Effivity ISO 20000-1: how the software runs your service management system alongside the ITSM tool you already use

How does Effivity run ISO/IEC 20000-1?

Effivity ISO 20000-1 work starts from a simple division of labour. An IT service provider already owns a ticketing or ITSM platform, and that platform is where the service desk logs an outage, an engineer raises a request for change and a problem analyst records a known error. None of that moves. What is usually missing is the system around the tickets that clauses 4 to 10 ask for, and that is the part Effivity holds.

The result is two connected sources of evidence. The ITSM tool shows what happened to each service event. Effivity shows that the organisation planned its services, set targets, watched performance, reviewed its suppliers, audited itself and corrected what went wrong. Auditors sample both and look for the link: an incident trend that reached the management review, or a failed release that became a corrective action.

Effivity, used in 50+ countries, is a management system platform, not a service desk, and nobody has to change ticketing product to certify.

ISO/IEC 20000-1 requirements mapped to Effivity

The table places each part of the 2018 edition, at clause-title level, against the Effivity module where the work is recorded, using the module names Effivity uses in its other management system guides.

Service reporting under 9.4 draws on both sides: the numbers come from the ITSM tool, and the decisions taken on them are recorded in Effivity. The paperwork each requirement calls for is covered in ISO/IEC 20000-1 documentation: the service management plan, catalogue and SLAs.

What Sterling configures at the start

Setup follows the gap analysis, so it reflects the services you actually run.

• Services and scope first. The services, customers and delivery locations in the certificate scope are entered before anything else, so every risk, objective and audit can be tied to a named service.
• Users follow accountability. Service owners, process owners, the service desk lead and supplier managers get their own accounts, so records carry the names of the people answerable for them.
• The ITSM link is agreed. For each process that runs in the ticketing tool, the team agrees which report or extract is attached to Effivity each month and who reviews it.
• Suppliers and calendars. External and internal suppliers are listed with their agreements and review dates, and internal audits, continuity tests and management reviews are scheduled at the outset.

Workshops write straight into these modules with the people who own the work, which is why the evidence carries real dates rather than a cluster in the fortnight before Stage 1.

A worked trace: one major incident

An illustrative case shows how the two systems meet. A storage fault takes a customer-facing application offline for four hours, beyond the availability target in the SLA. The service desk handles it in the ITSM tool under the major-incident procedure, and a problem record opens once service is restored.

In Effivity, the service owner raises a nonconformity against the SLA breach and attaches the incident and problem references. Root cause analysis finds that a firmware update was applied outside the change process by the hosting supplier. The corrective action has two parts: a clause added to the supplier review in Purchase, and a change to the service continuity plan in Business Continuity, with a test date set. The management review records the decision on the supplier.

When the certification auditor samples that incident, the ticket shows the response and the SMS shows the learning. Neither record was assembled for the audit.

What the certification body's auditor sees in Effivity

At the Stage 1 readiness review, the certification body looks at whether the SMS is defined: scope, policy, service management plan, catalogue, SLAs, the list of services and processes operated by other parties, and whether internal audit and management review are planned. In Effivity these sit as current, approved documents with a visible history.

At Stage 2 the auditor tests implementation and effectiveness. Typical requests include objectives and progress, supplier reviews, the last continuity test, internal audit reports with their corrective actions, and management review minutes. Your people open each record and explain it; the auditor then moves to the ITSM tool to sample tickets and checks that the story matches. How the full sequence runs is set out in ISO/IEC 20000-1 certification process, step by step.

The certification body is accredited to ISO/IEC 17021-1 and ISO/IEC 20000-6, and it sets the audit time under those rules. Effivity does not change the number of audit days; it changes how much of that time goes on finding evidence rather than testing it.

After certification: surveillance and Sustain™

The certificate opens a three-year cycle, with surveillance audits at least once a year and recertification before expiry. Surveillance tests whether the SMS kept running: service reports issued, SLAs reviewed with customers, suppliers reviewed, continuity tested, internal audits completed and corrective actions proven. Alerts and dashboards in Effivity keep that recurring work visible when people change roles.

Under Sustain™, Sterling continues with internal audits, service reviews, refresher learning and scope extensions, such as adding a new service or a data-centre site, in the same Effivity system.

What Effivity does not do

Effivity does not log tickets, run a configuration management database or deploy releases, and Sterling does not offer it as a replacement for those tools. It does not decide whether a service level is right or whether a supplier stays; your service owners make those calls and must explain them to the auditor. Four mistakes recur.

• Copying tickets into the SMS. Duplicating every incident creates two records that drift apart; carry trends and failures across, not the whole queue.
• No monthly link. If nobody attaches and reviews the ITSM reports, the management layer loses sight of the services it governs.
• A plan nobody opens. A service management plan approved once and never revised tells the auditor the SMS is a document, not a system.
• Group companies left out. Services delivered by a sister company still need an agreement and a review, recorded like any supplier.

Effivity for ISO/IEC 20000-1: questions buyers ask