Three Weeks Before Stage 2: Deciding Whether to Proceed
Three weeks before its stage 2 ISO/IEC 20000-1 certification audit, Callisto Support Services discovers several problems. The internal audit was performed by the consultant who wrote most of the procedures, and the audit report contains no findings. Management review took place last month, but the only record is a slide deck with no decisions, actions or attendance list. Two nonconformities from an earlier customer audit-incorrect asset records and missed problem reviews-remain open. The service catalogue still lists a service retired six months ago. Supplier contracts for two critical providers have no service levels. When staff are asked how their work supports service objectives, several say they have never seen the objectives. The certification body has confirmed the stage 2 dates and the organization has announced the certification to clients.
1. Assess Callisto's readiness for stage 2 and recommend a go/no-go decision. What can realistically be fixed in three weeks, and what cannot?
Read the worked answer
Readiness assessment. Callisto is not ready. The internal audit lacks independence and credible findings, the management review record does not show decisions or attendance, open nonconformities affect asset accuracy and problem management, the catalogue is inaccurate, supplier controls are incomplete and staff awareness is poor. These are not documentation gaps; they indicate that the SMS is not operating effectively.
What can be fixed in three weeks. Catalogue entries can be corrected if the service owner verifies them. The two open nonconformities can be closed if corrective action is genuinely completed and evidenced; otherwise they must be disclosed with an interim control. Supplier service levels can be documented as interim agreements or escalation commitments, with a plan to formalise them. Awareness sessions can explain objectives and roles. If management review genuinely took place, a proper record can be reconstructed from attendance and decisions, but it must not be backdated or invented.
What cannot be fixed. A credible internal audit cycle, months of operating evidence and a culture of awareness cannot be created in three weeks. The audit report with no findings from the procedure author will not withstand scrutiny.
Recommendation. Defer stage 2 unless the readiness review shows every major issue closed with evidence. Proceeding risks major nonconformities, a failed audit and reputational damage, especially since clients have been told. A deferral with a clear corrective plan is the lower-risk decision.
2. How should the internal audit issue be addressed to meet ISO/IEC 20000-1 clause 9.2, given the limited time?
Read the worked answer
Requirement. Clause 9.2 requires a planned internal audit programme covering the SMS, with defined criteria, scope, frequency and methods, auditors who are objective and impartial, and results reported to management. Auditors must not audit their own work. A consultant who wrote the procedures and then audited them fails that independence test, even if technically competent.
Options. Engage a different qualified auditor or team, preferably from another part of the group or an independent body, to re-audit the high-risk clauses before stage 2. Use trained internal staff from another function who were not involved in designing the processes, with documented competence. If neither is possible in three weeks, perform a focused gap assessment and disclose the limitation, but do not present it as a compliant internal audit.
Evidence to retain. Audit programme, criteria, scope, auditor competence and independence declaration, findings, reports and management response. The certification auditor will ask who audited what and whether the auditor had any role in the process.
Judgement. Running a rushed, non-independent audit solely to produce a report is worse than disclosing the gap and planning a proper cycle. The former creates false assurance; the latter is a corrective action issue that management can address.
3. The organization has announced certification to clients. What should management do about this, and how should it prepare staff for auditor interviews without coaching false answers?
Read the worked answer
Correct the announcement. Certification is not achieved until the certificate is issued. Management should communicate accurately to clients: the organization is in the final stage of certification and will confirm when the certificate is issued. If the audit is deferred, say so and explain the corrective plan. Silence or ambiguity creates a bigger reputational risk than a correction.
Prepare staff honestly. Brief staff on the purpose and scope of the audit, the service objectives, their roles and how to find records. Explain that auditors will sample records and ask open questions, and that 'I do not know, I will find out' is an acceptable answer. Do not script answers or rehearse a false narrative. Staff who have never seen the objectives need a genuine awareness session, not a memorised slogan.
Prepare evidence. Ensure the service catalogue, objectives, process records, corrective actions and management review records are accessible and consistent. Check that staff named as owners can explain their process. The auditor will follow trails from a record to a person and back, so inconsistency is more damaging than a missing document.
If a nonconformity is found. Accept it, record it and present the corrective action plan. Stage 2 tests effectiveness; a candid response to a finding is more credible than a defensive one.