ISO 20000-1 step-by-step plan: from zero to certificate

Step 1: baseline measurement and gap analysis

Map out what you already have and what is still missing. Check, clause by clause, how far you meet the requirements of the standard. Which processes already exist? Which are missing? Where is documentation incomplete?

This is the most valuable step, because it determines your approach. For how to run a baseline measurement per clause, read ISO 20000 baseline measurement and gap analysis. Without one, you start on good luck and only discover the gaps during the audit.

Where companies get stuck: taking the baseline measurement seriously takes time, but skipping it costs more. Many companies think they have “already got a lot in order” and find halfway through that clause 8 is almost empty.

Step 2: define the scope

Decide which services, locations and parts of the organisation fall under your SMS. The scope does not have to cover the whole company. An MSP that provides both workplace management and hosting may start with workplace management only.

A clear scope keeps the audit manageable. Do not include services you cannot demonstrate.

Where companies get stuck: a scope that is too broad, so you cannot fill in the standard for everything you have written down. Starting smaller is wiser.

Step 3: management commitment and policy

Top management takes ownership of the SMS. That means more than a signature: you appoint an accountable person, free up resources and set a service management policy.

The policy describes what you promise to customers and how you deliver on it. Keep it concrete and short: one A4 page beats ten pages nobody reads.

Where companies get stuck: management commitment that exists only on paper. The auditor asks follow-up questions. “Management signed the policy” is not enough if nobody can explain it.

Step 4: set up the SMS

This is the core of the process. You set up the service management processes: incident management, change management, service level management, problem management and the other processes in clause 8. You will find an overview on the service management processes.

The standard says what you must manage, not how. Many companies use ITIL 4 to implement it. That works well: ITIL provides the way of working, and ISO 20000-1 provides the structure that can be audited.

Where companies get stuck: writing processes down on paper without actually using them. The auditor looks for evidence from practice, not for attractive process charts.

Step 5: set up documentation

Record what you do. Not a thick handbook, but clear agreements: process descriptions, roles and responsibilities, and procedures for the most important situations. Link the documentation to the clauses of the standard so you know what it covers.

Keep documentation up to date. A procedure that nobody follows any more is not evidence, but a risk.

Where companies get stuck: too much documentation that describes reality poorly. Write down what you actually do.

Step 6: run the system and collect evidence

Let your SMS run for a period before the auditor arrives. The longer the better, but at least two to three months. During this period, collect evidence: tickets, SLA reports, meeting minutes and change logs.

This is the phase many companies underestimate. The auditor wants to see that the system is alive, not that it has just been set up.

Step 7: internal audit

Carry out an internal audit. This is an independent assessment of your own SMS: check per clause whether you comply and document the findings. The internal auditor may be someone from within the organisation, but not someone who reviews their own work.

Take deviations seriously and fix them. The internal audit is your rehearsal for the external audit.

Where companies get stuck: treating the internal audit too lightly (“just quickly go through the points”). A thorough internal audit prevents surprises at stage 2.

Step 8: management review

Top management reviews the results of the SMS: internal audit results, SLA performance, complaints and opportunities for improvement. This meeting must take place demonstrably: record the agenda, attendance and decisions.

This is also the moment to decide whether you are ready for the external audit.

Step 9: stage 1 audit

The external auditor assesses your documentation and your readiness. This is a desk review: are the processes described, is the scope correct, has the internal audit been carried out? The auditor gives findings that you resolve before stage 2.

Plan for half a day to a full day, depending on the size of your organisation.

Step 10: stage 2 audit and certificate

The auditor checks whether your SMS works in practice. They talk to employees, ask for evidence and look at whether the processes are alive. Clause 8 takes up most of the time. After a successful audit, you receive your ISO 20000-1 certificate, valid for three years.

Each year, a surveillance audit follows. After three years, there is recertification. The audit process is explained in more detail.