ISO 20000 Lead Auditor common mistakes
ISO 20000 Lead Auditor · Understand the traps and how to avoid them.
Treating ISO/IEC 20000-1 as a catalogue of ITIL processes and answering questions by naming processes (incident, problem, change) instead of the clause requirement being tested, e.g. describing an incident workflow when asked what the standard requires for service continuity.
Candidates often study from ITIL-oriented material and assume the two standards are interchangeable, so they answer from process knowledge rather than from the normative text of ISO/IEC 20000-1.
What to do instead
Before answering, identify which clause of ISO/IEC 20000-1 the question targets and answer only what that clause requires ('the organisation shall...'). Use ITIL as illustrative context, never as the source of the requirement.
Confusing the service management system (the management system: policy, objectives, planning, support, operation, performance evaluation, improvement) with the services themselves, and describing service delivery outcomes when asked about SMS conformity.
The standard's structure spans both system-level and service-level requirements, and candidates blur the two layers, especially in clauses on planning and operation.
What to do instead
Draw a two-layer diagram: the SMS (clauses on context, leadership, planning, support, operation, performance evaluation, improvement) contains the services. For each question, decide whether it asks about the management system or a service, then answer at that layer.
Missing that ISO/IEC 20000-1 requirements are largely 'shall' statements subject to audit evidence, and answering with 'should', 'best practice', or 'recommended' language that cannot be audited.
Candidates mix normative requirements with guidance from ISO/IEC 20000-2 or general good practice, and habitually soften statements.
What to do instead
Practise rewriting answers so each is a verifiable requirement: who does what, against which documented information, producing which record. If your answer cannot be evidenced by an audit trail, it is not the requirement being asked about.
Applying a checklist or 'compliance audit' mindset to ISO/IEC 20000 audits, asserting conformity from document review alone without seeking objective evidence of implementation and effectiveness.
Candidates prepare by memorising clause checklists and then equate 'document exists' with 'requirement met', forgetting the audit principle that evidence must be verified and that findings need objective evidence.
What to do instead
For every requirement, plan three evidence questions: is it defined (documented information), is it implemented (records, observation, interview), and is it effective (results, metrics, corrective action). Write audit notes that cite the specific evidence source for each conclusion.
Confusing audit criteria, audit scope, and audit objectives when drafting an audit plan, so the plan lists ITIL processes to review rather than the ISO/IEC 20000-1 clauses, organisational units, and services that define the boundaries.
Candidates conflate the 'what will be judged against' (criteria) with 'where and what we will look at' (scope) and 'why we are auditing' (objectives), and reuse generic process lists.
What to do instead
Write the three elements explicitly at the top of any plan: objectives (purpose and expected outputs), scope (organisational units, services, locations, time period, and exclusions with justification), criteria (ISO/IEC 20000-1 clauses, plus internal policies and contractual requirements). Check that every planned activity maps to a criterion within scope.
Failing to distinguish audit evidence types and their limitations, e.g. accepting a management presentation or a self-assessment spreadsheet as sufficient evidence of conformity for a requirement such as service level management or capacity management.
Candidates underestimate how much ISO/IEC 20000 evidence is documentary and how easily a document can describe an aspiration rather than a practice, and they do not triangulate sources.
What to do instead
Use the hierarchy: records generated by the process (tickets, SLAs with actual performance reports, capacity plans with trend data) outrank summaries and presentations. Corroborate at least two independent sources per conclusion and record sampling rationale (population, sample size, selection method).
Writing nonconformity statements that describe a symptom or a missing document without citing the requirement, the evidence, and the gap, e.g. 'change management is weak' or 'no evidence of continual improvement'.
Candidates draft findings from memory after the interview and do not link evidence to a specific clause, producing statements that cannot be closed or verified.
What to do instead
Use a fixed structure: requirement (clause reference and quoted requirement), evidence (what was seen, where, when, who, sample identifiers), gap (how the evidence fails to meet the requirement), and significance. Have the auditee confirm factual accuracy of the evidence before the closing meeting.
Grading findings inconsistently, labelling every observation a major nonconformity or downgrading a systemic failure to an 'opportunity for improvement', without applying the audit programme's defined criteria.
Candidates have not internalised the difference between a nonconformity (requirement not fulfilled) and an observation or improvement opportunity, nor the major/minor distinction based on systemic breakdown versus isolated lapse.
What to do instead
Before the audit, agree the grading definitions in the audit plan: nonconformity versus observation, and major (systemic or unaddressed failure of a requirement, or failure to correct a previously identified issue) versus minor (isolated lapse not indicating system failure). Justify each grade in the finding itself and cross-check against a second finding for consistency.
Overlooking the requirement to audit the effectiveness of the SMS as a whole, including performance evaluation and improvement, and treating the audit as a clause-by-clause document check that never tests whether the management system is achieving its intended outcomes.
Candidates focus on operational clauses they know well and skip the system-level clauses (monitoring, measurement, analysis, evaluation, internal audit, management review, improvement), which are exactly where effectiveness is demonstrated.
What to do instead
Build the plan around the Plan-Do-Check-Act logic of the standard: test planning and objectives, then operation, then monitoring and measurement results, internal audit outputs, management review decisions, and improvement actions. Ask for the last management review minutes and follow the resulting actions to closure as evidence of effectiveness.
Managing the audit programme as a one-off event rather than a cycle, omitting risk-based scheduling, auditor competence and impartiality checks, and follow-up of previous findings when describing how an ISO/IEC 20000 audit programme is run.
Candidates prepare for a single audit and answer programme questions with single-audit language, forgetting requirements for competence, independence, programme monitoring, and continual improvement of the programme itself.
What to do instead
For programme questions, always cover: risk-based frequency and scope of audits, auditor competence and impartiality (no auditing own work), programme resources, communication and reporting to top management, performance monitoring of the programme, and tracking of corrective actions from prior audits to closure.