Sampling, a changed definition and a whiteboard
During a surveillance audit of a 2,500-employee logistics company, the auditor interviews the service desk manager, who states: 'Every major incident gets a problem record within 48 hours; that is our procedure.' The auditor samples 30 major incidents from the last 12 months. Nine have no problem record; three have records created after 11 days; two records contain no root cause analysis and were closed as 'no fault found'. The manager says the sample is misleading because the definition of 'major incident' changed in July, and some of the sampled tickets would not be major under the new definition. The auditor also sees a whiteboard listing six incident numbers marked 'major' that are not in the ticket system. The procedure document is version 4, dated July, and states the 48-hour requirement.
1. How should the auditor evaluate the sufficiency and reliability of the evidence?
Read the worked answer
Sufficiency and reliability require triangulation. The interview is a claim, not proof; the procedure is criteria; the tickets are records; the whiteboard is an additional source. The auditor should first establish which definition applied to each sampled incident, using the version history and the date of each ticket, and stratify the sample into pre- and post-July. Then re-test the nine 'missing' records against the correct definition; some may legitimately fall outside. Verify the 11-day records and the two closed-without-root-cause records against the procedure. Follow the whiteboard: check whether those six incidents exist in the system and whether they were classified. Record ticket numbers, dates, interviewees and observations. The manager's explanation is a lead, not a correction; the auditor must test it. If records are missing, ask for them before concluding.
2. What finding or findings would you raise, and how would you classify them?
Read the worked answer
After applying the correct definition, if failures remain, raise a nonconformity against the problem management requirement and the organisation's own procedure. The statement should identify the criteria (procedure v4, 48-hour requirement; ISO/IEC 20000-1 problem management), the evidence (specific ticket IDs, dates, missing or late records, no root cause) and the finding. Classification: a pattern of 9 of 30 with no record, plus late records and closures without root cause, indicates the procedure is not effectively implemented, not a one-off slip. That is systemic and affects the SMS's ability to prevent recurrence; major is defensible. If the only failures are pre-July and explained by the old definition, a minor or observation may be appropriate for the transition control, not a major for the 48-hour rule. The whiteboard incidents, if absent from the system, support a separate incident-recording finding. The auditor must present the evidence at the closing meeting and allow the organisation to respond.
3. Draft an example nonconformity statement with criteria, evidence and classification.
Read the worked answer
Example: 'Criterion: Problem management procedure v4 (July) requires a problem record within 48 hours for every major incident, and ISO/IEC 20000-1 requires problem management to identify root causes and manage workarounds. Evidence: Of 18 major incidents sampled after 1 August, 5 (IDs ...) had no problem record after 48 hours; 3 (IDs ...) had records created on day 11; 2 records were closed as no fault found without root cause analysis. Interviews with the service desk manager on [date] confirmed the 48-hour rule. Finding: The problem management procedure is not consistently implemented. Classification: major, because the failures are repeated across incidents and periods and no effective correction was evident.' The auditor should avoid naming individuals and should state facts, not opinions.