ISO, HACCP and GDP gap analysis in Montenegro
Identify gaps in your ISO, HACCP or GDP system. Get findings and an action plan to prioritise implementation, corrective work or preparation for an audit.
Request an initial assessment
Identify gaps in your ISO, HACCP or GDP system. Get findings and an action plan to prioritise implementation, corrective work or preparation for an audit.
Request an initial assessment
Gap analysis compares existing processes, documentation and practices with the requirements that currently apply to your ISO, HACCP or GDP system. ConsultHQ identifies actual deviations, assesses their significance and converts the findings into a prioritized action plan prior to implementation, certification audit or regulatory inspection.
The company often knows that the system is not fully ready, but does not know where the real problem is.
Then time is spent sorting out forms, while a more serious deviation in the process remains unresolved.
Gap analysis changes that order.
First, we determine what the request is asking for, what the organization already has, and where there is a real gap between the two levels.
Illustrative example: a procedure requires supplier approval, but the reviewed sample contains no approval record. The finding should identify the criterion, reviewed evidence, scope and gap. The action plan then defines an owner, action, deadline and evidence required to close the finding.
This enables management to allocate resources. Sampling and review limitations must remain clear: a gap analysis of one process does not establish compliance of the entire organisation.
For a proposal, specify the system, sites, review purpose and available documentation. Where full implementation is the goal, the results can inform an ISO 9001, ISO 14001, HACCP or GDP implementation plan.
Not every company needs new documentation.
The existing system may be mostly good, but outdated in several important areas. Another organization may have a large number of procedures, but weak application in operations.
Without an initial analysis, both companies can easily pay for much more work than they actually need.
Gap analysis provides the basis for the decision.
It shows whether you need full implementation, targeted alignment, transition to a new release of the standard, or just closure of a few findings before validation.
Standards and regulatory requirements are changing.
ISO 9001:2026 was published on 16 September 2026 and replaced the 2015 edition. ISO 14001:2026 is the current fourth edition as of April 2026.
ISO 19011:2026 now provides valid international guidelines for auditing management systems, while the 2018 edition has been withdrawn.
With the HACCP system, we also check the current European hygiene framework. Regulation (EU) 2021/382 supplemented the requirements of Regulation 852/2004, among other things through allergen management and food safety culture.
With the GDP system, we use the current CInMED requirements and the valid EU GDP guidelines 2013/C 343/01 for human medicines. CInMED published the current GDP guidelines on July 22, 2026, and during August and September 2026, it additionally updated inspection documents, GDP forms and the CAPA procedure.
This means that the gap analysis from the old checklist can give a false sense of readiness.
We tie the check to the currently valid frame.
For ISO 14001 clients with material environmental risks, the gap analysis examines serious-damage scenarios, emergency preparedness and applicable obligations under the Law on Liability for Environmental Damage as amended in 114/2026. We review preventive measures, early response and how any remediation would be documented, according to the company’s actual activities.
For ISO 14001 clients handling chemicals, the gap analysis covers applicable obligations under the Law on Chemicals 114/2026. We review the chemical inventory, safety data sheets (SDS), classification and labelling under Rulebook 136/2026, and hazardous-chemical storage under Rulebook 137/2026. The review scope depends on the company’s role and processes.
Dates of entry into force: Rulebook 136/2026 — 26 September 2026; Rulebook 137/2026 — 29 September 2026.
With the ISO system, we don't just look at whether there is a procedure.
We check whether the process meets the requirement and whether there is sufficient evidence that the system actually works.
For ISO 9001 this may include processes, responsibilities, risks, objectives, suppliers, non-conformities, internal audits and management reviews.
With ISO 14001, the focus expands to environmental aspects, compliance obligations, objectives, operational controls and environmental performance.
If the company already has a certified system according to the previous edition, we can focus the gap analysis only on the transition.
That way we don't review everything from the beginning unnecessarily.
For relevant ISO 14001 clients, our gap analysis checks the Waste Management Law 34/2024 as amended by 128/2026: whether EPR applies to products placed on the market, whether packaging and waste data are reliable, whether operators are authorised and whether the waste-management plan follows significant operational changes.
In an ISO 14001 gap analysis, we first determine whether the activity or installation is covered by the Climate Change Law 149/2025 as amended by 70/2026 and Regulation 116/2026. Only where applicable do we check the GHG permit, approved monitoring plan, responsibilities and the audit trail for reporting data. We assess corporate carbon footprints and customer requests separately from statutory duties.
For ISO 14001 clients planning a new or expanded project, a gap analysis may check EIA status under the current law as amended by 70/2026 and Regulation 85/2026. Where EIA decisions or approvals already exist, we check whether their conditions have been carried into obligations, responsibilities and operational controls. This review is not automatic for businesses without a relevant project.
For an industrial ISO 14001 gap review, we check whether the activity and capacity fall within Regulation 75/2026, the status of any integrated permit, and whether applicable BAT conclusions, emission limits and monitoring have been put into practice. We assess the thresholds for the specific installation; not every ISO 14001 business needs an integrated permit. See our guide to integrated permits for industrial installations.
For ISO 14001 clients with emission sources, a gap review under Law 117/2026 and Correction 120/2026 checks the stationary-source inventory, permits or another applicable regime, measurement plans and results, records, deadlines and plant modifications. The actual activity determines the scope. See the Air Protection Law guide.
For an ISO 14001 investment gap review at a sensitive location, we check whether Nature Protection Law 117/2026 applies, the protected-area and ecological-network status, and relevant biodiversity conditions. This review is not added to clients with no relevant impact. See the Nature Protection Law guide.
For innovative-food manufacturers, an HACCP gap review may include the approval of new ingredients and their regulatory status under Regulation 126/2026 and List 127/2026. We do not add this review to products using ordinary ingredients without a relevant novel-food question. See our novel-food guide.
For fortified-food manufacturers, a targeted gap review covers recipes, vitamin and mineral premixes, precise chemical forms and supplier specifications under Regulation 47/2026. We check the ingredients actually added to the product. See our guide to vitamins and minerals.
For relevant food clients, the gap analysis checks activity-specific temperature rules for quick-frozen food, particularly the Rulebook on Temperature Monitoring in Transport and Storage (Official Gazette 122/2026). We review which vehicles and spaces are covered, measuring instruments, record availability and handling of deviations.
For food manufacturers using additives, the gap analysis covers approved recipes, product categories, the regulatory status and specifications of additives, supplier documentation and permitted levels under Regulation 112/2026 and Rulebook 122/2026. We compare these with actual production and the product label.
For food manufacturers, a gap analysis also covers packaging that contacts the product: we review its intended use, relevant specifications, supplier documentation and declarations of compliance where required. This is linked to risk assessment and supplier approval, rather than a universal list of “packaging certificates”.
Under the Food Hygiene Regulation (91/2026), a HACCP gap analysis also checks evidence of food safety culture, management responsibilities, allergen controls and staff training, proportionate to the business and facility.
A HACCP system can look good on paper and yet have a serious operational problem.
That's why we don't end the review with a HACCP plan.
We assess HACCP gaps against the Law on Food Safety (59/2026), the Law on Official Controls (72/2026) and the secondary rules applicable to the business. We review actual processes, relevant hygiene prerequisites, staff responsibilities, records and responses to deviations.
For restaurants and hotels, this can include reception, storage, kitchen flows, temperatures, allergens and training.
For food manufacturers, the gap analysis also checks microbiological criteria (84/2026), lot marking and traceability (58/2026), additional traceability for food of animal origin where applicable, and relevant contaminants (98/2026). Findings are linked to the HACCP plan, laboratory results, non-conforming products and recall.
In particular, we check whether the documentation follows the current process.
HACCP that describes old equipment, recipe or production schedule is no longer a reliable basis.
GDP gap-analysis criteria include the current Law on Medicines (Official Gazette Nos. 14/26 and 94/26), CInMED GDP guidelines published on 22 July 2026 and the applicable European GDP framework. We specifically review the authorisation, responsible person, quality system, partners, transport, traceability, CAPA and current CInMED forms.
With a GDP system, the difference between formal and actual compliance can be particularly costly.
CInMED requires that drug wholesalers act according to GDP guidelines and issues a GDP certificate after checking the prescribed conditions. The Institute currently uses a special CAPA procedure after GDP inspection.
That's why GDP gap analysis can include the quality system, responsible person, SOP documentation, suppliers, customers, storage, temperature control, transportation, deviations, CAPA, change control, returns and withdrawals.
We focus on what can affect the quality and integrity of the medicine.
No to cosmetic changes to the documentation that do not change the actual level of control.
One of the most important questions of the gap analysis is: does the company work as it wrote?
If the procedure says that a certain control is performed by one function, but in practice it is performed by another, there is a discrepancy.
If the form exists, but the employee only fills it in afterwards, there is another type of problem.
Such deviations are often not visible from an office review of the documentation.
That's why, where relevant, we include a conversation with employees and an overview of the actual process.
This gives a much more reliable picture of readiness.
Two non-conformances can look the same on the list, but have completely different significance.
An outdated document label does not have the same risk as an uncontrolled critical point in a HACCP system or a GDP temperature deviation without product evaluation.
That's why we don't deliver findings as a long list without context.
We assess their impact and determine the order of work.
What carries the greatest regulatory, qualitative or operational risk should be addressed first.
Only then come minor improvements.
These two services have similarities but different purpose.
Gap analysis most often answers the question: what is missing to reach the required level?
Internal audit checks the established system according to the defined criteria and audit program.
ISO 19011:2026 provides international guidelines for auditing principles, management of audit programs and implementation of management system audits.
That's why gap analysis often comes before full implementation or transition.
An internal audit makes more sense when the system is already in place and we want to check its compliance and effectiveness before an external audit.
A company that is just introducing ISO, HACCP or GDP often does not know how much work is really needed.
Without analysis, it is easy to define too big a project.
Gap analysis provides a realistic starting point.
After it, we can clearly separate what already exists from what needs to be developed.
This enables a more precise scope of implementation, less unnecessary documentation and a better assessment of priorities.
Another common scenario is a company that already has a system.
A certification audit, inspection or important customer request is approaching, but management is not sure how ready the system is.
Then the gap analysis serves as a pre-audit review.
We identify areas that may create a problem and define what needs to be completed before external verification.
We cannot guarantee the result of an independent audit or regulatory inspection.
We can reduce the chance that an obvious discrepancy is first discovered during that check.
Changing the ISO release does not automatically mean that the company has to build the system again.
ISO 9001:2026 maintains the existing foundation of the quality system with targeted changes, including greater emphasis on quality culture, leadership and a clearer separation of risks and opportunities.
ISO 14001:2026 also builds on the previous framework and improves clarity and integration with other systems.
Transition gap analysis therefore answers a very specific question:
What of the existing system remains good, and what needs to be changed for the new edition?
This is much more efficient than rewriting the entire documentation.
Gap analysis is not a universal checklist package.
The scope can include a single location, the entire company, or just a specific problem area.
A typical engagement may include:
In the case of regulated sectors, we also check the relevant current regulatory documents.
Thus, the finding remains tied to what the company actually has to fulfill.
The client should not only receive a comment that something is "not compliant".
The result should enable a decision to be made.
After the analysis, you get an overview of the current situation, identified deviations and priorities for further activities.
We clearly separate what is already working from what needs correction.
Where possible, we also define a logical next step: change of documentation, training, technical correction, implementation of new control or internal verification after closing the findings.
Thus gap analysis becomes the basis of the project.
Not another report that stays in a folder.
One of the frequent mistakes in gap analysis is converting each finding into a new document.
That is not our goal.
If the existing procedure meets the requirement and employees use it, there is no reason to change it just because of a different format.
We suggest correction when there is a real gap.
It can be a documentation deficiency, but it can also be a process, responsibility, training or technical control.
Such an approach also reduces the cost of implementation after the analysis.
A single location with several processes is not the same project as a manufacturing company with multiple plants.
The scope is influenced by the number of standards, location, employees, existing documentation and the reason for which the analysis is created.
That's why we don't determine the duration just by the name of the standard.
First we define the scope.
If the goal is an ISO 9001 transition gap analysis, there is no need to review an unrelated HACCP system in detail.
If wholesale is preparing for GDP verification, we focus on GDP processes that affect regulatory readiness.
The least valuable is the analysis done just to get another report for the company.
It provides the greatest value when deciding what to do next.
Is the system good enough for an internal audit?
Should we change the documentation first? Is there a critical gap before the certification audit or CInMED inspection?
That's why ConsultHQ ends the gap analysis with clear priorities and the next step.
We can then support the closure of the findings, the complete implementation or the preparation of the system for the next check.
ConsultHQ also provides GDPR gap analyses to prepare organisations for data protection compliance.
An initial assessment helps us define scope and next steps based on your actual business.
Request an initial assessment