The audit process for ISO 20000-1
An ISO 20000-1 certification audit has two stages: a documentation review (stage 1) and a practical test (stage 2). After certification, there is a surveillance audit every year and a recertification after three years. The standard is published by ISO and is available through NEN . You can find the full route to the audit in the step-by-step plan, and you can read what the auditor checks in substance on the requirements of ISO 20000-1.
Internal audit versus external certification audit
There are two types of audit. You carry out the internal audit yourself. An employee or adviser checks whether your SMS meets the standard, before the external auditor visits. This is a mandatory part of the standard and a good chance to close gaps.
An accredited body carries out the external certification audit, such as Kiwa , DNV or TÜV . Only that audit leads to a certificate. The body must be accredited by the Raad voor Accreditatie (RvA, Dutch Accreditation Council) .
The certification audit: stage 1 and stage 2
| Audit stage | What happens | Outcome |
|---|---|---|
| Stage 1 | Documentation review, readiness check | List of findings, green light for stage 2 |
| Stage 2 | Practical test, interviews with staff, evidence | Certificate or list of nonconformities |
| Surveillance | Yearly check that the SMS keeps working | Certificate stays valid |
| Recertification | Full reassessment after three years | New certificate for three years |
Stage 1: documentation review
The auditor reviews your documentation and checks whether you are ready for stage 2. They check: is the scope clear, are the processes described, has the internal audit been carried out, and has the management review been done?
Stage 1 is not a rubber stamp. The auditor gives you findings that you fix before stage 2. Plan enough time between the two stages: at least two to four weeks.
Stage 2: practical test
Stage 2 is the real test. The auditor talks to employees, asks for evidence and checks whether the processes actually work. They look not only at documents, but at what happens in practice.
Clause 8, the service management processes, often takes up half of the audit time in stage 2. The auditor wants to see concrete examples: how was this incident handled, who approved this change, what was in last month’s SLA report?
Evidence from practice counts for more than documents. Tickets, SLA reports, change logs and minutes of evaluation meetings are what the auditor looks for. A well-designed process without proof that it is used is not proof of compliance.
Nonconformities: major and minor
If the auditor finds something that is not right, they record a nonconformity. There are two types.
A major nonconformity is a serious gap: a required process is missing, a clause is systematically not followed, or there is a fundamental gap in the SMS. You cannot receive a certificate with a major nonconformity. You fix it and go through a repeat audit.
A minor nonconformity is a smaller shortcoming: a procedure was not followed everywhere, or documentation is incomplete. You send evidence of the correction within the agreed deadline. The certificate is only issued after approval.
You describe corrective actions in an action plan: what went wrong, what you do about it and how you prevent it from happening again?
A common mistake: assuming that findings from stage 1 will automatically be fine at stage 2. Stage 2 is a new test. Fixes from stage 1 must be demonstrably in place before the second day.
You can read which documents the auditor wants to see at stage 1 on stage 1 audit explained.
How to prepare
Good preparation starts with collecting evidence, not with writing documents. Make sure you have concrete examples for the most important clause 8 processes.
What the auditor wants to see for clause 8:
- Tickets or logs of incident handling with handling times
- SLA reports that show whether you have met your agreements
- Change logs with approvals
- Minutes of evaluations with suppliers
- Evidence of a completed internal audit and management review
Read through the processes of ISO 20000-1 and check for each process whether you have evidence. Make sure employees can explain their own work: the auditor will ask follow-up questions.
Combined audit with ISO 27001
If you also have ISO 27001 or are applying for it at the same time, you can plan a combined audit. The HLS structure is identical, so clauses 4 to 7 and clauses 9 and 10 are checked in one session. This saves audit days and therefore costs. Read more on ISO 20000 and ISO 27001.
Surveillance and recertification
After certification, there is a surveillance audit every year. The auditor checks a selection of clauses and monitors progress on improvement measures. After three years, there is a full recertification.
Yearly surveillance audits are not a formality. If you neglect your SMS after certification, you risk suspension or withdrawal of the certificate.
Next steps
The full route from zero to certificate.
Step-by-step plan → Preparing for the auditIncident management, change management and more.
The processes → What clause 8 requiresIndicative costs per phase and company size.
Costs and timeline → Audit costs budgetedSave costs with a combined approach.
ISO 20000 and ISO 27001 → Combined auditIs your question not listed here? Then see the frequently asked questions about ISO 20000.