ISO/IEC 20000-1 certificationIT Service Management

ITIL is a framework of guidance on IT service management practices, and individuals can gain ITIL qualifications. ISO/IEC 20000-1 is an auditable international standard against which an organisation's service management system can be certified. Many organisations use ITIL practices to meet the standard's requirements, but adopting ITIL is not required for certification.

No. Other parties, such as suppliers, internal groups or customers acting as suppliers, can operate parts of your services. However, clause 8.2.3 requires you to retain accountability and demonstrate governance of those processes. You cannot claim certification for a scope where another party operates all the processes and you have no control.

No. All requirements in clauses 4 to 10 apply to the services within your scope. Instead of excluding requirements, you control scope by defining which services, locations and organisational units are included. Where other parties operate processes, you show how you govern them rather than excluding them.

Yes. Both follow the Harmonized Structure, and ISO/IEC 20000-1 includes information security management within service assurance. Many providers run an integrated system with shared risk management, document control, internal audit and management review. We can carry out integrated audits where the systems are genuinely combined.

Auditors typically sample incident, request, problem and change records, service level reports, configuration records, release plans, supplier reviews and continuity tests. They also interview service desk staff, process owners and managers. The aim is to confirm that documented processes are followed and that service reporting and review lead to action.

Your SMS needs to have operated long enough to generate records across the clause 8 processes, plus internal audit and management review outputs. Most organisations at that stage complete Stage 1 and Stage 2 within six to twelve weeks of booking. Scope, number of services and the involvement of other parties affect audit duration.

Yes. An internal IT function delivering services to the rest of its organisation can be certified, treating other departments as customers. It needs agreed service levels, service reporting and the full set of service management processes for its scope. The certificate scope will make clear that the services are provided internally.

No. Under ISO/IEC 17021-1 we cannot design, implement or configure the systems we certify. You can build processes and tooling internally or with an independent provider. We can offer an optional pre-assessment that gives an impartial view of your readiness against the standard without recommending specific solutions.