ISO 20000-1 certification process: the ISO/IEC 20000-1 route, step by step

Who does what in ISO/IEC 20000-1 certification

Four parties take part, and the route only makes sense once their roles are kept apart. Your organisation owns the service management system (SMS): the services it covers, the processes that deliver them and the evidence that they work. Sterling helps you scope, build and prepare that system. An independent certification body audits it and decides whether to certify. An accreditation body, recognised through the Global ACI arrangement that replaced the IAF MLA and ILAC MRA on 1 January 2026, checks that the certification body is competent and impartial.

ISO/IEC 17021-1 sets the general audit rules: two initial stages, annual surveillance and a three-year cycle. ISO/IEC 20000-6 adds requirements specific to service management, so a body certified to audit quality or security systems is not automatically able to certify yours.

Steps 1 to 5: preparing the service management system

Step 1: decide which services the certificate covers

An ISO/IEC 20000-1 scope names services, the customers who receive them and the locations and teams that deliver them: a managed service provider's hosting and service desk, say, or the services an internal IT function provides to its group. ISO/IEC 20000-3 gives guidance on scope statements and is recommended to audit bodies, so drafting against it early avoids arguments later.

Step 2: gap analysis

The gap analysis is the first stage of a Sterling engagement. It sets the current service desk, change routine, supplier contracts, SLAs and ITSM tool data against the standard, and produces an action plan with owners, dates and a realistic month for the certification audit. It is more detailed than the free online readiness check and happens long before the certification body's Stage 1.

Step 3: implement the SMS

Implementation turns working habits into a controlled system: a service management policy and objectives, the service management plan clause 6.3 asks for, a catalogue and SLAs that match what is actually delivered, a change management policy, a major-incident procedure, continuity plans and the controls over suppliers and group companies that deliver part of the service. Tickets stay in the ITSM tool; the work is making them complete and linking them to reviews and decisions. The documentation guide lists what must be written down.

Step 4: operate and let the evidence build

A certification body has to see the system working. That means service reports, SLA reviews held with customers, problems analysed to root cause, assessed requests for change, tested releases, capacity monitoring and at least one recorded continuity test. Some of these come round only quarterly, which is why the timeline runs longer than many expect.

Step 5: internal audit and management review

Before Stage 2, complete one internal audit across the whole scope, by people who do not audit their own work, and a management review whose minutes record decisions. Findings you raise and close now are findings the certification body will not raise. The internal audit guide explains how to plan and report it.

Step 6: choose a certification body accredited for service management

Choose while implementation is still running, because auditor calendars fill weeks or months ahead. Confirm four points with evidence. The body holds accreditation for ISO/IEC 20000-1 against ISO/IEC 17021-1 and ISO/IEC 20000-6, shown in the accreditation body's own directory. The accreditation body is recognised through Global ACI. The accredited scope matches your services; accredited certificates under this standard are generally for IT services, so confirm how your services will be described. And the quotation states the audit days for Stage 1, Stage 2 and each surveillance, the sites to be visited and how services delivered by suppliers or group companies will be examined.

Audit days follow the scope, sites, headcount and complexity of the services, so a quotation far below the others usually means fewer days or no recognised accreditation. The cost guide explains what moves the price.

Steps 7 to 9: Stage 1, closing the concerns, and Stage 2

Step 7: Stage 1, the readiness review

In Stage 1 the auditor reviews the scope statement, service management plan, catalogue, SLAs and the list of services and processes operated by other parties, checks that the internal audit and management review have taken place, and confirms locations and Stage 2 arrangements. The report lists areas of concern that could become nonconformities.

Step 8: close the Stage 1 concerns

Treat each concern as a preview of a Stage 2 finding: a catalogue missing a service in scope, supplier contracts unlinked to SLA targets, an untested continuity plan. Close each with evidence before the body returns.

Step 9: Stage 2, the certification audit

Stage 2 evaluates whether the SMS is implemented and effective across the whole scope. Expect the team to follow a breached SLA through the incident, the problem record and the service review, to trace requests for change to release, and to ask how a supplier's performance was reviewed. Findings are graded as major or minor nonconformities or recorded as opportunities for improvement, and the closing meeting ends with the auditor's recommendation.

Steps 10 and 11: responding to findings and the certification decision

For each nonconformity you provide the correction, the root cause and the corrective action within the period the certification body sets. A major nonconformity has to be verified as closed before a certificate can be issued, which may mean a follow-up visit; a minor one is normally accepted on the strength of a credible plan and checked at the first surveillance. The audit team's recommendation is not the decision; people in the certification body who were not on the audit take it, from the report and the evidence of closure.

The certificate names your organisation, the services and locations in scope, the standard and its edition, ISO/IEC 20000-1:2018 in current practice, and the dates of its three-year validity. Check the scope wording before issue; customers read that line, not the audit report.

Step 12: surveillance, recertification and the overall timeline

The first surveillance audit falls within twelve months of the certification decision, and further surveillance follows at least once in each calendar year that is not a recertification year. Each visit samples the SMS and always looks at internal audits, management review, corrective actions and changes; before expiry a recertification audit covers the whole scope again. Discuss new services, sites or entities with the certification body before they happen.

Overall, the route typically takes six to twelve months. Teams already running ITIL-based processes in an ITSM tool finish nearer six months; those agreeing a catalogue and service levels for the first time need nearer twelve, plus the certification body's scheduling.

What delays ISO/IEC 20000-1 certification

• A scope written around the organisation chart. The certificate covers services; a list of departments gives the auditor nothing a customer would recognise.
• Suppliers left outside the system. A hosting partner or group company running part of the service without defined controls is found quickly at Stage 2.
• Booking Stage 2 before the quarterly records exist. A service review, a capacity report or a continuity test that has not yet happened cannot be shown.
• A certificate offered without implementation. An unaccredited certificate, or one issued without Stage 2, is rejected by the customers who asked for it. Our guide to choosing a credible provider explains what to check.

ISO 20000-1 certification process: questions buyers ask