Certification Scope When Internal IT and External Services Share the Same Machinery
Northwind Managed Services processes payroll for 40 client organizations and also runs internal IT for its own 300 staff. Both use the same service desk tool, on-call rota, data centre and two external suppliers. Client satisfaction with payroll availability is high, but new-client onboarding takes 11 weeks against a target of 6, and internal staff report slow ticket resolution. The COO wants to certify 'the IT department', including internal desktop support, to reduce duplication. The service manager wants to certify only external payroll services, arguing that internal IT has no customer and will add audit cost. A consultant notes that the last two payroll incidents were caused by a network change made for internal IT. The organization has no documented service catalogue, and its scope statement is a single sentence.
1. Recommend how Northwind should determine the scope of its SMS and certification, applying the ISO/IEC 20000-1 concepts of 'service' and 'customer'. Justify your recommendation.
Read the worked answer
Concepts. ISO/IEC 20000-1 treats a service as a means of delivering value by facilitating outcomes the customer wants, without the customer owning the associated costs and risks. A customer is the organization, or part of it, that receives the service. Internal IT can therefore be a service with internal customers, so the service manager's claim that internal IT has no customer is incorrect.
Scope decision. Scope is not a free choice. Under clause 4.3 it must be documented and justified, reflecting the organization's context, interested parties, services and interfaces. The network-change incident shows that internal IT and payroll share components. Excluding internal IT does not remove its effect on in-scope payroll services.
Recommendation. Certify one SMS covering payroll and internal IT, or at minimum include the shared data centre, network, service desk, on-call rota and suppliers, and control the interfaces. If desktop support stays outside, the scope statement must explain the boundary, list shared components and describe how changes and incidents crossing that boundary are controlled. The service catalogue should mirror the scope, showing customer-facing services and shared supporting services. The decision should be risk-based: audit cost is a weak argument against an uncontrolled change path that has already caused two payroll incidents.
2. If the certification scope excludes internal desktop support, what must the SMS still address, and how should the scope statement be worded so it remains credible to an auditor?
Read the worked answer
What must still be addressed. An exclusion cannot remove the need to control shared resources that affect in-scope services. Northwind would still need supplier management for the two external suppliers, change control for the shared network and data centre, incident and problem interfaces, capacity and availability planning across the shared platform, and service continuity arrangements that reflect the shared on-call rota. The SMS must show how work crossing the boundary is authorised, recorded and communicated.
Wording. A credible scope statement identifies the legal entity, locations, services, customers and technologies included, and then states exclusions with a rationale. For example: 'The SMS covers payroll processing services delivered to external clients, including the shared service desk, network, data centre, on-call rota and supplier interfaces on which those services depend. Internal desktop support for Northwind staff is outside the certification scope; changes to shared infrastructure that can affect in-scope services are controlled by the SMS.'
Why this survives scrutiny. The statement does not pretend the boundary is a wall. It declares dependencies and shows that the SMS controls their effect. An auditor will test whether the exclusion is honest and whether any in-scope requirement is left unmanaged. A one-sentence scope cannot demonstrate that analysis.
3. How should Northwind structure its service catalogue to support both the scope decision and the customer outcomes that current measures miss?
Read the worked answer
Two levels, not one list. Build a customer-facing layer and a supporting layer. Customer-facing services describe outcomes, such as 'payroll processed accurately and on time' and 'new client onboarding completed within six weeks'. Supporting services describe internal enablers, such as network connectivity, identity management and the service desk. Servers and applications are configuration items, not services in the catalogue.
Ownership and boundaries. Each catalogue entry needs a service owner, customer group, description, hours of operation, dependencies and the agreements that apply. Onboarding should be modelled explicitly, either as part of payroll or as a separate service with its own acceptance criteria, because the 11-week cycle is a customer-visible failure that availability reporting will never reveal.
Link to scope and measurement. The catalogue should show which services are in the certification scope and which shared supporting services affect them. That makes the scope statement operational rather than theoretical. Measures can then be defined at the service level: onboarding lead time, payroll accuracy, end-to-end transaction success and service desk resolution from the customer's perspective. A catalogue that lists only technical components would repeat the current mistake of measuring what is easy rather than what customers experience.