ISO 20000-1 Audit: What Auditors Examine, Clause by Clause

ISO 20000-1 uses the common management system structure for clauses 4 to 10. Clause 8 holds the service processes, and that is where most of the audit happens. This guide follows the 2018 edition, which ISO lists as current. What auditors sample varies with your services.

What do auditors examine in clauses 4 to 7?

Auditors test whether the foundations are defensible. Scope must name the services delivered and must not carve out parts run by other parties. A service management function needs real authority over delivery teams, objectives should reflect service performance, and knowledge must be documented, not held by individuals.

Clause 4 asks for context, interested parties, scope and the service management system. Control of other parties sits in clause 8.2.3, and it is the requirement most likely to complicate a scope. Where another party operates a process or delivers a component, auditors ask how you govern them and what evidence exists. Clause 7 names knowledge specifically, so auditors ask about known error records, runbooks and documentation.

Which clause 8 processes does an ISO 20000-1 audit examine most?

Change management is examined most after incident management. Auditors sample changes and check assessment, approval, testing, implementation records and post-implementation review, with particular attention to emergency changes. Configuration management follows: they select configuration items and verify them against reality, since inaccurate data spreads into every other process.

For emergency changes, auditors ask whether the route exists, whether it is genuinely exceptional and whether retrospective review occurs.

Why is problem management the process most often missing?

Problem management needs problem records distinct from incidents, evidence of root cause analysis and known error records. Auditors ask for all three. An organisation with thousands of incidents and no problem records has a finding, since recurring incidents are being absorbed rather than eliminated. Incident management itself is usually well run, because incidents demand attention.

At a Chennai managed-services provider, the auditor opened the problem register and found it empty, while the incident log ran to many pages.

What do auditors look for in capacity, availability and continuity?

Auditors ask to see the capacity plan and how forecast demand was determined, and reactive capacity management is a common finding. They check that availability requirements were agreed and measured against. Continuity plans must be tested, and untested plans are a finding, as in ISO 22301.

How do auditors treat the catalogue, service levels, suppliers and costs?

Auditors check that the service catalogue is current and describes what is actually delivered. Service level targets must be agreed, monitored, reported and reviewed, with reported performance matching the data. They also look for a defined route for customer communication and complaints, supplier agreements with performance monitoring, and identified, allocated costs, which are often thin.

Release and deployment needs planning, testing, acceptance criteria and back-out arrangements. Information security management is also required, at a level that fits the services.

What do clauses 9 and 10 examine?

Service reports sent to customers must be accurate and derived from the underlying records. Auditors trace a reported figure back to source data and take discrepancies seriously. Clause 10 expects improvement driven by problem management and service review, not only by audit findings.

Clause 9 also covers monitoring, internal audit and management review.

Where do auditors keep finding the same weaknesses?

Three weak points recur: problem management that does not exist, configuration data that is inaccurate, and capacity managed by reaction. All three stay invisible while things go well and become costly when they do not. Configuration data is the one that spreads, since it feeds every other process. Check these three before the audit.

How do ISO 20000-1 consultants play a main role?

ISO 20000-1 consultants map your processes to clause 8, test them the way an auditor would, and help close gaps before the audit. They do not issue the certificate, and they do not carry out the certification audit. A certification body does that.

A consultant can sample changes, configuration items and problem records the way an auditor will. If an adviser also acts as one of your ISO certification consultants, ask which tasks they will do and which stay with the certification body.

How can MSCi help with ISO 20000-1 certification?

MSCi is a consultancy with 40+ years of experience in ISO consultation, and we prepare companies for audits. For ISO 20000-1, we focus on scope, gap assessment and remediation planning. We do not issue the certificate, which a certification body does.

We usually begin with the three recurring weak points: problem records, configuration accuracy and capacity planning. We then agree a remediation plan with owners and dates, and support you through the audit. Contact MSCi to review your scope and audit readiness.

Frequently Asked Questions

1. Which edition of ISO 20000-1 is current?

ISO/IEC 20000-1:2018 is the current edition, and ISO confirmed it in 2023. It has been amended once, in 2024, with climate action changes.

2. Which clause holds most of an ISO 20000-1 audit?

Clause 8, operation of the service management system, holds most of the audit. It covers the service portfolio, relationships, supply and demand, change and release, resolution and assurance.

3. Is problem management required for ISO 20000-1 certification?

Yes, Clause 8.6.3 covers problem management, and auditors ask for problem records distinct from incidents, root cause evidence and known error records.

4. Do auditors check service reports against source data?

Yes, Auditors trace a reported figure back to the underlying records. They take discrepancies between the report and the system seriously.

5. Can MSCi issue an ISO 20000-1 certificate?

No. A certification body issues the certificate, not a consultancy. MSCi prepares you through scope, gap assessment and remediation planning.

---