Conducting an ISO/IEC 20000 audit
Domain 5 - Conducting an ISO/IEC 20000 audit
This domain tests fieldwork: opening meeting, evidence collection, interviewing, sampling, documenting findings, communicating and adapting the plan while staying within scope.
Fieldwork discipline
- Hold an opening meeting: confirm objectives, scope, criteria, schedule, methods, confidentiality and safety, and explain that findings are preliminary until the closing meeting.
- Collect evidence from multiple sources: interviews, observation, system screens, reports, tickets, change records, contracts and meeting minutes. Follow the audit trail from a claim to a record and from a record to the related process.
- Use open questions (walk me through...), then probe and verify. Avoid leading or yes/no questions.
- Sample deliberately: cover different services, priorities, locations, shifts and time periods. Sample size should reflect risk and the strength of controls; if you find a failure, expand the sample to test whether it is systemic.
- Record findings as you go: criterion, evidence, location, person and date. Keep factual notes; do not write conclusions you cannot support.
- Hold daily debriefs so the auditee can correct factual misunderstandings and provide missing evidence.
Worked example
Auditing problem management, the auditor selects five problem records. Two have no root-cause analysis, and one has no link to known errors or changes. The auditor checks the procedure and finds it requires root-cause analysis for all problems. The finding cites the procedure, the sampled records and the effect: recurring incidents may not be prevented. Before finalizing, the auditor asks whether any records were closed as no action under an approved exception.
Traps
- Accepting screenshots without checking the source system or date.
- Writing a nonconformity because a process differs from ITIL rather than from the criteria.
- Asking a leading question such as you do review all incidents, don't you?
- Losing independence by helping the auditee design the fix.
- Closing the audit without giving the auditee a chance to show contrary evidence.