Assessment Methods
Gap Assessment vs. Internal Audit: What Each Covers, What Each Proves and What You Receive
In short
Know when you need a gap assessment, when you need an internal audit, and what each one gives you.
Company names and figures are invented.
A sponsor preparing for certification and an audit committee reviewing control performance need different answers. Choose a gap assessment or internal audit by the decision its report must support, the evidence needed and the independence expected.
Working definitions
A gap assessment compares current practices with a standard, framework or internal policy and recommends how to address gaps. It is advisory. Evidence depth varies: some reviews use self-report and documents; others inspect operating records or test controls. The report should state which methods were used.
An internal audit is an assurance activity performed by, or on behalf of, the organization's own internal audit function. For most organizations the applicable professional framework is the IIA's Global Internal Audit Standards, effective 9 January 2025, which set expectations for independence, objectivity, planning, evidence and reporting.
For a management system such as ISO/IEC 27001:2022 or ISO/IEC 42001:2023, the standard itself requires internal audits at planned intervals, and ISO 19011 provides guidance on auditing management systems. The IIA Standards and ISO management-system audit guidance are not interchangeable; which one governs depends on who commissions the audit and why.
Same criteria. Different questions.
A gap assessment compares documentation and observed practices, producing a gap register and evidence needs. An internal audit inspects controls and tests selected samples, producing procedures, findings and evidence references. Both support scoped conclusions. A gap is not a tested exception, and a mapping is not framework equivalence. Neither a gap assessment nor an internal audit is certification.
Side by side
Reference table · every row is included.
| Dimension | Gap assessment | Internal audit |
|---|---|---|
| Primary question | Where are we short of the criteria, and what should we do first? | Do the controls we rely on exist and operate as intended, and can we say so with evidence? |
| Who it is for | Management, a program lead, a buyer deciding whether to pursue certification. | The board or audit committee and senior management; sometimes a regulator or parent company. |
| Criteria | Chosen by the sponsor: a standard, a framework profile or internal policy. May be partial. | Recorded in the audit plan and tied to the organization's risk assessment; expected to be complete for the audited scope. |
| Independence | Advisory; the assessor may also help remediate afterwards. | Required. The IIA Standards expect organizational independence of the function and individual objectivity; ISO 19011 expects auditors not to audit their own work. |
| Evidence depth (default) | Self-report and documents; may include inspection and testing. Check the report's methods. | Documents, inspection and testing, with sampling proportionate to the conclusion sought. |
| Conclusion | A prioritized list of gaps and recommendations. Operating-effectiveness conclusions require sufficient reliable operating evidence from inspection or testing. | Findings with condition, criteria, cause, consequence and recommendation; an overall conclusion for the scope, qualified by the evidence obtained. |
| Period covered | Point in time. | Point in time or a defined period, stated in the report. Internal audits do not universally conclude on operating effectiveness over a period; the plan says what was tested. |
| Deliverables | Gap register, prioritized roadmap, optional evidence inventory. | Audit report, working papers, management responses and action plan, follow-up tracking. |
| Typical follow-on | Remediation, then an internal audit or certification audit. | Management action tracking; input to the next risk assessment and audit plan. |
One control, two outputs
The clearest way to see the difference is to watch both engagements handle the same control. The example uses access reviews because almost every framework expects them in some form.
Reference table · every row is included.
| Step | Gap assessment output | Internal audit output |
|---|---|---|
| Evidence requested | Policy; the most recent review sign-off; a conversation with the security lead. | Policy; all four quarterly reviews in the period; the user population at each review date; ticket records for every revocation; evidence of who performed each review. |
| Evidence obtained | Policy (document); Q2 sign-off email (document); lead confirms the process runs each quarter (self-reported). | Policy; sign-offs for Q1, Q2 and Q4 only; Q3 reviewer left the company and no Q3 review record could be produced; 31 revocations identified, 26 completed within five days, 3 completed late, 2 outstanding. |
| Analysis | Control exists and appears to be designed in line with the criteria. Gap: no evidence that the review covers service accounts; policy does not define 'system owner'. | Design adequate. Operation: Q3 performance could not be established from the missing review records; this does not prove the review or revocations never happened. Of the 31 identified revocations, 26 were timely (about 84%), 3 late and 2 outstanding; the two outstanding accounts retained access for over 60 days after the review flagged them. |
| Output | Gap register entry: 'Extend access review scope to service accounts; define ownership; retain review evidence.' Priority: medium. Owner: security lead. | Finding (medium): condition, criteria, cause (reviewer departure with no evidence handover), consequence (Q3 performance unestablished; two accounts over-privileged), recommendation and management response with dates. Conclusion for the control: partially effective on the evidenced population, with Q3 performance not established. |
| What the reader can rely on | That the control is probably designed appropriately and where to improve before certification. Not that it operated. | That on the evidenced population the control operated with the stated exceptions; Q3 performance could not be established. |
Neither output is wrong. The gap assessment told management what to fix before a certification audit. The internal audit told the audit committee something the gap assessment could not: performance for Q3 could not be established, and the identified revocations included three late and two outstanding cases.
Missing Q3 records are not proof that revocation never happened. If the gap assessment had been scoped to include inspection of all four quarters, it could have identified the same evidence gap; depth follows scope, not the engagement label.
Choosing between them
Ask three questions before you commission either.
- What decision will the report support? 'Should we start a certification program and what will it take?' points to a gap assessment. 'Can the audit committee rely on these controls?' points to an internal audit.
- Who needs to trust it? If the reader is management, advisory independence is acceptable. If the reader is a board, regulator or parent, the independence expectations in the IIA Standards or ISO 19011 apply and the engagement should be commissioned accordingly.
- What operating evidence can you provide, and over what population? Inspection of reliable operating records can support operating effectiveness, alongside testing where appropriate. Without sufficient evidence for the population and period, the conclusion must be limited whatever the engagement is called.
See sample deliverables in Framework Gap Assessments and Internal Audits. Download Gap Assessment vs. Internal Audit: What Each Can and Cannot Tell You to share with a sponsor. For worked evidence requests, read ISO 42001 Internal Audit: An Evidence Request Checklist; IT Risk Assessment: From Risk Register to Control Testing shows how a risk assessment feeds the audit plan.
If you are not sure you have enough of a program to assess yet, the free AI Governance QuickScan gives a preliminary, self-reported view in about ten minutes.
Key takeaways
- A gap assessment answers 'where are we short and what first'; an internal audit answers 'do the controls operate, with evidence'.
- Check independence and evidence depth in the audit plan and report before relying on the engagement label.
- Neither engagement issues a management-system certificate or a SOC 2 report; external certification bodies and independent CPA firms respectively do so. Accredited certification adds a competence check; accreditation is not compulsory and ISO does not certify.
- Internal audits conclude only on the period and population actually tested; read the scope section before relying on a conclusion.
- Decide by the decision the report must support, who must trust it, and how much testing you can resource.
References
Primary sources cited above. Standards are referenced by number and year; their text is licensed and is paraphrased, not reproduced.
- The IIA, Global Internal Audit Standards (effective 9 January 2025) (opens in a new tab) — Independence, objectivity, evidence and reporting expectations for internal audit.
- ISO 19011, Guidelines for auditing management systems (opens in a new tab) — Licensed text; guidance on management-system audit programs and auditor competence, paraphrased.
- ISO/IEC 27001:2022, Information security management systems — Requirements (opens in a new tab) — Licensed text; internal audit requirement referenced, not reproduced.
- ISO/IEC 42001:2023, Artificial intelligence management system — Requirements (opens in a new tab) — Licensed text; internal audit requirement referenced, not reproduced.
- AICPA, 2017 Trust Services Criteria with Revised Points of Focus (2022) (opens in a new tab)
- AICPA, System and Organization Controls (SOC) suite of services (opens in a new tab) — SOC 2 reports are issued by independent CPA firms.