Scope exclusion for a subcontracted network
CloudHost Managed Services holds ISO/IEC 20000-1 certification for its UK data-centre operations. Its scope statement reads: 'Provision of hosted ERP application services to public sector clients. Network infrastructure and physical data-centre facilities supplied by subcontractors are excluded.' The auditor reviews three months of service desk records and finds 14 incidents logged as 'network latency' that breached the ERP service level agreement, triggered service credits and required the service desk to coordinate the network subcontractor's engineers. The service catalogue lists 'ERP access' as a single service. There is no service level agreement with the network subcontractor and no supplier management records for it. Top management says the exclusion is legitimate because CloudHost does not own the network. The auditor must decide how to treat the exclusion and what to examine next.
1. Is the scope exclusion acceptable under ISO/IEC 20000-1? Justify your answer with reference to the scope and service management requirements.
Read the worked answer
No. ISO/IEC 20000-1 Clause 4.3 requires the scope to state the services, the boundaries of the SMS and its applicability, and any exclusion must not affect the organisation's ability to conform. Here the network is not a separate service; it is a dependency of the ERP service covered by the SLA. The 14 latency incidents breached the ERP SLA, triggered credits and were handled by the service desk, so incident management, service level management and supplier management are already engaged. Excluding the network from the SMS removes the controls (supplier agreements, performance monitoring, escalation and review) that the service depends on. The correct treatment is to include the network subcontractor within the SMS boundary or, at minimum, apply supplier management and service level management controls over it; the service catalogue also needs to reflect the dependency. A major nonconformity against 4.3 is supportable if the exclusion is systemic; a minor may be appropriate only if controls exist and the scope wording is imprecise. The auditor should test the effect, not the wording alone.
2. What audit evidence would you gather to determine whether supplier management controls are effective, and how would you classify the finding?
Read the worked answer
Evidence: the subcontract, any supplier performance reviews and SLAs, the service catalogue entry and dependency map, the 14 incident records with timeline and escalation, SLA breach reports and credits, service desk scripts, supplier escalation logs, management review minutes covering supplier performance, and corrective actions. Interview the service desk team lead and the supplier manager; observe how incidents are routed. Test whether performance is measured against agreed targets and whether reviews lead to actions. Classification: if no supplier agreement, no performance monitoring and no review exist for a supplier whose failure breaches a customer SLA, the finding is systemic and affects the SMS's ability to meet service requirements, so major. If agreements exist but are incomplete for one interface, a minor may be arguable. The auditor must record the sample, dates and records; state the criteria (Clause 4.3 and supplier management requirements), the objective evidence and the effect. Do not accept 'the subcontractor is excluded' as a correction; the correction is to bring the dependency into the SMS or remove the end-to-end SLA claim.