A gap analysis asks a simple-sounding question: does the evidence support this disclosure requirement? The answer is often recorded as a single word — compliant, non-compliant, partial — and that word travels into slide decks, board papers and client letters. The trouble is that “non-compliant” usually describes something narrower than it claims.
Three situations that look the same
When a reviewer cannot find evidence for a requirement, one of at least three things is true:
- The evidence exists, but was not found. It sits in a document nobody provided, in an appendix the search did not reach, or in wording that did not match the reviewer's expectations.
- The evidence does not exist in the documents provided. The disclosure is genuinely missing from the material under review — which is a gap in the documents, not yet a finding about the company.
- The requirement does not apply. Many disclosures depend on materiality, sector or circumstance. A market-based Scope 2 figure, for example, is only expected where an organization uses contractual instruments.
Only after these are separated — and after someone with authority has considered the company's actual practices — can a statement about compliance be made. Collapsing them into one label overstates what the review established and invites the wrong remediation.
What a better status vocabulary looks like
Veridion reports what the documents establish, not what the company does. Its five statuses are deliberately narrow: supported, partially supported, evidence not found, conflicting evidence, and human review required. “Evidence not found” means exactly that, and every such finding says how many documents were assessed and that the evidence may exist elsewhere.
Partial support is broken down further. Each requirement is split into elements — a value, its reporting period, the consolidation approach, the methodology — and the finding lists which are evidenced and which are missing. “Scope 1 is partially supported because biogenic CO₂ is not reported separately” is actionable; “Scope 1 is 92% compliant” is not, and it is not true either.
Conflicts deserve their own word
When two documents disagree — a sustainability report and an annual report stating different energy totals for the same year — the requirement is neither supported nor missing. It is conflicting, and the right next step is reconciliation, not data collection. In Veridion's demo, a fictional company reports 412,300 MWh in one document and 1,532,000 GJ (about 425,556 MWh) in another. The difference only appears once units are aligned, and it is exactly the kind of inconsistency an auditor would ask about.
Write the uncertainty down
The final safeguard is a person. Findings that rest on low-confidence OCR text, where a language model and the deterministic checks disagree, or where values conflict, are routed to human review with the reason stated. Reviewers can accept or override a finding, but the original assessment is kept alongside the decision, so a later reader can see both.
None of this makes a gap report more cautious for its own sake. It makes it more precise — and precision is what makes a finding defensible when a client, an auditor or a regulator asks how it was reached.