ISO 20000 stage 1 audit: what the auditor checks
The stage 1 audit is the first external assessment of your ISO 20000-1 management system. The auditor from the certification body assesses whether your documentation is complete and whether your organisation is ready for the practical test in stage 2. The auditor therefore looks mainly at paperwork and readiness. The full evidence from practice follows in stage 2. The documents involved are listed below. The standard against which you are assessed is ISO/IEC 20000-1:2018 , sold via NEN . The full audit process is set out on the audit process for ISO 20000-1.
The outcome of stage 1 is not a certificate, but a list of findings. Those findings help the certification body decide whether you can proceed to stage 2, or whether you first need to fix issues. For the whole process, this is the first moment of real assessment by outsiders.
What is the difference from stage 2?
Stage 1 looks at the design, stage 2 at the operation. In stage 1, the auditor reads your policy, your process descriptions and your scope. In stage 2, the auditor asks for evidence: tickets, change records, SLA reports and minutes. A system that is correct on paper but not yet running often passes stage 1 and fails stage 2.
This distinction helps you divide your preparation. For stage 1, you deliver documents. For stage 2, you deliver evidence. You cannot swap the two.
The documents the auditor wants to see
Below is a checklist of the documents that usually come up in a stage 1. It is a guideline. The certification body sets the exact requirements. The standard does not prescribe this list of documents.
| Component | Document | What the auditor checks |
|---|---|---|
| Scope | Scope statement | Are the services, locations and boundaries clear? See defining the scope |
| Policy | Service policy | Has top management approved it, and do employees know it? |
| Context | Service catalogue and list of interested parties | Do you know which services you deliver and to whom? |
| Risks | Risk register for the SMS | Have you identified risks and opportunities for the service delivery? |
| Objectives | Service objectives with measurable targets | Are they measurable and linked to the SLAs? |
| Processes | Process descriptions for clause 8 | Do they cover incident, request, problem, change and the other processes? |
| Internal audit | Audit programme and first audit report | Has the internal audit been planned and carried out? |
| Management | Management review report | Has top management discussed the SMS and taken decisions? |
| Improvement | Register of nonconformities and actions | Are problems addressed in a structured way? |
Pay attention to the internal audit and the management review. These two are often the weak spots in stage 1. Checking whether internal audits and management reviews have been planned and carried out is one of the objectives of a stage 1, according to the general standard for certification bodies (ISO/IEC 17021-1, 9.3.1.2.2). Check this with your certification body. An internal audit planned only a week before the external audit stands out.
Example: a process description that passes or fails
A fictional MSP has a one-page incident procedure. It describes who takes a report and what happens once the service is working again. An auditor then asks: how do you determine the priority? Who is informed about a serious outage? How long may an incident stay open? Where are the SLA times recorded?
A version that passes stage 1 answers those questions in the procedure itself. For example: “We determine priority using the impact and urgency matrix. We report P1 incidents to the customer contact within one hour. The SLA times are set out in the service contract.” That is short, concrete and verifiable.
What happens to the findings?
After stage 1, you receive a report with findings. The certification body decides whether you can proceed to stage 2, and when. Findings that affect the SMS usually need to be fixed before stage 2 can take place. Record your corrective actions in your own register, so that at stage 2 you can show that you have addressed them.
Certification bodies often classify shortcomings as major (serious) or minor (less serious). Terms and remediation periods differ per body, so ask yours. What a major and a minor nonconformity involve is explained in major and minor nonconformities and in the initial audit.
Common mistakes
The most common mistake at stage 1 is writing documents that look good but do not match practice. The auditor selects samples at stage 2, and then the difference becomes visible. Only write down what you actually do.
- A copy of a template. A procedure that does not fit your organisation is quickly noticed.
- Missing links. A problem that does not refer to a change, or a risk without a control, feels like a gap.
- A scope that does not match practice. If the scope names more or fewer services than you deliver, the audit starts with a problem.
- An internal audit just before the external one. An internal audit needs time for its findings to be resolved.
How do you prepare?
Start well before the stage 1 date. Work through the checklist above and ask yourself for each document: is it finished, has management approved it, and does it match what we do? Have a colleague who is not on the project read the procedures. They will see the gaps that you no longer see.
A baseline measurement helps here. The gap register from the baseline measurement is a good basis for the document list. The step-by-step plan shows where stage 1 fits in the process, and how the steps before and after the audit connect.
Costs and planning
Stage 1 is part of the total cost of the process. The amounts and the number of days vary per certification body and per organisation. For this, see the costs page for ISO 20000-1. When requesting a quote, ask explicitly for the cost of both stage 1 and stage 2, and for what happens if your findings need to be fixed and re-assessed.
Example: questions from the auditor and suitable answers
Below are questions that often come up in a stage 1, with an answer that works well. Use them as an exercise: answer them first without your documents at hand, then check.
| Auditor’s question | Suitable answer | Where the evidence is |
|---|---|---|
| What is the scope of the SMS? | Name the services, locations and exclusions, with reasons | Scope statement |
| Who is responsible for the SMS? | Name the role, not just the person | Organisation chart and role description |
| How do you determine the priority of an incident? | Refer to the impact and urgency matrix | Incident procedure |
| When did you last carry out an internal audit? | Date, scope and outcome | Audit report |
| How does top management know whether the SMS works? | Name the meeting, the agenda and the decisions | Management review report |
The pattern is always the same. A good answer points to a document and shows that the document has been applied. An answer that only says “we always do it this way” does not pass the question.
What if you fail stage 1?
This happens, and it is not the end of the process. The certification body decides whether you receive a remediation period and how long it lasts. Often it means you fix the findings and have the documentation reassessed before you move on to stage 2.
What you do is the following: read each finding word for word, determine the cause, and adjust the procedure or the evidence. A fix that only changes the document, without changing the way of working, often comes up again at stage 2. See also major and minor nonconformities for how findings are classified.
Plan your remediation so that you already have evidence of the change before the next appointment is scheduled. An auditor looks not only at the result, but also at the period you have let it run afterwards.
Next steps
Sources
- NEN: IT service management with ISO/IEC 20000 - Netherlands Standardization Institute (NEN)
- BSI: ISO/IEC 20000-1 Service Management - British Standards Institution