ISO 20000 Lead Auditor cheat sheet

ISO/IEC 20000-1 defines requirements for a service management system (SMS); ISO/IEC 20000-2 provides guidance on applying Part 1 and is informative, not certifiable.

The SMS is a management system: interrelated policy, objectives, processes and resources used to plan, establish, implement, operate, monitor, review, maintain and improve service management.

Scope statement must name the services delivered, the service provider's organizational units, and any exclusions with justification; exclusions cannot remove requirements affecting service conformity.

Service is defined as a means of delivering value to customers by facilitating outcomes the customer wants, without the customer owning specific costs and risks.

Key concepts: service provider, customer, user, internal and external suppliers, interested parties; the SMS must determine interested parties and their relevant requirements.

Applicable requirements flow from the customer, the organization, and statutory/regulatory/contractual obligations; the SMS must show how these are identified and met.

Leadership and commitment sit with top management, who must ensure the SMS is integrated into the organization's business processes and provide resources.

The Plan-Do-Check-Act cycle underpins the standard: planning (context, leadership, planning), doing (support, operation), checking (performance evaluation), acting (improvement).

Risk-based thinking applies to service planning and delivery; the organization must identify, assess and treat risks to service continuity and service quality.

Clause 4 (Context of the organization) requires determining external and internal issues, interested parties, the SMS scope, and establishing the SMS and its processes.

Clause 5 (Leadership) requires top management to establish service management policy, assign roles, responsibilities and authorities, and ensure customer focus.

Clause 6 (Planning) requires risk and opportunity identification, service management objectives, and planning of changes to the SMS.

Clause 7 (Support) covers resources, competence, awareness, communication and documented information, including creating, updating and controlling documented information.

Clause 8 (Operation) covers service planning, service portfolio management, service relationships, service design/build/transition, resolution and fulfilment processes, and service assurance.

Service assurance includes capacity, availability, service continuity, information security, and supplier management requirements.

Clause 9 (Performance evaluation) requires monitoring, measurement, analysis, evaluation, internal audit, management review and service reporting.

Clause 10 (Improvement) requires nonconformity and corrective action control and continual improvement of the SMS and services.

Documented information must be controlled: availability, protection, distribution, access, retrieval, retention, and control of changes; the organization determines what is needed for effectiveness.

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria.

Audit principles (ISO 19011): integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach.

Audit criteria are the set of policies, procedures, requirements or standards used as a reference; audit evidence is records, statements or other verifiable information.

Audit findings are results of evaluating evidence against criteria; findings can indicate conformity or nonconformity, and nonconformities are graded (e.g., major/minor).

Major nonconformity: absence of, or failure to implement and maintain, a required system element, or a situation that would cause the system to fail its objectives.

Minor nonconformity: a single observed lapse or isolated deviation that does not indicate systemic failure.

Audit types: first-party (internal), second-party (supplier/customer), third-party (certification/registration); audits may be combined, joint, or integrated.

Sampling is used because auditing is conducted within a limited time and resources; auditors must use representative samples and document the sampling rationale.

Independence: auditors must not audit their own work; the audit team must be free from bias and conflicts of interest.

Define audit objectives, scope, criteria and boundaries in consultation with the audit client; document them in the audit plan.

Perform document review of the SMS (policy, scope, procedures, records, risk assessment, internal audit and management review results) before on-site activities.

Conduct a stage 1 readiness review for initial certification audits to evaluate documentation and readiness for stage 2; stage 2 evaluates implementation and effectiveness.

Develop the audit plan: schedule, audit team roles, audit trails, sampling strategy, and allocation of time to clauses and processes.

Prepare audit working documents: checklists, audit trails, sampling plans, forms for recording evidence and findings.

Select the audit team based on competence, sector knowledge and independence; assign a lead auditor responsible for the audit.

Identify applicable legal, regulatory, contractual and customer requirements relevant to the services in scope.

Communicate the audit plan to the auditee in advance; agree access, resources, safety and confidentiality arrangements.

Determine audit criteria including ISO/IEC 20000-1, the organization's own SMS documentation, contracts and applicable regulations.

Opening meeting: confirm scope, criteria, plan, communication channels, and audit methods; confirm the auditee's understanding and any changes.

Collect objective evidence through interviews, observation of activities, and review of records and documented information; verify rather than accept assertions.

Use audit trails to follow a service, process or record from start to finish to test implementation and effectiveness.

Evaluate evidence against criteria; classify findings as conformities, opportunities for improvement, observations, minor nonconformities, or major nonconformities.

Record each nonconformity with the requirement reference, the objective evidence, and the nature of the deviation; avoid prescribing the solution.

Interview staff at multiple levels, including top management, process owners, and operational personnel, to test leadership commitment and competence.

Verify that internal audits and management reviews are performed and effective, and that corrective actions address root causes.

Sample across services in scope, shifts, locations and suppliers to test consistency and coverage.

Daily team meetings and progress reviews with the auditee keep the audit on track and clarify emerging findings.

Closing meeting: present findings, conclusions and audit opinion; explain the grading of nonconformities and agree on correction and corrective action timelines.

The audit report should include objectives, scope, criteria, dates, team, findings, conclusions, and any areas of uncertainty or limitations.

Audit conclusions address the conformity and effectiveness of the SMS and whether it meets the audit criteria; certification recommendations follow from these conclusions.

Nonconformity reports must identify the requirement, the evidence, and the significance; the auditee proposes correction and root-cause corrective action.

Verify corrective actions through follow-up audit or documented evidence review before closing nonconformities, particularly for major nonconformities.

The audit is complete when all planned activities are performed and the audit report is issued; audit records must be retained and controlled.

Confidentiality applies to all information obtained during the audit; the report distribution is agreed with the audit client.

Follow-up audits verify that corrective actions are implemented and effective before certification is granted or maintained.

Feedback to the audit team and lessons learned support improvement of the audit programme.

An audit programme is a set of one or more audits planned for a specific time frame and directed toward a specific purpose.

Programme management includes establishing objectives, identifying and evaluating risks, planning schedules, and providing resources.

The programme manager establishes the extent of the programme, considering the size, nature and complexity of the organization and the services in scope.

Audit programme risks include resource availability, auditor competence, auditee availability, and scheduling conflicts; these must be identified and managed.

Monitor and review the programme: track audit completion, findings trends, corrective action effectiveness, and stakeholder feedback.

Auditor competence must be maintained through continuing professional development, calibration, and performance evaluation.

Impartiality of the programme: separate the function managing the programme from the activities being audited where practicable.

Records of the audit programme must be retained, including plans, reports, findings, and evidence of corrective action closure.

Programme improvement uses monitoring results, feedback, and lessons learned to adjust frequency, scope and methods of future audits.