ISO 13485 Gap Assessment Workbook (Excel)

By Ishan Maharaj, Founder and Principal Consultant. Last reviewed 26 October 2026.

See the Gap Assessment Workbook ($49) or download the free Gap Assessment Lite

What is in the workbook?

It is part of the Starter Kit ($249) and the Complete QMS Kit ($449). The workbook does not reproduce the standard, so you need your own licensed copy of ISO 13485:2016.

How do I run the assessment?

1. Work down the Gap Assessment tab and look for the evidence listed in each row.
2. Choose a status for every requirement and note what you found, with a document or record reference.
3. Read the dashboard to see which clauses carry the most gaps.
4. Give each gap an action, owner, priority and due date.
5. Re-run the assessment before your certification or surveillance audit.

Which areas usually need the most evidence?

Product-related evidence takes longest to produce, so start there. Two examples:

• Design and development (clause 7.3). Look for a plan, inputs, outputs, review records, verification and validation, transfer, change control and a design and development file for each device type or family. Our design controls and DHF page lists the subclauses.
• Process validation (clause 7.5.6). Any production or service process whose output cannot be, or is not, verified by later monitoring or measurement must be validated, and software used in production validated in proportion to risk. See the clause 7.5.6 hub.

Other areas worth checking first are CAPA, quality manual and document control and internal audit.

Worked example: a five-person startup

A five-person company plans to submit its first device for certification in nine months. It scores the 71 rows in two sessions. The dashboard shows most gaps concentrated in design controls and process validation, while document control and training are largely in place. The action plan sequences work: finish the design and development file for the first device, validate the one process whose output cannot be fully inspected, then rerun the assessment and book a remote internal audit. The figures are illustrative; your own dashboard will differ.

When should I get expert help instead?

• Your audit date is within three months and gaps are widespread.
• You have open nonconformities from a previous audit. See audit findings recovery.
• Nobody can own the assessment. A remote internal audit starts from $1,250 on the consulting page.

For certification audit days and costs, see ISO 13485 certification cost for a small company. The roadmap after you download is in the first-time implementation roadmap.

Does the gap assessment cover EU and US requirements?

It assesses ISO 13485:2016. The EU harmonised standard EN ISO 13485:2016/A11:2021 appears in the Commission's list of harmonised standards for Regulation (EU) 2017/745. In the US, FDA's QMSR incorporates ISO 13485:2016 by reference from 2 February 2026, with a few supplemental requirements. The mapping table on the Complete QMS Kit page shows where they line up.

Frequently asked questions

How long does a gap assessment take?

It depends on how much evidence you need to find. Many teams complete a first pass in a few working sessions; expect longer if records are spread across several locations.

Is a gap assessment the same as an internal audit?

No. A gap assessment checks whether the system meets the requirements on paper and in outline. An internal audit samples records to check the system is operating. Use the Internal Audit Kit for the second.

Can I use it for a surveillance audit?

Yes. Re-run it before the audit to find drift since your last assessment.

Does it guarantee certification?

No. It finds gaps. The certification body makes the decision.

Sources

• BSI, Validation and verification webinar (clauses 7.3 and 7.5.6)
• Commission Implementing Decision (EU) 2021/1182, as amended (harmonised standards for Regulation (EU) 2017/745)
• FDA, Quality Management System Regulation (QMSR)
• ISO, ISO 13485:2016