Continual Improvement of an SMS Based on ISO/IEC 20000-1
This domain tests clause 10, and specifically whether you can distinguish a correction from a corrective action and show that improvement was planned, implemented and verified.
Nonconformity and corrective action (10.1)
React to the nonconformity and, where applicable, control and correct it and deal with the consequences. Then evaluate the need to eliminate the root cause so it does not recur, implement the action, review its effectiveness, update risks where needed, and make changes to the SMS if required. Retain documented information on the nature of the nonconformities, actions taken and results.
Continual improvement (10.2)
Determine and select opportunities, plan how to achieve them, implement, and evaluate the result. Sources include 9.1 performance data, internal audit findings, management review outputs, customer feedback and complaints, SLA breaches, recurring incidents and problems, supplier performance, benchmarking, and risk assessment. Improvement is not limited to projects - small, frequent changes count if they are planned and their effect is evaluated.
Tools that earn marks
Trend analysis over time; Pareto to prioritise; 5 Whys and Ishikawa for cause; an improvement register with owner, target date, expected benefit and verification method.
Worked example
Major incidents recur every time a particular change type is deployed. The team retrains the engineers and closes the record. Reasoning: retraining is a correction at best. A corrective action would examine why the change process allowed an untested deployment, add a validation step or gate, then verify over the next several changes that recurrence stopped - and record the evidence. Until effectiveness is reviewed, the action is not closed.
Traps
Treating correction as corrective action; closing actions without verifying effectiveness; running improvement as unplanned enthusiasm with no owner or measure; ignoring improvement opportunities surfaced by management review; forgetting to update risk assessments after a significant failure.