ISO 20000 Lead Implementer common mistakes
ISO 20000 Lead Implementer · Understand the traps and how to avoid them.
Treating ISO/IEC 20000-1 as a catalogue of ITIL processes to be implemented one by one, and answering questions by naming processes (incident, problem, change) instead of the clause requirement being tested.
Candidates arrive from ITIL or service-desk backgrounds where process knowledge is the currency, and the standard's process-agnostic, outcome-based wording feels thin by comparison, so they default to the vocabulary they know.
What to do instead
Before answering, locate the question in the clause structure: is it asking about a requirement (shall), a plan, a documented information obligation, or a performance evaluation activity? Practice restating each clause in one sentence of your own words without using any ITIL process name, then check whether the original clause still holds.
Confusing ISO/IEC 20000-1 (the certifiable requirements standard) with ISO/IEC 20000-2 (guidance) or with the ITIL framework, and attributing mandatory status to guidance material.
The parts share a number and vocabulary, and study material often quotes guidance alongside requirements without labelling which is which, so the boundary blurs.
What to do instead
Build a one-page comparison table: document, nature (requirements vs guidance), certifiability, and typical question phrasing. For any statement you are unsure about, ask 'could an auditor raise a nonconformity against this?' If not, it is guidance, not a requirement.
Answering scope questions by describing the IT department or the whole organization rather than the defined service management system scope, including interfaces with parties outside that scope.
Scope feels like an introductory formality, so candidates skim it and reach for an organizational-chart answer; the requirement to define and document the scope with reference to services, organizational units and interfaces is easy to under-read.
What to do instead
Memorize the scope elements as a checklist: services covered, organizational units, the boundary and applicability, and interfaces with parties outside the scope. For any scenario, ask which of these four is missing or misstated before selecting an answer.
Treating top management responsibility as a single clause (commitment or policy) and missing the linked obligations: ensuring integration into business processes, providing resources, communicating, and assigning roles, responsibilities and authorities.
Leadership clauses read as generic management-system boilerplate, so candidates memorize one keyword and stop; exam questions then test the specific obligation that was skipped.
What to do instead
Map the leadership requirements as a chain: policy, then integration with business processes, then resources, then communication, then assigned roles and authorities, then management review inputs and outputs. For each, write one concrete piece of evidence an auditor would accept.
Building a plan that lists activities and dates but omits the elements the standard expects of planning: scope and objectives, roles, resources, risk and opportunity, dependencies, and how results will be monitored and reported.
Project-planning habits dominate, and candidates reproduce a Gantt-style list because it looks complete, while the management-system planning requirements are not front of mind.
What to do instead
Use a fixed planning skeleton as an answer template: context and scope, objectives and success criteria, roles and responsibilities, resources and competence, risks and opportunities with actions, dependencies and interfaces, timeline and milestones, monitoring and reporting, and review points. Check any proposed plan against all nine before choosing.
Assuming the implementation sequence must be strictly clause-by-clause from clause 4 to clause 10, and rejecting scenario answers that start with service delivery or relationship work.
The document's numbering suggests a waterfall, so candidates infer a mandated order that the standard does not impose.
What to do instead
Separate what must exist (the requirements) from the order in which you build it (your choice, driven by risk and maturity). In sequencing questions, select the answer that establishes governance, scope, objectives and baseline first, then builds capability, then measurement and improvement, regardless of clause numbers.
Designing metrics that count activity (number of incidents closed, tickets handled) rather than measuring whether service and management-system objectives are met, and ignoring the requirement to analyse and evaluate the data.
Operational reporting culture rewards volume dashboards, and the distinction between monitoring, measurement, analysis and evaluation collapses into a single 'reporting' idea.
What to do instead
For every proposed metric, state the objective it serves, the decision it informs, the threshold that triggers action, and who evaluates it. Practise classifying a described activity as monitoring, measurement, analysis, evaluation or improvement, and reject answers that stop at collecting data.
Treating continual improvement as a corrective-action-only activity, and failing to distinguish nonconformity correction and root-cause action from proactive improvement of suitability, adequacy and effectiveness.
Corrective action has a visible trigger and a familiar form, whereas improvement opportunities require initiative, so candidates collapse the two and pick corrective-action answers for improvement scenarios.
What to do instead
Keep a two-column contrast: corrective action (triggered by a nonconformity, removes cause, prevents recurrence) versus improvement (triggered by analysis, performance data or opportunity, changes capability or effectiveness). For scenario questions, identify the trigger first, then choose the mechanism that matches it.
Preparing for certification by memorizing clause text and skipping the evidence trail: documented information, records, internal audit results, management review outputs and service performance against targets.
Written exams reward recall, so candidates over-invest in definitions and under-invest in what an auditor would actually sample, which is where stage 1 and stage 2 questions live.
What to do instead
For each clause, write the artefact you would show an auditor and the person who owns it. Then rehearse the two-stage logic: stage 1 checks readiness, documentation and scope; stage 2 checks implementation and effectiveness through sampling and interviews.
Describing certification as a guarantee that services are good, or as a one-off event, and misstating the roles of the certification body, the client and the accreditation body, including surveillance and recertification obligations.
Marketing language around certificates ('certified quality') shapes expectations, and the audit-cycle mechanics are learned late, so candidates import assumptions from product certification.
What to do instead
Write a short chain: accreditation body accredits the certification body; the certification body audits the client's SMS against the standard; the certificate covers the defined scope only; surveillance audits maintain it and recertification renews it. Answer any question by identifying which of these three parties the question is about.