I85PREP
⌘ K
ISO 20000 Lead Auditor study materials
ISO 20000 Lead Auditor study resources

ISO 20000 Lead Auditor practice questions

One question at a time. Build your ISO 20000 Lead Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a service management system

In ISO/IEC 20000-1, what does the term "service management system" (SMS) refer to?

  1. The contractual agreement that defines service levels with a customer
  2. The organizational unit responsible for procuring hardware and software assets
  3. The single IT service desk application used to log and resolve incidents
  4. The set of interrelated or interacting elements an organization uses to plan, establish, implement, operate, monitor, review, maintain and improve service management Correct answer.

Explanation

The SMS is defined as a management system, meaning a set of interrelated or interacting elements, that covers the full lifecycle of service management activities. It is broader than any single tool, contract, or department, and it must be established, implemented, maintained and continually improved.

Question 2Fundamental principles and concepts of a service management system

Which statement best describes the relationship between ISO/IEC 20000-1 and the supporting guidance in ISO/IEC 20000-2?

  1. Both parts contain mandatory requirements and an organization must conform to both
  2. Part 2 replaces Part 1 for organizations that use cloud services
  3. Part 1 contains requirements that can be audited for conformity, while Part 2 provides guidance on applying those requirements Correct answer.
  4. Part 1 provides guidance and Part 2 contains the auditable requirements

Explanation

ISO/IEC 20000-1 is the normative requirements standard against which certification audits are conducted, while ISO/IEC 20000-2 offers guidance and examples for applying Part 1. Only Part 1 clauses contain auditable "shall" requirements.

Question 3Fundamental principles and concepts of a service management system

An organization adopts the Plan-Do-Check-Act cycle for its SMS. Which activity belongs to the "Check" phase?

  1. Taking corrective action to improve service performance
  2. Monitoring, measuring and reviewing service performance against agreed requirements Correct answer.
  3. Defining the service management policy and objectives
  4. Implementing the service management processes and delivering services

Explanation

Check covers monitoring, measurement, analysis and review of performance against the planned objectives and requirements. Planning sets policy and objectives, Do implements and operates, and Act drives corrective action and improvement.

Question 4Fundamental principles and concepts of a service management system

In ISO/IEC 20000-1 terminology, which best describes a "service"?

  1. A means of delivering value to the customer by facilitating outcomes the customer wants to achieve without the customer owning specific costs and risks Correct answer.
  2. The agreed maximum acceptable duration of an unplanned interruption
  3. A formal request from a user for something to be provided, such as a password reset
  4. A documented description of the technical configuration of an infrastructure component

Explanation

A service delivers value by enabling customer outcomes while transferring associated costs and risks to the service provider. This outcome-and-value orientation distinguishes services from components, requests and targets.

Question 5Fundamental principles and concepts of a service management system

Which pair correctly matches the ISO/IEC 20000-1 terms for the party receiving services and the party accountable for providing them?

  1. Supplier and internal auditor
  2. Customer and service provider Correct answer.
  3. Top management and interested party
  4. User and process owner

Explanation

The customer is the organization or person that receives a service, and the service provider is the organization that provides it. Suppliers and users are distinct roles, and auditors or top management are not defined by the service relationship.

Question 6Fundamental principles and concepts of a service management system

What is the primary purpose of top management demonstrating leadership with respect to the SMS?

  1. To ensure the SMS is integrated into the organization's business processes and that policy and objectives are established and supported Correct answer.
  2. To delegate all SMS decisions to an external certification body
  3. To personally perform all incident resolution activities
  4. To replace documented processes with informal verbal instructions

Explanation

Leadership requires top management to align the SMS with business direction, establish policy and objectives, and provide resources and support. It is a governance responsibility rather than operational execution.

Question 7Fundamental principles and concepts of a service management system

Which statement reflects the process approach emphasized in ISO/IEC 20000-1?

  1. Processes should be defined only after certification has been achieved
  2. Understanding how interrelated processes interact as a system helps achieve intended results consistently Correct answer.
  3. Process performance is measured solely by the number of documents produced
  4. Each process must operate in isolation to avoid cross-departmental dependency

Explanation

The process approach means managing activities as interrelated processes whose interactions are understood and controlled to achieve consistent, intended results. Isolation, delayed definition and document counting contradict this principle.

Question 8Fundamental principles and concepts of a service management system

Which of the following is an example of a service management objective that fits the intent of ISO/IEC 20000-1?

  1. Document every meeting held by the service management team
  2. Reduce unplanned service downtime affecting critical business services by a defined percentage within a stated period Correct answer.
  3. Employ more staff than any competitor in the region
  4. Purchase the most expensive monitoring tool available on the market

Explanation

Objectives should be measurable, relevant to service performance and consistent with the service management policy. Reducing unplanned downtime for critical services is a measurable service outcome, whereas tool cost, headcount comparison and meeting documentation are not service objectives.

Question 9Fundamental principles and concepts of a service management system

A provider defines a service, agrees its outcomes with the customer, and identifies responsibilities and interfaces. Which concept of the SMS domain does this primarily illustrate?

  1. Managing supplier contracts by price only
  2. Managing services through defined, agreed and controlled service relationships Correct answer.
  3. Managing audit findings by closing them without analysis
  4. Managing risks by transferring them all to the customer

Explanation

The SMS requires services to be defined, agreed with the customer, and managed through clear responsibilities, interfaces and performance expectations. This is about controlled service relationships rather than procurement price, audit handling or risk transfer.

Question 10Fundamental principles and concepts of a service management system

Which statement best explains why documented information is required within the SMS?

  1. It guarantees that no service failures will occur
  2. It provides evidence that processes are performed as planned and supports consistent operation and traceability Correct answer.
  3. It allows the organization to avoid reviewing its processes
  4. It eliminates the need for competence and awareness of personnel

Explanation

Documented information supports consistent process operation and provides evidence of conformity and effectiveness for audit and improvement. It does not prevent failures, replace competence, or remove the need for review.

Question 11Fundamental principles and concepts of a service management system

In ISO/IEC 20000-1, what does "continual improvement" of the SMS require?

  1. Improving only after a major incident or a failed audit
  2. Replacing all existing processes with new ones at fixed intervals
  3. Identifying opportunities and implementing changes to improve service management performance and the value delivered Correct answer.
  4. Increasing the number of documented procedures each year

Explanation

Continual improvement is a proactive, ongoing activity that identifies opportunities and implements changes to enhance performance and value. It is not limited to reactive triggers, wholesale replacement or document growth.

Question 12Fundamental principles and concepts of a service management system

Which principle explains why ISO/IEC 20000-1 requires the SMS to consider the organization's context and interested parties?

  1. The SMS must ignore legal and regulatory obligations to remain flexible
  2. The SMS must be designed exclusively around the IT department's preferences
  3. The SMS must be identical in every organization regardless of size or sector
  4. The SMS must be relevant to the organization's internal and external environment and the needs of parties affected by its services Correct answer.

Explanation

Understanding context and interested parties ensures the SMS is appropriate to the organization's environment, obligations and stakeholders. The standard is scalable and does not impose an identical design on all organizations.

Question 13Fundamental principles and concepts of a service management system

A service provider wants to demonstrate that its SMS supports the organization's strategic direction. Which action best reflects this principle?

  1. Setting service objectives based only on the preferences of the IT operations team
  2. Aligning service management objectives with the organization's business goals and integrating the SMS into business processes Correct answer.
  3. Keeping service management separate from business planning to preserve technical focus
  4. Outsourcing all service management decisions to a technology vendor

Explanation

Integration means the SMS and its objectives support the organization's strategy and are embedded in business processes. Isolation from business planning, narrow IT preferences, and vendor control of decisions undermine that alignment.

Question 14Fundamental principles and concepts of a service management system

Which of the following best describes the role of risk management as a foundational concept in the SMS?

  1. Recording risks without assigning owners or actions
  2. Identifying and treating risks that could affect the delivery of services and the achievement of service management objectives Correct answer.
  3. Transferring every operational risk to suppliers through contracts
  4. Eliminating all risk so that no service interruption can ever occur

Explanation

Risk management in the SMS means identifying, assessing and treating risks to service delivery and objectives, with owners and actions. Total elimination and wholesale transfer are unrealistic, and unowned risk records provide no control.

Question 15Fundamental principles and concepts of a service management system

A provider uses a single SMS to deliver both internal and external services. What does ISO/IEC 20000-1 require regarding scope?

  1. Scope must be limited to a single department to simplify audits
  2. Scope may be left undefined provided services are delivered
  3. Scope must always cover the entire organization without exception
  4. The scope of the SMS must be defined and documented, including the services and organizational units covered Correct answer.

Explanation

The standard requires a documented scope that identifies the services and organizational units covered by the SMS. It can be tailored but must be defined; it need not cover the whole organization, nor be arbitrarily limited.

Question 16Fundamental principles and concepts of a service management system

Which statement correctly distinguishes a "service level agreement" from a "service level target"?

  1. An agreement applies only to suppliers, while a target applies only to users
  2. An agreement is a documented commitment between provider and customer, while a target is a measurable goal within or supporting that commitment Correct answer.
  3. An agreement is an internal technical metric, while a target is a legal contract
  4. An agreement is optional, while a target is always legally binding

Explanation

A service level agreement records commitments agreed between the provider and customer, whereas targets are measurable goals used to manage performance. Agreements are not merely internal metrics, and targets are not automatically legal contracts.

Question 17Fundamental principles and concepts of a service management system

Why does ISO/IEC 20000-1 emphasize the need for a service management policy?

  1. It defines the audit methodology used by certification bodies
  2. It replaces the need for any measurable service objectives
  3. It sets the framework for establishing objectives and demonstrates management commitment to the SMS Correct answer.
  4. It specifies the technical architecture of all services

Explanation

The policy provides direction, frames objectives and evidences top management commitment. It does not substitute for measurable objectives, prescribe technical architecture, or define external audit methods.

Question 18Fundamental principles and concepts of a service management system

Which statement best captures the meaning of "value" in the context of service management?

  1. Value is determined solely by the number of features in a service
  2. Value is created only by the service provider and never by the customer
  3. Value is realized when the service enables the customer's desired outcomes at acceptable cost and risk Correct answer.
  4. Value is measured only by the price the customer pays

Explanation

Value is outcome-oriented: it arises when services facilitate customer results with acceptable trade-offs of cost and risk. Feature counts, price alone, and one-sided creation do not capture this concept.

Question 19Fundamental principles and concepts of a service management system

An organization is deciding which services to include in the scope of its SMS. Which consideration is most consistent with ISO/IEC 20000-1 principles?

  1. Including only services with the lowest operational cost
  2. Including services whose failure would significantly affect business outcomes and the interfaces they depend on Correct answer.
  3. Excluding all services that have ever experienced an incident
  4. Excluding services used by external customers to simplify reporting

Explanation

Scope decisions should reflect business importance and the interdependencies that affect service delivery. Excluding services based on incident history, low cost or customer type can leave critical risks and interfaces outside the SMS.

Question 20Fundamental principles and concepts of a service management system

What is the significance of the "service management system" being described as a management system rather than a set of IT tools?

  1. It can only be operated by external service providers
  2. It is a one-time project with a defined end date
  3. It comprises coordinated policies, objectives, processes and roles that must be governed and continually improved Correct answer.
  4. It must be purchased as a commercial software product

Explanation

A management system is a coordinated set of policies, objectives, processes and roles that is governed, reviewed and improved. It is not a purchasable product, cannot be delegated only to external parties, and is not a one-time project.

Question 21Fundamental principles and concepts of a service management system

A provider claims its SMS is effective because all staff attended training. Which reasoning best evaluates this claim?

  1. Training addresses competence, but effectiveness also requires that processes achieve intended results and meet requirements Correct answer.
  2. Effectiveness is irrelevant if staff hold professional certifications
  3. Training alone proves effectiveness because competent staff guarantee process outcomes
  4. Effectiveness is proven only by the number of training hours delivered

Explanation

Competence is necessary but not sufficient; effectiveness concerns the extent to which planned activities achieve intended results. Training volume or certifications do not by themselves demonstrate process performance.

Question 22Fundamental principles and concepts of a service management system

Two departments share a service, but only one is within the defined SMS scope. What is the most significant risk from a conformity perspective?

  1. Sharing a service removes the need for service level agreements
  2. Interfaces and dependencies outside the scope may be uncontrolled, undermining the effectiveness of the SMS for the in-scope service Correct answer.
  3. The scope statement becomes legally invalid
  4. The out-of-scope department will automatically be certified

Explanation

Scope boundaries do not remove dependencies; interfaces with out-of-scope parties must still be managed to ensure the SMS achieves its intended results. Uncontrolled interfaces can undermine effectiveness and conformity.

Question 23Fundamental principles and concepts of a service management system

Which statement best explains how the process approach and the PDCA cycle relate within the SMS?

  1. PDCA and the process approach are unrelated concepts used in different standards
  2. PDCA provides the cyclical logic for establishing, operating, reviewing and improving the interrelated processes of the SMS Correct answer.
  3. The process approach replaces PDCA once certification is obtained
  4. PDCA applies only to incident management, while the process approach applies only to suppliers

Explanation

PDCA supplies the iterative structure that drives the processes of the SMS through planning, operation, review and improvement. The two concepts are complementary, not mutually exclusive or limited to single processes.

Question 24Fundamental principles and concepts of a service management system

An auditor finds that service objectives exist but are not linked to the service management policy or to customer requirements. Which conclusion is most defensible?

  1. The objectives are acceptable because any objective satisfies the requirement
  2. The policy must be deleted so the objectives can stand alone
  3. Customer requirements are irrelevant once objectives are documented
  4. The objectives are not consistent with the policy framework and may not support the intended outcomes of the SMS Correct answer.

Explanation

Objectives must be consistent with the policy and relevant to requirements and service performance. Objectives that are disconnected from policy and customers fail to provide meaningful direction for the SMS.

Question 25Fundamental principles and concepts of a service management system

Which statement best reflects the principle that the SMS should deliver value to both the customer and the service provider?

  1. The SMS should balance customer outcomes with the provider's need to manage costs, risks and resources sustainably Correct answer.
  2. The SMS should ignore the interests of either party to remain neutral
  3. The SMS should maximize customer satisfaction regardless of provider viability
  4. The SMS should minimize provider costs even if customer outcomes suffer

Explanation

Sustainable service management considers both customer outcomes and the provider's capacity to deliver them over time. Ignoring either side's interests undermines the long-term value of the service relationship.

Question 26Fundamental principles and concepts of a service management system

In ISO/IEC 20000-1, which statement best describes the relationship between the service management system (SMS) and the services it covers?

  1. The SMS is the contractual schedule that lists service levels agreed with each customer.
  2. The SMS is a set of documented procedures that must be applied identically to every service in the catalog.
  3. The SMS is the technical tooling platform that monitors infrastructure and records incidents for the provider.
  4. The SMS is the management framework of policies, objectives, and processes used to direct and control the service lifecycle for the services within its scope. Correct answer.

Explanation

ISO/IEC 20000-1 treats the SMS as a management system: an interrelated set of policies, objectives, and processes by which the provider directs and controls service management across the service lifecycle. It is not a fixed procedure set applied identically, nor a tool or a contract schedule, although those may support it.

Question 27Fundamental principles and concepts of a service management system

A service provider is defining the scope of its SMS. It offers a customer-facing service and an internal service to its own staff. What does ISO/IEC 20000-1 require regarding the scope?

  1. The scope must exclude internal services because the standard applies only to external customers.
  2. The scope may be left implicit provided top management understands which services are covered.
  3. The scope must include every service the organization delivers, regardless of whether it is customer-facing.
  4. The scope must be documented and state which services and organizational units are covered, with justification for any exclusion. Correct answer.

Explanation

ISO/IEC 20000-1 requires the scope of the SMS to be documented and to identify the services and organizational units covered. Where a service or unit is excluded, the provider must be able to justify the exclusion, so the scope cannot be left implicit.

Question 28Fundamental principles and concepts of a service management system

An auditor is reviewing how a provider applies the PDCA cycle to its SMS. Which finding best demonstrates that the provider is applying the 'Check' phase as intended by ISO/IEC 20000-1?

  1. The provider has defined service level targets for the coming year.
  2. The provider has published a service management policy signed by top management.
  3. The provider has implemented a new incident management tool across all support teams.
  4. The provider monitors and measures service performance and reports results against planned objectives and requirements. Correct answer.

Explanation

In the PDCA cycle, 'Check' covers monitoring, measurement, and reporting of performance against planned objectives and requirements. Publishing policy and defining targets belong to planning, while implementing tooling belongs to doing.

Question 29Fundamental principles and concepts of a service management system

A provider's SMS has processes for incident, problem, and change management, but no process for managing the service catalogue or for measuring service performance. Which conclusion is most consistent with ISO/IEC 20000-1?

  1. The SMS is acceptable because incident, problem, and change management are the only mandatory processes.
  2. The SMS is acceptable because service catalogue and performance measurement are optional good practices.
  3. The SMS is incomplete only if a customer has complained about the missing processes.
  4. The SMS is incomplete because the standard requires processes to be established for the full set of service management activities within the scope. Correct answer.

Explanation

ISO/IEC 20000-1 expects the SMS to include the processes needed to manage the services in scope, including service catalogue management and measurement of service performance, not only the operational incident, problem, and change processes. Absence of required processes is a gap in the management system regardless of complaints.

Question 30Service management system requirements

ISO/IEC 20000-1 requires the service management system (SMS) to be established, implemented, maintained and continually improved. Which clause structure element of the standard primarily expresses this requirement for the SMS as a whole?

  1. Operation of the SMS Correct answer.
  2. Context of the organization
  3. Normative references
  4. Leadership

Explanation

Clause 8 (Operation) is where the standard requires the organization to plan, implement and control the processes needed to meet requirements and to implement the actions determined in Clause 6, including planned changes and reviewing consequences of unintended changes. Context (Clause 4) and Leadership (Clause 5) support the SMS but do not carry the operational delivery requirement. Normative references contain no requirements at all.

Question 31Service management system requirements

When defining the scope of the SMS, ISO/IEC 20000-1 requires the organization to determine which of the following?

  1. A list of every configuration item held in the CMDB
  2. The services provided and the organizational units that deliver them Correct answer.
  3. The financial budget allocated to service continuity
  4. The names of all suppliers with contracts longer than one year

Explanation

The scope statement must identify the services and the organizational units (parts of the organization) covered by the SMS, together with interfaces and dependencies where relevant. Configuration items, supplier lists and budgets are supporting information, not the elements the scope must determine. This keeps the scope auditable and comparable to what is actually delivered.

Question 32Service management system requirements

An auditor finds that the service management policy exists but has not been communicated within the organization. Which requirement of ISO/IEC 20000-1 is most directly affected?

  1. Monitoring and measurement of service performance
  2. Planning of changes, including impact assessment
  3. Management of knowledge and documented information
  4. Leadership and commitment, including ensuring the policy is communicated Correct answer.

Explanation

Top management must ensure the service management policy is appropriate, communicated within the organization and available to relevant interested parties. Communication of the policy is an explicit leadership commitment, so a policy that exists but is unknown to staff fails that requirement. The other clauses concern change planning, performance measurement and documented information respectively, none of which is the primary issue.

Question 33Service management system requirements

Which of the following best describes the role of the service management system within ISO/IEC 20000-1?

  1. A software tool used to record incidents and changes
  2. A framework of interrelated processes and governance that directs and controls service management Correct answer.
  3. A certification mark applied to individual IT products
  4. A contractual agreement between the service provider and its customers

Explanation

The SMS is a management system: a set of interrelated or interacting elements, including policies, objectives and processes, used to direct and control service management. It is not a tool, a contract or a product mark. Certification applies to the organization's SMS, not to individual products or software.

Question 34Service management system requirements

An organization wants to claim conformity with ISO/IEC 20000-1. What must it do with respect to the standard's requirements?

  1. Adopt every ISO/IEC 20000-2 guidance recommendation as mandatory
  2. Certify each service individually with the certification body
  3. Meet all applicable requirements and be able to demonstrate conformity Correct answer.
  4. Apply only the clauses relevant to its largest customer

Explanation

Conformity requires the organization to meet all applicable requirements of ISO/IEC 20000-1 and to be able to demonstrate that conformity through evidence. Part 2 provides guidance and is not a set of mandatory requirements, and certification covers the SMS as scoped, not individual services. Selective application of clauses would break the integrity of the management system.

Question 35Service management system requirements

Top management is required to demonstrate leadership with respect to the SMS. Which action best evidences this requirement?

  1. Approving the purchase of a new service desk tool
  2. Ensuring SMS objectives are compatible with strategic direction and integrating them into business processes Correct answer.
  3. Attending the annual certification audit as an observer
  4. Delegating all SMS decisions to the external auditor

Explanation

Leadership includes ensuring the SMS objectives are established and compatible with the organization's strategic direction, and integrating SMS requirements into the organization's business processes. Delegating decisions to an auditor is inappropriate, and tool purchase or audit attendance alone does not demonstrate integration and direction. Leadership is about direction-setting and integration, not passive presence.

Question 36Service management system requirements

An organization identifies interested parties relevant to the SMS. Which pair of factors must be determined for the SMS?

  1. The relevant requirements of interested parties and which of these will be addressed Correct answer.
  2. The marketing budget and social media strategy
  3. The salary bands and job grades of service desk staff
  4. The hardware refresh cycle and asset depreciation method

Explanation

Clause 4 requires the organization to determine the interested parties relevant to the SMS and the relevant requirements of those parties, and to decide which of those requirements will be addressed by the SMS. Salary bands, marketing strategy and asset depreciation are organizational details that do not constitute the required determination. This determination feeds the scope and planning of the SMS.

Question 37Service management system requirements

An auditor reviews the organization's risk treatment for the SMS. Which requirement does ISO/IEC 20000-1 place on risks and opportunities?

  1. Risk registers must be maintained exclusively by the finance department
  2. Only risks affecting customer satisfaction must be recorded
  3. Risks and opportunities must be determined and actions planned and integrated into SMS processes Correct answer.
  4. All risks must be eliminated before certification

Explanation

Clause 6 requires the organization to determine risks and opportunities that need to be addressed, plan actions to address them, and integrate and implement those actions into its SMS processes. It does not restrict attention to customer satisfaction risks, mandate a specific owner department, or require elimination of all risks. The focus is on planned, integrated treatment.

Question 38Service management system requirements

The organization sets an SMS objective to reduce major incidents by 30% within a year. Which element is required to make this objective consistent with ISO/IEC 20000-1?

  1. It must be identical to the objectives of all suppliers
  2. It must be published on the public website
  3. It must be approved by the certification body before implementation
  4. It must be measurable and monitored, with responsibilities and a timeframe Correct answer.

Explanation

SMS objectives must be consistent with the policy, measurable where practicable, monitored, communicated, and supported by plans that state what will be done, resources needed, responsible persons, timeframe and evaluation of results. Certification bodies do not pre-approve objectives, and public publication or supplier alignment is not required. Measurability and ownership make the objective auditable.

Question 39Service management system requirements

A service provider has outsourced its network operations to a supplier. What does ISO/IEC 20000-1 require regarding this arrangement?

  1. The supplier must use the same service desk tool as the provider
  2. The organization remains responsible for conformity of the outsourced processes within the SMS scope Correct answer.
  3. The supplier must be certified to ISO/IEC 20000-1 before the services can be delivered
  4. The outsourced process can be removed from the SMS scope entirely

Explanation

When processes or functions are outsourced, the organization retains responsibility for ensuring the outsourced processes conform to ISO/IEC 20000-1 requirements within the SMS scope, and must control them through agreements and monitoring. Supplier certification is not a prerequisite, scope cannot simply exclude accountability, and tool uniformity is not required. Control and accountability stay with the certified organization.

Question 40Service management system requirements

Which document must the organization establish and maintain to describe how the SMS and its processes interact?

  1. A service catalogue listing every product SKU
  2. Documented information describing the scope and processes of the SMS Correct answer.
  3. A list of all customer complaints for the last three years
  4. A training plan for every employee in the organization

Explanation

The organization must maintain documented information that describes the scope of the SMS and the processes and their interaction, providing a coherent view of how the system works. A product SKU list, complaint history or organization-wide training plan may exist but does not fulfil this specific requirement. This documented information is a core audit entry point.

Question 41Service management system requirements

During an audit, the auditor samples service reports and finds that performance against service targets is reviewed monthly by service owners, but no corrective action is taken when targets are missed. Which requirement is most clearly unfulfilled?

  1. Determination of legal and regulatory requirements
  2. Competence of internal auditors
  3. Monitoring, measurement, analysis and evaluation leading to improvement actions Correct answer.
  4. Control of externally provided processes

Explanation

Monitoring and measurement must be planned and used: results are analysed and evaluated, and where performance falls short, action is taken to address the shortfall and improve. Simply reviewing reports without acting breaks the link between measurement and improvement. Legal requirements, auditor competence and supplier control are separate requirements not evidenced here.

Question 42Service management system requirements

An auditor is verifying that the organization has planned its SMS changes in a controlled manner. Which evidence is most relevant to this requirement?

  1. A signed lease for the data centre building
  2. A list of staff birthdays maintained by HR
  3. The organization's marketing brochure
  4. Records of impact assessment and authorization for significant SMS changes Correct answer.

Explanation

Changes to the SMS must be planned and carried out in a controlled way, which typically means assessing impact, considering consequences of unintended changes, and authorizing changes before implementation. Lease documents, HR lists and brochures do not evidence change control. Records showing assessment and authorization directly demonstrate the control.

Question 43Service management system requirements

Which statement correctly distinguishes ISO/IEC 20000-1 from ISO/IEC 20000-2?

  1. Part 1 contains requirements for certification; Part 2 provides guidance on applying Part 1 Correct answer.
  2. Part 1 is guidance only; Part 2 contains the certifiable requirements
  3. Both parts contain mandatory requirements that must be met together
  4. Part 1 applies to suppliers; Part 2 applies to customers

Explanation

ISO/IEC 20000-1 specifies requirements for an SMS and is the part against which conformity can be assessed and certified. ISO/IEC 20000-2 provides guidance on the application of Part 1 and is not a set of requirements. Both parts apply to service providers, not separately to suppliers and customers. Confusing the two leads auditors to raise nonconformities against guidance text.

Question 44Service management system requirements

The organization's SMS scope statement lists all services but omits the internal IT unit that delivers them. What is the most significant consequence for the SMS?

  1. The certification body will automatically withdraw the organization's licence
  2. The omission has no effect because internal units are outside the standard
  3. The scope is incomplete and the SMS may not cover the units actually delivering the services Correct answer.
  4. The supplier contracts become void

Explanation

The scope must identify the services and the organizational units that provide them; omitting the delivering unit makes the scope incomplete and undermines the credibility of conformity. Certification bodies do not automatically withdraw licences, internal units are not outside the standard, and supplier contracts are unaffected. An incomplete scope is a substantive audit finding.

Question 45Service management system requirements

An auditor finds that the service management policy has not been reviewed for three years while the business has changed substantially. Which requirement is most directly at risk?

  1. The policy must name every individual employee
  2. The policy must be written by the certification body
  3. The policy must be appropriate to the purpose of the organization and provide a framework for objectives Correct answer.
  4. The policy must be identical to the quality policy of the organization

Explanation

The service management policy must be appropriate to the purpose and context of the organization, provide a framework for setting objectives, and be reviewed for continuing suitability. A stale policy after substantial business change risks no longer being appropriate. The policy is not written by the certification body, need not mirror a quality policy, and does not name every employee.

Question 46Service management system requirements

Which of the following is the best example of a measurable SMS objective that meets ISO/IEC 20000-1 expectations?

  1. Ensure all staff are happy at work
  2. Implement the latest technology available in the market
  3. Achieve 90% first-contact resolution on the service desk by 31 December, owned by the service desk manager Correct answer.
  4. Improve customer satisfaction as much as possible

Explanation

An acceptable objective is specific, measurable, time-bound, assigned to a responsible person and consistent with the policy. '90% first-contact resolution by 31 December, owned by the service desk manager' meets all these criteria. Aspirational statements without metrics, timeframes or ownership cannot be monitored or evaluated.

Question 47Service management system requirements

An organization's SMS covers three data centres but the scope statement refers only to 'IT services'. Why is this a weakness from an audit perspective?

  1. The scope must be approved by the customer's auditor
  2. Scope statements must always be shorter than one page
  3. The scope must list every employee's job title
  4. The scope must identify the services and organizational units covered so that boundaries and applicability are clear Correct answer.

Explanation

A scope that merely says 'IT services' does not identify which services and which organizational units are covered, leaving boundaries and applicability ambiguous and making conformity hard to verify. Length limits, job titles and customer auditor approval are not requirements. Clear scope enables the auditor to test whether all in-scope processes are controlled.

Question 48Service management system requirements

An auditor notes that the organization's risk assessment for the SMS is performed once at the start of the year and never revisited, even after a major outage. Which requirement is most clearly not met?

  1. Risks must be recorded in a specific software tool
  2. Risks must be approved by every customer
  3. Risks must be quantified in monetary terms
  4. Risks and opportunities must be determined on an ongoing basis and actions updated as the context changes Correct answer.

Explanation

Determining risks and opportunities is not a one-off exercise; the organization must keep it current as context changes and update planned actions accordingly, especially after significant events such as a major outage. Monetary quantification, customer approval and a specific tool are not requirements. Ongoing determination is what keeps risk treatment effective.

Question 49Service management system requirements

Which situation best demonstrates that top management has integrated SMS requirements into the organization's business processes?

  1. Service performance objectives appear in the annual business plan and are reviewed at management reviews Correct answer.
  2. The SMS is managed as a separate project with no link to business planning
  3. The service management policy is stored in a locked cabinet
  4. The SMS coordinator works alone without management involvement

Explanation

Integration means SMS requirements are embedded in how the organization runs, for example through business planning and management review. Isolating the SMS as a separate project, hiding the policy or relying on one person without management involvement indicates the opposite. Integration is a hallmark of effective leadership and a strong audit indicator.

Question 50Service management system requirements

During an audit of the SMS, the auditor finds that a supplier provides the incident management tool but the organization's own staff perform incident handling. Who is accountable for incident management conformity?

  1. The organization whose SMS is being audited, because it performs the process Correct answer.
  2. No one, because the process is partially outsourced
  3. The tool supplier, because it provides the platform
  4. The customer, because it receives the service

Explanation

Accountability for conformity of processes within the SMS scope rests with the organization being audited, regardless of which tools or suppliers support them. The supplier provides a platform but does not perform incident handling, and the customer receives the service rather than owning the process. Outsourcing support does not dilute the organization's accountability.