EHS Audit vs Gap Assessment: Which One Do You Actually Need?

When management says “we need an audit,” what they usually mean is: we need to know where we stand. That’s a reasonable goal, but the word “audit” may be pointing you toward the wrong service.

An EHS audit and a gap assessment answer different questions, cost different amounts, and are useful at different stages. Choosing the wrong one wastes money. Choosing the right one gets you to a clear answer faster.

The Core Distinction

A gap assessment answers: what’s missing?

It’s a big-picture evaluation of your facility’s EHS programs: which ones exist, which ones don’t, and which ones are so outdated they might as well not exist. The assessment identifies what regulatory programs apply to your operations, checks whether those programs are in place, and produces a report with specific recommendations organized by regulatory area.

Gap assessments are designed for facilities that haven’t had an outside review, need an independent look at their compliance posture, or suspect that programs have fallen behind. The output gives you a prioritized roadmap: here’s what’s missing, here’s what matters most, here’s where to start.

An audit answers: is what we have working correctly?

A compliance audit is a detailed, line-by-line review of programs that are already running. It checks whether your Injury and Illness Prevention Program (IIPP) meets current Cal/OSHA requirements, whether your training records are complete and current, whether your hazardous waste handling follows federal RCRA (Resource Conservation and Recovery Act) and California DTSC (Department of Toxic Substances Control) rules, program by program, item by item.

Audits are valuable when the foundation is solid and you want to verify the details. They produce granular findings that help you fine-tune programs that are already substantially in place.

Side by Side

Why the Distinction Matters

Here’s the practical problem with jumping straight to an audit when you need an assessment:

Imagine your facility doesn’t have a hazardous materials management plan. A detailed audit might produce a hundred findings related to hazardous materials: labeling issues, storage deficiencies, missing emergency procedures, incomplete inventory records. Each one is technically accurate. But the real answer is one thing: you need the plan. Build the plan, and most of those hundred findings resolve themselves.

The assessment identifies that one answer. The audit gives you a hundred line items that all point to the same root cause. The assessment costs less, takes less time, and gives you a clearer path forward.

This isn’t hypothetical. It’s the pattern we see in most first engagements. A facility calls asking for an audit. After a conversation about what’s in place (and what isn’t), it becomes clear that a gap assessment is the right first step.

The Decision Framework

You probably need a gap assessment if any of these are true:

• Your facility hasn’t had an outside EHS review in more than two years
• You’re not sure whether you have an IIPP, HMBP, or other required California programs
• Programs exist in a binder somewhere but haven’t been updated or actively followed
• You recently changed ownership or management
• An inspector from your local CUPA (which may be a county environmental health department, fire department, or another local agency depending on jurisdiction) or Cal/OSHA found issues you didn’t expect
• Nobody on staff is dedicated to EHS, so it’s handled alongside everything else
• Management said “get an audit” but can’t describe what specific programs they want audited

You’re ready for a compliance audit if:

• Your EHS programs are active, documented, and being followed
• You’ve had an outside review or assessment within the last two years
• You have a dedicated EHS person (or team) managing programs day to day
• You want to verify compliance ahead of an expected inspection or certification
• Your programs are in place and you want to refine them, not build them

If you’re not sure which category you fall into, that ambiguity is itself an answer. You likely need the assessment.

What to Expect from Each

During a gap assessment, we review your facility’s operations against the California regulations that apply, including Cal/OSHA safety requirements, CUPA-enforced hazardous materials and waste programs, stormwater and air permits, and any industry-specific standards. We request key documents beforehand, walk the facility with your team, and deliver a report organized by program area showing what’s in place, what’s missing, and where to focus first. Read more about the assessment process →

During a compliance audit, we go deeper. We check each program requirement against current practice: whether your IIPP has been reviewed within the last year, whether training records match the employees on your roster, whether your CERS (California Environmental Reporting System) inventory reflects what’s actually stored on site, whether your SWPPP (Stormwater Pollution Prevention Plan) sampling results are filed in SMARTS on time. The output is a detailed findings report with specific corrective actions for each item.

The assessment tells you what to build. The audit tells you what to fix.

What About “Starting from Scratch”?

Some facilities have programs on paper, but they’re years out of date. Training records list employees who left long ago. Plans reference regulations that have been revised. Binders exist, but nobody is sure what’s in them or whether they reflect current operations. See the signs your programs may have drifted →

In these cases, the question isn’t whether to update or replace. It’s whether the existing material has enough value to build on. Often, it doesn’t. When programs are significantly outdated, it’s faster, cheaper, and more reliable to rebuild from a current regulatory baseline than to try to patch documents that have drifted too far.

The assessment determines this. It tells you which programs can be updated and which ones need a fresh start, and that distinction directly affects the scope and cost of the program development that follows.

How the Two Services Connect

The assessment and audit aren’t competing options. They’re sequential stages in a compliance lifecycle.

Stage 1: Gap assessment. Identify what programs are needed, what’s in place, what’s missing. Produce a prioritized roadmap.

Stage 2: Program development. Build or rebuild the programs identified in the assessment. Start with the highest-risk items, the areas where a regulatory inspection would create the most exposure.

Stage 3: Ongoing audits. Once programs are in place and running, we review them on a rotating schedule throughout the year, catching drift before it creates exposure. Regulations change, staff turns over, operations evolve. We watch for those changes and adjust your programs proactively, not after the next inspection finds something.

Most facilities that engage CDMS start at stage one. Many move through all three stages over the course of a year or two. The assessment defines the work; program development does the work; audits maintain the work.

The “Management Said Get an Audit” Scenario

This is one of the most common conversations we have. Leadership has decided it’s time to take stock of the facility’s compliance posture. Someone on the team is asked to find a vendor and “get an audit done.”

Sometimes that person is an EHS manager who needs an outside perspective. Sometimes it’s an operations or facility manager who’s handling compliance alongside everything else. Either way, the starting question is the same, and it’s one we work through with clients every day.

The intent is right. They want to know where the facility stands. But the specific request for an “audit” often doesn’t match the situation. If the facility hasn’t had a full outside review, the assessment is the more efficient and informative starting point.

A gap assessment covers the big picture that leadership is asking about, costs less than a full audit, and gives you a concrete plan for what comes next. It’s easier to explain to leadership than a hundred-item audit report because it organizes findings by program area and prioritizes them by risk, which is usually what leadership wanted in the first place.

Next Steps

If you’re trying to decide between an assessment and an audit, the answer usually becomes clear after a short conversation about your facility’s situation.

← Back to EHS Gap Assessment & Compliance Audit Services