ISO 20000-1 documentation: the service management plan, catalogue, SLAs and the records behind them

What documented information does ISO/IEC 20000-1 require?

The 2018 edition prescribes fewer documents than the 2011 edition did, yet it still names more than most management system standards, because promises to customers have to be written down before anyone can measure them. The requirements are spread across clauses 4 to 10, and clause 7.5 ends with a sub-clause titled "Service management system documented information". The documents, by the clause title where each sits:

The standard also expects whatever else you decide the system needs; treat that as a judgement about risk, not a duty to write something for every sub-clause. Our requirements guide covers each clause in operation.

Documents and records in a service management system

Two kinds of documented information run through the standard. Documents tell people how the services and the system are meant to work, and they change when the service changes: a new SLA version when targets are renegotiated, a revised catalogue entry when a service is retired. Records prove what happened: a ticket with its timestamps, an approved request for change, the result of a failover test. A record edited after the event, without a trace, stops being evidence.

In a service business, the ITSM tool and the monitoring platform create most records, not people filling in forms. That helps, provided the tool captures priority, target, actual resolution, cause and approvals. If an auditor samples twenty incidents and half were closed with no resolution note, the gap is in the records, however well the procedure reads.

The service management plan, the catalogue and the SLAs

These three carry most weight at audit, because nearly everything else refers to them.

The service management plan

Clause 6.3 asks for a plan for the SMS itself. It is not a project plan for certification and it is not a list of every procedure. Write it as the document a new service delivery manager would read first: scope, objectives, process owners, resources and tools, how you work with suppliers and group companies, and how the system is reviewed. Keep it short enough to revise at each management review, and point to other documents rather than repeating them.

The service catalogue

The catalogue is the customer-facing description of what you provide. Auditors compare it with the tickets and the contracts: if the catalogue lists a service nobody delivers, or the service desk supports something the catalogue never mentions, the scope and the reality have drifted apart. Give each service a description, its customers, support hours, how to request it and its dependencies. One catalogue can serve several customers, with variations held in their agreements.

The service level agreements

An SLA is useful when its targets are measurable from your own data and when someone reviews the results with the customer. For internal IT, the agreement may be with business departments rather than paying clients; the discipline is the same. Line up the underpinning agreements behind each SLA: if you promise four-hour restoration and your hardware supplier commits to next business day, the auditor will find the mismatch before your customer does.

Which records prove the services run as agreed?

The certification body's Stage 1 readiness review checks that the documents exist and fit your scope; Stage 2 samples records to see whether the system operates. Expect requests for:

• Resolution and fulfilment. Incident and service request records against their targets, and problem records with known errors.
• Change and release. Requests for change with their assessment and approval, and evidence that releases met their acceptance criteria.
• Configuration. Configuration information that matches what is deployed, sampled against live systems.
• Assurance. Availability monitoring results, continuity test results and information security incidents.
• Performance and improvement. Service reports, the internal audit programme and results, management review outputs, corrective actions and improvement opportunities.

Leave ticket-level records in the tool that creates them and reference them from the SMS; copies in a document system soon disagree with the original. Our internal audit guide explains how to sample these records yourself before the certification body does.

A minimal document set for a small IT service provider

A managed service provider with thirty staff and a handful of customers needs no library. This set covers the named requirements with few controlled documents. Several policies can sit as separate, clearly headed sections of one controlled document, provided each can be identified, approved and reviewed; confirm the arrangement with your certification body at Stage 1.

Where ISO/IEC 27001 is also in scope, the information security policy and risk method are shared; our integration guide explains how one set serves both.

What to avoid, and how Effivity holds the documentation

• Procedures written for the auditor. A twenty-page change procedure the change advisory routine never follows is a finding waiting to happen.
• Copied ITIL process manuals. ITIL describes good practice; the audit tests what you do. Generic manuals name roles and tools you do not have. Our ITIL 4 comparison explains how the two fit.
• A catalogue that nobody maintains. A catalogue written once for certification contradicts the tickets by the first surveillance audit.
• Records reconstructed before Stage 2. Back-dated SLA reviews or continuity tests show in timestamps and interviews. A real gap with a plan is an ordinary finding; manufactured evidence damages the whole assessment.

Effivity holds the management-system layer: the controlled documents with versions and approvals, objectives and KPIs, the risk register, supplier evaluation, competence records, internal audits, management reviews, nonconformities and corrective actions. Day-to-day incident, request, problem, change and configuration records stay in your ITSM tool and are referenced from the SMS. Our Effivity guide maps the modules in detail.

ISO/IEC 20000-1 documentation: questions buyers ask