When organisations decide to pursue ISO/IEC 20000-1 certification, the first instinct is often to start writing. Policies, procedures, process documents, a big service management manual.
Documentation matters, but it is not what gets you certified. Auditors are looking for evidence that your service management system genuinely works and keeps improving. Here is what that means in practice, and how to prepare.
A clear and sensible scope
One of the first things an auditor checks is your scope: which services, which locations and which parts of the organisation your service management system covers.
A well-defined scope makes everything else easier. Many organisations start with a focused scope, such as their core IT services for internal customers, and widen it later. That is perfectly acceptable, as long as the scope is clear and you can show you are managing everything inside it.
Leadership that is actually involved
The standard expects top management to be visibly involved, not just to sign a policy. Auditors will look for evidence that leaders set objectives, provide resources and review how the system is performing.
In practice, this usually shows up in management review meetings: regular, minuted sessions where performance, risks, audit findings and improvements are discussed and decisions are recorded. If those meetings are not happening yet, start them well before your audit.
Records, not just procedures
This is the point that catches many organisations out. A procedure describes what should happen. A record proves that it did.
Auditors will sample real activity. They may pick a handful of changes and follow each one from request to closure. They may look at incidents, problems, service reviews or supplier meetings. What they want to see is that your actual work matches your documented approach, consistently.
The practical lesson: make sure your ITSM tool captures the right information as part of everyday work. Good records should be a by-product of doing the job properly, not something assembled the week before the audit.
Agreed services and service levels
Expect questions about your service catalogue and your service level agreements. Are your services defined? Are targets agreed with customers? Are you measuring performance against them and reviewing the results together?
Gaps here are common, particularly where service levels exist on paper but nobody reports against them. Closing that gap is often one of the most valuable things to come out of certification preparation.
Suppliers under control
Most IT services depend on external suppliers, and the standard expects you to manage them. Auditors will look for contracts or agreements with clear expectations, evidence that performance is monitored, and regular reviews.
Internal audit and continual improvement
Before the certification body visits, you need to have audited yourselves. A well-run internal audit, with findings tracked through to resolution, gives you confidence and gives the auditor evidence that your system can find and fix its own weaknesses.
Alongside this, auditors want to see continual improvement in action: issues identified, improvements agreed, and changes made as a result.
How the certification audit works
Certification audits are usually carried out in two stages. The first stage reviews your scope, documentation and readiness. The second stage looks in depth at how your system operates in practice. Treat the first stage as a useful health check: any gaps it highlights can be addressed before the second.
A practical way to prepare
- Start with a gap analysis against the standard to see where you stand.
- Build a realistic plan that fixes the biggest gaps first.
- Let the system run for a few months so you have genuine records to show.
- Carry out an internal audit and a management review before booking the certification audit.
Approached this way, ISO/IEC 20000 certification becomes more than a badge. It leaves you with service management that is clearer, better measured and easier to improve.
Considering ISO/IEC 20000 certification? Book a free scoping call and we will help you understand how ready you are.
