An appraisal team does not grade intent. It grades what the projects on the sample list can prove through documents, records, and interviews on the days the appraisal runs. That distinction is the reason a CMMI readiness and gap assessment matters more than most preparation activities. It turns a vague internal sense of "we are probably close" into a dated, defensible list of process areas that are strong, weak, or simply undocumented, and it puts that list in front of leadership while there is still time to act on it.
For organizations that deliver work as projects, programs, and capital jobs, process maturity is rarely uniform. One project manager keeps disciplined records. Another keeps a spreadsheet. A third keeps everything in email. A gap assessment exposes that variation before an appraisal sample does.
Why project-driven organizations need a readiness check first
Project-driven firms grow by adapting. Each new client brings a slightly different reporting format, a different approval chain, and a different tolerance for documentation. That flexibility wins work, but it also produces practices that live inside individual habits rather than inside an institutionalized system. CMMI assesses whether practices are institutionalized, meaning they survive a change of project manager, a change of client, or a change of site.
A readiness check answers three questions that leadership usually cannot answer from memory: which process areas already satisfy the model's goals, which satisfy them only on the best-run projects, and which have no supporting evidence at all. Organizations that skip this step often discover the third category during the appraisal itself, at which point the finding is expensive and public rather than internal and fixable.
What a CMMI gap assessment actually measures
A gap analysis is a systematic evaluation of current practice against the specific requirements relevant to your target. In a CMMI context, that means mapping existing processes to the model's requirements and comparing what is written, what is performed, and what is recorded. The comparison is not a document audit alone. It also tests whether the people doing the work can describe the process consistently and show where it produced a decision.
Process areas, goals, and levels
Readiness is usually tracked process area by process area, with progress recorded against the goals associated with the target level. Many teams maintain a workbook that summarizes progress toward Level 2 and Level 3 goals and update it after each assessment wave. That structure is useful because it prevents the most common reporting error in CMMI preparation: declaring the organization ready as a single verdict when in reality twelve process areas are solid and four are barely started.
Evidence rather than intentions
A process that exists only in a slide deck scores as a gap. A procedure that was written last year but never revised after a reorganization scores as a partial gap. A practice that is performed well but leaves no record is, for assessment purposes, indistinguishable from a practice that was never performed. Assessors ask for the artifact, the date, the owner, and the project it came from. If any of those are missing, the finding follows.
How to scope the assessment before the first interview
Pick the model and the target level deliberately
CMMI for Development is a framework designed to help organizations improve their software and product development processes, and it is a common starting point for engineering-heavy businesses. Other constellations emphasize different work. Confirm the current model version, the appraisal method, and any recent changes through the CMMI Institute resource centre, which publishes presentations, webinars, articles, case studies, and whitepapers addressing common appraisal questions. Do not let a consultant's slide deck become your only source of truth on model content.
Choose the organizational unit and the project sample
The boundary you draw determines everything downstream. An assessment that covers a single department will produce findings that do not transfer to a sister business unit. An assessment that covers the entire enterprise will consume months and produce a roadmap nobody can resource. Draw the boundary around the group that shares processes and customers, then select a project sample that reflects the real mix of size, client type, and delivery model, including at least one project that went badly. The struggling project usually contains more useful evidence than the showcase one.
The assessment sequence, step by step
- Confirm the sponsor, the business reason, and the target level in writing so the exercise has a decision-maker attached to it.
- Build a process inventory: what procedures, templates, logs, and registers exist today, and who owns each one.
- Map current processes against the model's requirements, recording matches, partial matches, and absent practices.
- Interview practitioners at more than one level, including project managers, functional leads, and senior management.
- Review project evidence for the sample, checking that each claimed practice has a dated artifact behind it.
- Rate each process area against its goals and record the reasoning, not just the score.
- Write a remediation roadmap with sequenced actions, owners, and a recheck date.
- Revalidate the roadmap with the sponsor and the practitioners who will have to execute it.
A practical view of the assessment stages
Gaps that surface again and again in project-driven firms
- Plans are produced at kickoff and never revised, so the plan no longer describes how the work is actually being done.
- Requirement and scope changes are agreed verbally and recorded late, leaving no trace of the decision or its approver.
- Measurement is limited to schedule and cost, with little tracking of quality, defect trends, or rework.
- Supplier and subcontractor oversight depends on the relationship rather than a defined evaluation and acceptance process.
- Training and competency records are scattered across HR, project files, and personal folders.
- Process assets are published but not used, or used by one team and unknown to the rest.
- Senior management reviews happen, but the actions and follow-ups are not tracked to closure.
None of these are unusual, and none of them are fatal when found early. They become fatal when first discovered during an appraisal interview by a project manager who has to admit the record does not exist.
Turning findings into a remediation roadmap
Rank gaps by appraisal risk, not by ease of fixing
Teams naturally want to close the easy gaps first, which produces visible activity and very little change in readiness. A better sequence ranks gaps by how much they threaten the target level and how many process areas they touch. A weak corrective action process , for example, undermines several goals at once, while a missing template affects one. Published CMMI case studies describe organizations using the model to shorten time to market and reduce cost, and one G&P case study describes measurable return alongside a reduction in bureaucracy. Those outcomes come from fixing the structural gaps, not from accumulating paperwork.
Assign owners and set a recheck date
A roadmap without owners is a wish list. Each action should name a person, a deliverable, and a date, and the sponsor should review progress on a fixed cadence. Set the recheck at the same time, using the same sample and the same method, so that improvement is measured rather than assumed.
What good readiness evidence looks like
Evidence should be contemporaneous, attributable, and retrievable. Contemporaneous means it was created when the work happened. Attributable means a named person approved or performed it. Retrievable means a project manager can produce it within minutes when asked. A useful test is to pick three random projects and ask for the same five artifacts in each. If the answer varies wildly in format or availability, the process is not institutionalized, regardless of how good the procedures look in the document repository.
Where independent QA support fits
An external assessor reads evidence with the same skepticism as an appraisal team, which is hard for internal staff to sustain when they also own the processes being examined. Independent QA and compliance consultants can run the gap assessment, map project quality management systems and corporate quality management systems against model requirements, and connect the findings to ISO 9001 readiness work that is often running in parallel. For capital project and fabrication environments, the same review can fold in third-party inspection and welding or NDT oversight records, which are frequently the weakest evidence link in the chain. Verify model versions, appraisal rules, and current requirements directly with the CMMI Institute before finalizing scope.
Questions we get on this topic
How long does a CMMI readiness and gap assessment take?
Duration depends on the organizational unit, the number of process areas in scope, and how quickly project evidence can be produced. Assessments covering a single business unit and a small project sample move faster than enterprise-wide reviews. The schedule is usually driven less by interview time and more by how long it takes the organization to assemble retrievable records. Scope it after the process inventory, not before.
Is a gap assessment the same as an appraisal?
No. A gap assessment is an internal improvement exercise that tells you where current practice falls short of the model and what to fix. An appraisal is a formal evaluation carried out under the CMMI Institute's appraisal framework, and its rating can be shared with customers and bidders. Treat the gap assessment as preparation, and confirm appraisal specifics with the CMMI Institute directly.
Can a simple checklist replace a full gap assessment?
A checklist can be a useful starting tool for evaluating how well you have prepared and for framing early conversations. It cannot verify evidence, test consistency across projects, or distinguish a documented practice from a performed one. Use a checklist for orientation, then follow it with interviews and artifact review once you need findings solid enough to build a roadmap on.
Which maturity level should we target first?
Most organizations are better served by establishing Level 2 discipline before reaching for Level 3, because Level 3 goals assume the project management foundations are stable. The right target also depends on customer requirements, bid expectations, and the strength of current practice. Confirm the target with the sponsor and, where relevant, with the customers whose contracts drive the requirement.
Do CMMC gap analysis methods transfer to CMMI work?
The mechanics transfer well. A CMMC gap assessment also evaluates current practices against the requirements of a target level, and the discipline of comparing evidence to requirements is the same. The models themselves are different, one addressing process maturity and the other cybersecurity practice, so the requirement content must come from the correct source for each exercise.
Quality briefs, straight to your inbox
Field-tested guidance on inspection, audits and project quality systems — one issue on the first Tuesday of each month, written for people who have to make them work.
See past issues →- CMMI readiness and gap assessment: what it measures and how to run oneAn appraisal is a bad place to learn that your process description documents a workflow nobody actually follows. A CMMI gap assessment makes sure that discovery happens months earlier, in a room you control, with time left to fix what it finds.
- Independent Quality Assurance Consulting: What It Means for Capital ProjectsWhy independent QA consulting is about owner-side evidence, not just advice — from contract requirements and supplier audits to verified closure and turnover.
- Quality control plan: what it is, what to include, and how to write oneThe quality control plan sits between the project quality plan and the inspection and test plans. Written well, it tells each discipline exactly what gets controlled, checked and recorded. Written badly, it is a copied procedure no one on site can use. Here is what belongs in it and how to write one that survives contact with the work.
Need independent quality assurance on your project?
Talk to our team about inspection, auditing and QMS support.