ISO 20000 Foundation common mistakes
ISO 20000 Foundation · Understand the traps and how to avoid them.
When asked who must approve the service management policy, the candidate answers 'the service desk manager' or 'the IT director' instead of top management.
Candidates carry over ITIL-style thinking where service management ownership sits with an IT role, and they overlook that ISO/IEC 20000-1 places the policy and its communication with top management, who must also ensure it is compatible with the organization's direction.
What to do instead
Memorize the clause logic: top management establishes the policy, ensures objectives and plans are compatible with strategic direction, and communicates the policy. When a question names an approver, scan for the highest-level role and treat IT-only roles as implementers, not owners.
The candidate lists the 2011-era set of separate management system clauses (e.g., separate clauses for capacity, availability, and service continuity as standalone systems) rather than the integrated structure of the current standard.
Many study materials and older summaries predate the 2018 restructuring, which consolidated management-system requirements into a single set of clauses aligned with the harmonized structure used across ISO management system standards.
What to do instead
Work from the current edition's clause map: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement, with service management-specific requirements embedded in operation. Discard any study sheet that lists the old clause numbering.
The candidate treats documentation as optional 'if the organization finds it useful' and cannot name what must be documented, such as the service management policy, objectives, scope, and evidence of competence.
Candidates confuse 'documented information' flexibility with the absence of mandatory records, and they do not distinguish documents that must be maintained from records that must be retained as evidence.
What to do instead
Build a two-column list: documented information to maintain (policy, scope, objectives, plans, service catalog, agreements, processes) versus documented information to retain as evidence (results of monitoring, audits, reviews, competence records, incident and change records). Practice classifying items into the correct column.
When asked about defining the scope of the service management system, the candidate writes a generic statement like 'all IT services' without addressing interfaces with parties outside the scope or justified exclusions.
Candidates memorize that scope must be documented but skip the requirement to consider the organization's context, interested parties, and the services delivered to customers, and they forget that exclusions must be justified and cannot affect the organization's ability to meet requirements.
What to do instead
Answer scope questions with four elements: the services covered, the organizational units and locations, the interfaces with parties outside the scope, and the justification for any exclusion. Rehearse one worked example so the structure becomes automatic.
The candidate cannot distinguish risk management from opportunity identification and writes only about avoiding negative events, omitting the requirement to determine and address risks and opportunities that affect conformity and customer satisfaction.
Everyday usage of 'risk' is purely negative, and candidates skim the planning clause without noticing that it pairs risks with opportunities and requires planning actions and evaluation of their effectiveness.
What to do instead
For any planning question, answer in three parts: identify risks and opportunities relevant to service conformity and customer satisfaction, plan actions to address them and integrate those actions into processes, and evaluate the effectiveness of the actions. Include at least one opportunity example, such as service automation reducing incident volume.
The candidate describes service management objectives as qualitative aspirations ('improve customer satisfaction') with no measurable target, baseline, or owner.
The standard requires objectives to be measurable where practicable, consistent with the policy, relevant to conformity and customer satisfaction, monitored, communicated, and updated; candidates recall 'set objectives' but not the attributes.
What to do instead
Memorize the attribute checklist and apply it in answers: specific, measurable, monitored, communicated, updated, and assigned responsibility with a plan of what will be done, resources needed, who is responsible, when it will be completed, and how results will be evaluated.
The candidate describes monitoring and measurement as a list of IT metrics (uptime, ticket counts) without linking them to the service management objectives, the effectiveness of processes, and the evaluation of service performance against agreements.
Operational reporting habits dominate, and candidates miss that performance evaluation must show whether the service management system and the services are effective, not merely that systems are running.
What to do instead
Structure answers in three layers: what is monitored (services, processes, customer satisfaction, suppliers), how results are analyzed and evaluated against objectives and service level targets, and what decisions the results trigger. Always tie at least one metric to a stated objective.
The candidate conflates management review with internal audit, stating that the audit output satisfies the review requirement or that the review is performed by the auditor.
Both are evidence-gathering activities in the performance evaluation clause, and candidates merge them because both produce reports; they forget that review is a top-management activity with defined inputs and outputs.
What to do instead
Separate the two by actor and purpose: audit is an independent, planned check of conformity performed by auditors; review is top management evaluating suitability, adequacy, and effectiveness using defined inputs (audit results, performance against objectives, customer feedback, risks, improvement status) and producing decisions on improvement, changes, and resources.
When asked about nonconformity and corrective action, the candidate describes fixing the immediate symptom and omits root cause analysis, evaluation of the need to eliminate the cause, and review of the effectiveness of the action taken.
Incident-fix thinking from service operations bleeds into the improvement clause, and candidates do not separate correction (fix the problem) from corrective action (remove the cause so it does not recur).
What to do instead
Answer with the full sequence: react and correct the nonconformity, evaluate the need to eliminate the cause, determine and implement the action, review its effectiveness, update risks and plans if needed, and retain records. Explicitly label which step is correction and which is corrective action.
The candidate treats continual improvement as a one-off project or a yearly activity rather than an ongoing cycle, and cannot name the inputs that feed it, such as policy, objectives, audit results, and service performance data.
Project language ('we will run an improvement project') is common in IT work, and candidates miss that the standard requires improvement to be a continual, planned activity with identified opportunities, prioritized actions, and measurement of results.
What to do instead
Frame every improvement answer as a cycle: identify improvement opportunities from policy, objectives, monitoring results, audits, and reviews; plan and prioritize actions; implement; measure and evaluate results; and feed outcomes back into the next cycle. Name at least two concrete inputs and one way results are verified.