ISO 20000 Lead Auditor key terms

A documented framework of policies, objectives, processes and resources an organization uses to direct and control its service management activities and deliver value to customers.

Top management's stated intentions and direction for service management, providing the framework within which service management objectives and processes are established and reviewed.

A means of delivering value to customers by facilitating outcomes they want to achieve, without the customer owning the specific costs and risks involved.

A documented agreement between a service provider and a customer that identifies services and expected service levels, often including responsibilities, targets and reporting arrangements.

An internal agreement between parts of the same service provider organization that supports delivery of service levels agreed with customers, defining internal responsibilities and targets.

A structured repository of information about services available or delivered, including their description, status, orderable items and dependencies, used by customers and provider staff.

The documented boundaries of the service management system, stating which services, locations, organizational units and interfaces are covered and which are excluded.

The internal and external issues, interested parties and their requirements that are relevant to the organization's purpose and affect its ability to achieve intended SMS outcomes.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity related to service management, such as customers, regulators or staff.

Potential negative effects and potential beneficial possibilities that the organization must identify and address so the SMS can achieve intended results and prevent undesired outcomes.

Information the organization must control and maintain, including documented policies, plans, procedures and records, together with the media that carry them.

Recurring activity to enhance performance of the SMS and its services, typically driven by measurement, analysis, corrective action and planned improvement opportunities.

A failure to meet a specified requirement, whether from ISO/IEC 20000, the organization's own SMS requirements, or applicable legal, regulatory or contractual obligations.

Action taken to eliminate the cause of a detected nonconformity or other undesirable situation so that it does not recur, including root cause analysis and verification of effectiveness.

A structured investigation that identifies the underlying reason a nonconformity or problem occurred, rather than only its immediate symptoms, to enable effective corrective action.

A measurable value used to track progress toward a specific service management objective, selected so that it is relevant, comparable over time and actionable.

The collection, analysis and reporting of data on service delivery against agreed targets, used to demonstrate effectiveness of the SMS and support decisions and improvement.

An unplanned interruption to, or reduction in the quality of, a service; it may also cover a failure of a configuration item that has not yet affected service.

A cause, or potential cause, of one or more incidents, investigated and managed so that recurrences and their impact are reduced or eliminated.

The addition, modification or removal of anything that could affect services, including configuration items, processes, documentation and supporting infrastructure, managed to control risk.

The process for governing relationships with external suppliers, including selection, contract agreements, performance monitoring and control of risks arising from outsourced services.

A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

The set of policies, procedures, requirements or standards used as a reference against which audit evidence is compared, such as ISO/IEC 20000 and the organization's own SMS documentation.

Records, statements of fact or other information relevant to the audit criteria that are verifiable and can be relied upon when forming audit findings.

Data supporting the existence or truth of something, obtained through observation, measurement, testing or review of records, and independent of personal opinion.

The result of evaluating collected audit evidence against audit criteria, which may indicate conformity or nonconformity and is recorded to support conclusions and reporting.

A finding that is not a nonconformity but indicates a risk, weakness or opportunity that the auditee should consider, often reported without requiring formal corrective action.

A finding that identifies a possible way to enhance performance or effectiveness, reported separately from nonconformities because no requirement is currently being breached.

A nonconformity that significantly affects the capability of the management system to achieve intended results, or a total failure to meet a requirement, requiring prompt correction.

A nonconformity that has limited impact on the effectiveness of the management system, is isolated or does not indicate a systemic breakdown of a requirement.

The documented extent and boundaries of an audit, including the organizational units, locations, services, processes and time period covered, and stated in the audit plan.

A description of the activities and arrangements for an audit, covering objectives, criteria, scope, schedule, audit team, and allocation of resources and responsibilities.

A set of one or more audits planned for a specific time frame and directed toward a specific purpose, managed to ensure coverage and effective use of resources.

The person assigned responsibility for managing an audit programme, including planning, resourcing, monitoring implementation and reviewing the programme for improvement.

The demonstrated personal attributes plus ability to apply knowledge and skills needed to conduct audits effectively, including sector knowledge, audit techniques and communication skills.

One or more auditors conducting an audit, supported where needed by technical experts, led by an audit team leader who manages the audit and its conclusions.

A formal meeting at the start of an audit where the audit team confirms the plan, scope and criteria, explains methods and confirms communication channels and availability of evidence.

A formal meeting at the end of an audit where findings, conclusions and recommendations are presented to the auditee and management, and any disagreement is clarified.

A documented output of the audit that records objectives, scope, criteria, findings, conclusions and any agreed follow-up, issued to those responsible for acting on it.

Selecting a representative subset of records, processes or activities for examination, used when full examination is impractical, with the limitation disclosed in findings.

An audit activity carried out to verify that corrective actions for previously reported nonconformities have been implemented and are effective in closing the gap.