ISO 20000-1 Documentation: What Do You Really Need?

1. Documents You Need to Maintain

Organisations should maintain the following documents to show how their service management system works:

• Scope of the Service Management System: Defines the services covered by the system.

• Service Management Policy: Explains the organisation’s approach to managing services.

• Service Management Objectives: Lists the goals the organisation wants to achieve.

• Service Catalogue: Provides details of the services offered to customers.

• Service Level Agreements (SLAs): Defines the agreed service levels and targets.

• Service Management Plan: Explains how services will be managed and delivered.

• Policies and Plans: Includes plans for capacity, service continuity, availability, and information security, as required.

• Required Processes: Documents the processes needed to meet the standard.

• Supporting Information: Maintains other information necessary for the effective operation of the system.

2. Records You Need to Keep

Organisations must retain records to demonstrate that their service management system is working effectively.

• Records of employee competence and training.

• Records of changes, including emergency changes and their reviews.

• Configuration management records.

• Incident and service request records.

• Problem records and known errors.

• Release and deployment records.

• Service performance reports and SLA results.

• Capacity plans and monitoring records.

• Availability measurement records.

• Service continuity plans and test results.

• Supplier agreements and performance records.

• Customer complaints and actions taken to resolve them.

• Internal audit plans and results.

• Management review records.

• Records of nonconformities and corrective actions.

3. Documents Auditors Usually Check First

Service Catalogue: It should be up to date and accurately describe the services delivered. Auditors may compare it with the services customers actually receive.

Service Level Agreements (SLAs): Service targets should be agreed upon with customers. Auditors check whether these agreements exist and are reviewed when necessary.

Configuration Records: Auditors may select records and check whether they match the actual IT environment and service setup.

Change Records: Auditors review change records to check whether changes were properly approved, implemented, and reviewed, especially emergency changes.

Problem Records: Organisations should maintain separate records for problems, their causes, and known errors. Missing records may indicate weaknesses in problem management.

Service Reports: Reports should match the original data and records. Incorrect or inconsistent reports can affect customer trust and service decisions.

4. Practical Tips for ISO 20000-1 Compliance

• Define the scope clearly: Focus on the services provided rather than listing only departments or organisational units.

• Include outsourced activities: If external providers perform parts of your service management process, ensure these activities are properly controlled and managed.

• Plan for future capacity: A capacity plan should consider expected demand, future requirements, and actions needed to meet them. Current usage data alone is not enough.

• Review changes after implementation: Record the results of changes and conduct post-implementation reviews, particularly for emergency changes.

• Test service continuity plans: Test whether services can continue or recover as planned. Document the results, including any gaps and corrective actions.

• Maintain known error records: Document known errors and available workarounds so that teams can access this information when needed.

• Keep service reports accurate: Ensure reported performance matches the underlying data and records.

5. Common ISO 20000-1 Audit Findings

Auditors may identify the following issues during an audit:

1. Problem records are missing or not maintained separately from incident records.

2. Configuration records do not match the actual environment.

3. Service level targets have not been agreed upon with customers.

4. Capacity is managed only when issues arise, without proper future planning.

5. Emergency changes are used frequently without proper review afterward.

6. Outsourced activities are not properly considered within the service management system.

7. Service continuity plans have not been tested.

8. Service reports contain figures that do not match the original records.

Conclusion

ISO 20000-1 is not just about preparing documents. It is about maintaining accurate records, following defined processes, monitoring service performance, and improving service delivery.

Keeping documentation updated and ensuring that actual practices match documented procedures can help organisations prepare for audits and manage their services more effectively.