. ASG can support implementation, internal verification and a mock audit before the official one.
Key takeaways
- A gap analysis checks implementation and evidence, not just whether a manual paragraph exists
- Each gap should be traced to its systemic cause
- Chapter-level references are treated as gaps
- Gaps are ranked by safety significance and audit exposure
- The gap register can become the organisation's ongoing compliance tool
Preparing for an audit?
Tell us which standard and which audit date. ASG will scope a gap analysis that shows where you stand and what to fix first.