Sequencing an Eight-Month SMS Implementation Around an ERP Migration
MetroShare is a public-sector shared service centre providing HR, finance and IT services to 14 government agencies and 9,000 employees. It holds ISO/IEC 27001 certification, has informal ITIL practices and a service desk tool, but no documented SMS, no service catalogue and no management review for 18 months. A large tender requires ISO/IEC 20000-1 certification within eight months. The board has approved two full-time staff and 20 days of external consultancy. A major ERP migration will occupy the service manager and most engineers from month 4 to month 6. Internal audit currently covers only information security and reports to the CISO; the last audit found three high-risk findings that are still open. The IT director wants to 'write the documents first' and start internal audit in month 7.
1. Construct a sequenced eight-month implementation plan. Explain why the IT director's 'documents first' approach is likely to fail and what should happen in months 1–2.
Read the worked answer
Why documents first fails. Documents written before the SMS is designed become shelfware. They describe processes nobody owns, cannot be evidenced in operation and usually collapse under audit sampling. Certification tests whether the SMS is effective, not whether a document set exists. Starting internal audit in month 7 also leaves no time for corrective action before stage 2.
Months 1–2 should establish the system, not the paperwork. Confirm leadership commitment and appoint the SMS owner with authority. Define context, interested parties, scope and the service catalogue baseline. Perform a gap analysis against clauses 4 to 10, including the existing ITIL practices that can be reused. Assess risks and opportunities, set service management objectives and approve the implementation plan and governance. Engage staff and agencies so the scope is understood.
Then build only the documented information needed to operate. Procedures should be written with the process owners as the processes are piloted. Early wins, such as a single incident escalation path or a service catalogue, build credibility.
Sequence. Months 1–2: scope, gap analysis, governance, plan. Months 3–4: processes and measures operating; internal audit programme established. Months 5–6: internal audit, management review, corrective action, even though the ERP migration is consuming resources. Month 7: stage 1 readiness review and closure of findings. Month 8: stage 2. The migration must be planned around, not used as a reason to pause the SMS.
2. How should the plan address the ERP migration and the three open high-risk internal audit findings?
Read the worked answer
Treat the migration as a test of the SMS. The ERP migration is a major change and a service transition. It should be governed through change management, risk assessment, service continuity, supplier coordination, release and deployment, and post-implementation review. That produces genuine operational evidence for the audit rather than a gap. The plan should identify which engineers are essential to both activities, protect minimum SMS resources and schedule internal audit sampling around migration freeze periods.
Handle the open findings under corrective action. The three high-risk findings cannot be left open and mentioned only at stage 2. Each needs an owner, root-cause analysis, action, due date and verification of effectiveness under clause 10.2. If a finding cannot be closed before the audit, document the risk, the interim control and the accepted residual risk. The certification body will sample corrective action records and may treat unresolved high-risk issues as a major nonconformity.
Fix the audit programme. Internal audit must cover the SMS, not only information security. The CISO-owned programme needs to be extended, with auditor competence and independence addressed. The audit should be completed early enough for management review to consider its results and for actions to take effect. The migration and the findings should appear in the risk register and in management review inputs, showing that planning is integrated rather than parallel.
3. What milestones and decision gates should MetroShare set so that the certification date is realistic, including internal audit, management review and corrective action?
Read the worked answer
Milestones. Month 2: approved scope, service catalogue baseline, gap analysis and implementation plan. Month 4: core processes operating with measures and records; internal audit programme approved. Month 5: full-scope internal audit completed. Month 6: management review held, with audit results, performance, risks, customer feedback and improvement actions as inputs; corrective actions assigned. Month 7: stage 1 audit and closure of major findings. Month 8: stage 2 audit.
Decision gates. At the end of month 4, check that processes are actually operating, not merely documented. At the end of month 5, check that internal audit covered the full scope and that auditors were independent. At the end of month 6, hold a go/no-go gate: if major nonconformities remain open, or management review is only a slide deck, defer stage 2. Deferral is cheaper than a failed audit and a damaged relationship with the tendering authority.
Why the order matters. Internal audit must precede management review so that review has real inputs. Corrective action needs several weeks to produce evidence of effectiveness. Stage 1 should confirm readiness and resolve scope and documentation questions, leaving stage 2 to test implementation. Compressing these steps into month 7 repeats the IT director's mistake in a different form.