Doing a gap analysis is key to finding where a company isn't meeting the rules. It compares what the company does now with what the rules say. This shows where changes are needed.