Preparing an ISO/IEC 20000 audit
Domain 4 - Preparing an ISO/IEC 20000 audit
This domain tests how to design an audit that is risk-based, evidence-driven and feasible. Preparation covers objectives, scope, criteria, audit plan, team competence, sampling and communication.
Preparation sequence
- Confirm the audit objectives: certification, surveillance, internal audit, supplier audit or follow-up.
- Define the scope: organizational units, services, locations and processes. For certification, the scope must match the certification scope and the SMS scope. Check exclusions and outsourced services.
- Establish audit criteria and review the organization's documented information, previous findings, performance data, complaints and changes.
- Assess risk to prioritize processes and services: high incident volumes, failed SLAs, recent changes, supplier dependency and regulatory exposure.
- Produce an audit plan: objectives, scope, criteria, dates, locations, time allocations, audit team roles, methods and sampling approach.
- Confirm competence and independence of auditors; assign process owners and technical experts as needed.
- Communicate the plan and logistics; prepare working documents, not closed checklists.
Worked example
Planning an audit of service transition: the auditor identifies interfaces with change management, configuration management and the service desk. The plan samples recent changes by risk and type, checks authorization, test evidence, rollback plans, communication and post-implementation review. The auditor allocates more time to high-risk changes and interviews both the transition team and the recipients. The reasoning: transition is a process with inputs from design and outputs to operations, so evidence must cross boundaries.
Traps
- Reusing last year's plan without considering changes and risk.
- Setting a scope that quietly excludes a supplier-operated service desk.
- Planning only document reviews and no interviews or observation.
- Writing checklists that demand yes/no answers and close down inquiry.
- Assigning an auditor to audit their own department or recent work.