What an ISO 45003 Gap Analysis Actually Involves
A charterer sends through a pre-qualification questionnaire. Question 34 asks how the organisation identifies and controls psychosocial hazards. The HSE manager knows there is an employee assistance line, a toolbox talk on mental health, and a wellbeing week in October. None of that answers the question, because the question is about a management system, not a set of activities.
This is the point at which most organisations start looking for an ISO 45003 gap analysis. The term gets used loosely, and the certification bodies that sell one tend to describe the commercial process rather than the work. Here is what the exercise actually involves.
It is not an audit, and there is nothing to certify
ISO 45003 is a guidance standard. It sits alongside ISO 45001 and applies the same management logic to psychological health, but it carries no requirements clauses, which means no body can certify an organisation against it. Any provider offering ISO 45003 certification is selling something the standard does not support.
A gap analysis is a point-in-time comparison. It sets current practice against the guidance and produces a documented picture of the distance between them. That distance is the useful output. It is not a compliance verdict, and it will not survive being presented as one.
The distinction matters commercially as well as technically. An organisation can say it has completed an ISO 45003 gap analysis and is working to an aligned roadmap. Saying it is ISO 45003 compliant invites an obvious question from anyone who knows the standard.
What gets measured
The assessment works across six domains, each mapped to a clause of the standard.
Domain | ISO 45003 clause | What it examines |
|---|---|---|
Leadership and Culture | Clause 5 | Visible senior commitment, governance, assigned responsibilities, worker participation |
Work Design and Demands | Clause 6 | Systematic hazard identification, workload, autonomy, role clarity, controls at source |
Support and Resources | Clause 7 | Support access in practice rather than on paper, manager capability, return to work |
Operational Risk Factors | Clause 8 | Fatigue and shift work, remote and isolated work, aggression, traumatic incidents |
Monitoring and Performance Evaluation | Clause 9 | Leading and lagging indicators, board reporting, internal audit, findings driving action |
Improvement and Maturity | Clause 10 | Systemic root cause analysis, improvement plans with owners and dates, feedback loops |
Domain four is where high-risk operations usually separate from the general corporate field. An office employer answering questions about traumatic incident response is describing an edge case. A shipping company, a mine site, or an offshore operator is describing something that happens, and the quality of the answer tends to be the difference between a system and a folder.
Each domain scores from 0 to 100 and lands in one of five maturity bands: Critical, Inactive, Reactive, Active, or Proactive. Most operations that have never looked at psychosocial risk systematically come out Reactive. Something exists in every domain, but it is incomplete and unevenly applied, and nobody can demonstrate that findings led to action.
What it produces
Four things, and the first is the least important.
A maturity score and band, by domain and overall. This is the number that goes on a slide, and it is useful mainly as a baseline to measure against later.
A gaps table. Each gap stated as a condition of the system rather than a behaviour of people, the clause it relates to, and the operational risk if it stays open. "No documented fatigue risk controls for night watch-keeping" is a gap. "Crew not reporting fatigue" is a symptom, and writing it that way puts the problem on the wrong side of the table.
A compliance readiness view across the requirement areas in clauses 5 to 10, marked compliant, partial, or not evidenced. This is the section that answers pre-qualification questionnaires and board papers directly.
A prioritised action plan across immediate, short-term, medium-term and strategic horizons, with each action stated as a system change, a clause reference, an owner by role, and a target date. Actions that ask workers to manage stress better are not actions. They are the reason the gap exists.
Expect four to six weeks from kick-off to a finished analysis and plan. Anyone promising it faster is producing a document rather than an assessment.
The limitation nobody mentions
A gap analysis of this kind is completed by an HR, OHS, or leadership representative. It captures what the management layer believes is in place. That is exactly the right lens for assessing a management system, and it is also a partial one.
Leadership self-report and worker experience come apart in predictable places. The support pathway that exists on the intranet and the support pathway a night shift supervisor can actually reach at 3am are different objects. Findings should be triangulated with worker-level data before anyone treats the score as the whole picture. Any provider who does not raise this without being asked is not being straight about what the instrument can see.
Where the value sits
The gap analysis is not the intervention. It tells an organisation which of the six domains is holding the others back, which is worth knowing, because psychosocial risk work fails most often through sequencing rather than effort. Building monitoring infrastructure while leadership commitment sits at Inactive produces data that nobody acts on. Running support workshops while work design goes untouched treats a demand problem as a coping problem.
Maturity improvement is usually visible within twelve months. Movement in operational metrics follows over the twelve to twenty-four months after that. Sustained change runs to a two or three year horizon with quarterly review. Those are honest numbers, and they are the ones worth planning against.
The organisations that improve fastest are almost always the ones that scored low and said so.