ISO 20000-1 certification cost: what moves the price for an IT service management system

What ISO 20000-1 certification cost is made of

Anyone searching for an ISO 20000-1 certification cost is really asking about three separate amounts, paid to different parties for different work. None is fixed by the standard.

Building the system. A consultant, if you use one, helps turn your existing service desk, change routine and supplier arrangements into a service management system (SMS) that meets clauses 4 to 10: the scope statement, the service management plan, the catalogue, agreed service levels, the policies the standard requires, internal audit and management review. What you pay reflects how much has to be created and how much your own people take on.

Auditing the system. An independent certification body carries out the Stage 1 readiness review and the Stage 2 audit, makes the certification decision, then returns for surveillance audits at least once a calendar year and for recertification before the third year ends. Its fee is built from audit days plus travel and any fixed charges. ISO/IEC 17021-1 bars a certification body from offering management system consultancy, so the body that audits you cannot be the one that builds your SMS. Sterling does not certify.

Your own time. Service owners, process owners and managers spend hours on workshops, reviews, customer conversations about service levels and the audits themselves. It never appears on an invoice.

What moves the price

The same facts about your organisation push both invoices, though not by the same amount. A consultant prices the effort of building and embedding the system; a certification body prices the time needed to sample and verify it.

Three levers specific to IT service management

How the scope is written

The scope statement names the services, the customers they serve and the locations delivering them. ISO/IEC 20000-3 gives guidance on drawing that boundary, from a single internal service to a complex supply chain. Narrowing the first certificate to the services a contract or tender actually needs keeps both invoices down, and the scope can be extended later.

Who else delivers the service

Outsourcing a component does not take it out of the SMS. The standard expects a documented list of the services, components and processes other parties operate, contracts with external suppliers and agreements with internal ones. Where a group company runs the data centre or a vendor runs second-line support, drafting and aligning those agreements is real work, and it is often underestimated in early budgets.

Continuity and information security

Service availability, continuity and information security sit inside the standard's service assurance requirements. If another team already runs a continuity programme or an ISO/IEC 27001 system, connecting to it is quicker than building anew; if nothing exists, the continuity plan, its test and the security controls are extra effort. Running both standards as one system is explained in the ISO/IEC 20000-1 and ISO/IEC 27001 integration guide.

How the certification body works out audit days

ISO/IEC 17021-1 requires every accredited certification body to keep documented procedures for determining audit time, taking into account factors such as the complexity of the activities, outsourced processes, the size and number of sites, the risks involved, previous audit results and whether audits are combined or integrated. A body certifying service management systems must also meet ISO/IEC 20000-6, which adds requirements specific to SMS audits and certification.

The day count is calculated from your scope, not picked to win the work. A proposal should show the days for Stage 1, Stage 2, each surveillance and recertification, and the facts it relied on: services, customers, sites, people in scope and suppliers. When one quotation shows markedly fewer days for the same scope statement, ask why before you accept it.

The cycle matters as much as the first audit. The three-year certification cycle begins with the certification decision; surveillance follows in each of the next two years, and recertification before expiry. A quotation that stops at Stage 2 has priced only part of what you will pay. The full sequence of stages is set out in the ISO/IEC 20000-1 certification process guide.

Costs quotations tend to leave out

• Operational change. A change advisory routine, a major-incident procedure, capacity reviews or a first continuity test may be new ways of working, with time and sometimes tooling behind them.
• Customer conversations. Service level agreements have to be agreed and reviewed with customers. Where current SLAs no longer describe what is delivered, renegotiating them takes management time.
• Tool configuration. Categories, priorities, targets and report formats in the ITSM tool often need adjusting so the records answer what the standard and the auditor ask.
• Findings after Stage 2. A major nonconformity must be corrected and verified before certification; if that cannot happen within six months of the last day of Stage 2, the body repeats Stage 2 before recommending certification.
• An unaccredited certificate. A cheap certificate a client's audit team or a tender panel refuses leaves you paying for accredited certification anyway, with the service problems still unsolved.

How to compare ISO/IEC 20000-1 quotations

Totals mean something only once every quotation describes the same scope and the same three years.

Certification bodies

• Accreditation to ISO/IEC 17021-1 and ISO/IEC 20000-6, by an accreditation body recognised through the Global ACI arrangement; confirm it in the accreditation body's own directory.
• The accredited scope covers IT services of your kind; confirm this before proposing anything unusual.
• The proposed scope statement, identical in every quotation.
• Audit days per stage over the full cycle, with the justification, plus travel and annual charges.

Consultants

• A fixed scope and fee, with deliverables, responsibilities, assumptions and exclusions written down.
• Certification-body fees shown separately, never bundled into a promised certificate.
• What follows certification: internal audits, service reviews and support through surveillance.

ISO/IEC 20000-1 cost: questions buyers ask