The RM Studio Gap Analysis is a great place to start with any Standard or Regulation. The Gap is used to establish the baseline for the implementation process and to gain a clear understanding of the requirements included. The Gap can be made on one Standard or multiple Standards and Regulations if desired.

The Gap Analysis in RM Studio provides users with the initial or follow up view (during internal audits) of the implementation, but the Gap can be combined with the Control Maturity and Effectiveness Assessment to further understand the actual compliance or success of the control implementation.

How to Perform a Gap Analysis

1. After opening the Gap Analysis under Risk Management in the tree, click the ‘+’ to create a new Gap.
2. Select the Standard, Regulation, or Control Set from the drop down list in the popup window ‘Add Gap Analysis’.
3. Select the Business Entity in the same manner and then click the ‘Ok’ button.Note: In order to use multiple Standards or Control Sets, user must first choose one Standard in the manner above, then add the additional Standard or Control Sets inside the newly created Gap Analysis (instructions are below).
4. After creating the new Gap, it opens in a new tab. Also, a new row of tabs are added below. Under the General Information you need to input a name for the new Gap.
5. The Description of the Gap Analysis should be filled in clearly and concisely along with any other relevant information. On the right side an option to set a time frame is available, but it is not required.

Controls

Under the Controls tab you will find all the Controls from the Standard you chose to work with when you created the Gap Analysis. Below the list of controls you will find the Control Information Pane that lists information about the Control as well as the Implementation Guide for a particular Control.

Implementation

Finally, in the Implementation tab, you will define if and how your organization will implement each Control.

You can set a responsible person for the implementation of a given Control. To designate a responsible person you must select a registered user from the Responsible drop down box.

Status

As you go through the Controls you will decide whether the Control is “Not Applicable” for your organization. If you determine the Control is applicable you must then determine whether it is Not Implemented, Partially Implemented, Fully Implemented, or a Future Control. Future Control means that you plan to implement the Control at a scheduled time in the future. Note that only controls with “Implemented” status serve for reduction of  risk in the risk treatments.

Justification

In the Justification text box you should write the clear and concise reasoning for the defined status of each Control. A thorough justification will help you later to remember your reasons for giving a Control a particular Status.