ISO 20000-1 internal audit: how to plan, conduct and report audits of your service management system

What does ISO/IEC 20000-1 require of internal audit?

An ISO 20000-1 internal audit is the organisation examining its own service management system (SMS) before anyone else does. Clause 9.2 sits in the performance evaluation clause, alongside 9.1 monitoring and measurement, 9.3 management review and 9.4 service reporting, and it follows the harmonised structure shared by every ISO management system standard. In substance it asks for four things:

• Planned intervals. Audits follow a schedule you set, not the next certification visit.
• A programme. The frequency, methods, responsibilities, planning and reporting of the audits are defined, with each audit given its criteria and scope.
• Objectivity and impartiality. Auditors are chosen, and audits run, so that nobody passes judgement on work they own.
• Reported results. The findings reach the managers who can act on them, and nonconformities pass into clause 10.1, nonconformity and corrective action.

Two tests apply throughout: does the SMS conform to the standard and to your own rules, such as your change management policy, and is it implemented and maintained in daily delivery? The audit programme and its results are documented information the 2018 edition names, so both must exist as records.

ISO 19011:2026 as the method

ISO/IEC 20000-1 says what internal audit must achieve; ISO 19011, Guidelines for auditing management systems, shows how. Its fourth edition, ISO 19011:2026, published in May 2026, replaced the 2018 edition and gives fuller guidance on remote auditing and digital tools. It is guidance, so nobody is certified to it.

Two of its principles, independence from the activity audited and an evidence-based approach, matter most where the same few engineers design, operate and report on a service. Use its terms precisely: the audit programme covers a period, usually a year; the audit plan covers one audit; findings are evidence weighed against the criteria.

Building an audit programme across your services

An SMS has two dimensions: the processes in clause 8 and the services in your catalogue. Auditing change only for your largest customer's service misses the smaller services where discipline slips. Plan by process, and rotate the services you sample so that every service in the scope statement is touched during the year.

Weight the plan by risk (tight service levels, frequent changes, repeated major incidents) and by history (last year's findings, complaints, SLA breaches). Clause 8.2.3 requires control of the suppliers and group companies that operate parts of the service, so the programme tests how you govern them too. An example for a managed service provider with three services in scope:

Before initial certification, compress the cycle so that the whole scope has been audited, and the findings acted on, before the certification body's Stage 2.

Conducting the audit: tracing tickets across processes

Prepare from the tool, not only the procedure

Agree the plan with the process owner, read the process description and last year's report, and ask for read access to the ITSM tool. Pull the population yourself, such as every change closed in the quarter or every incident that breached its target. Choosing your own sample is what separates an audit from a guided tour.

Follow the thread

The strongest evidence in service management comes from following one event through several processes. Take a major incident: was it handled under the major-incident procedure, did it raise a problem, did the root cause become a known error, and did the fix pass change and release control? Take an SLA breach: does it appear in the service report, and did the customer review act on it? Each break is a question for the process owner, and for the analysts and engineers who did the work.

Write the finding in three parts

An example of the form a finding should take:

• Requirement: the change management policy states that emergency changes are reviewed after implementation.
• Evidence: of nine emergency changes closed between April and June, four have no post-implementation review, including the change linked to the outage reported to one customer in May.
• Gap: emergency changes are not reviewed as the policy requires.

Grading, reporting and closing the findings

ISO/IEC 20000-1 sets no grading scheme for internal audit findings, so your audit procedure should define one. Borrowing the certification body's terms keeps everyone aligned: a major nonconformity affects the ability of the SMS to achieve its intended results, a minor one does not, and an opportunity for improvement notes a better practice where nothing is wrong.

The report gives the scope, criteria, samples, findings with evidence and a conclusion, and goes promptly to process owners and top management; the results feed the management review under clause 9.3.

To close a nonconformity, the process owner records correction, root cause and corrective action, and the auditor later checks the action worked: for the example above, a quarter of emergency changes each with its review on file. Certification auditors sample closed findings.

Where Effivity fits

Effivity holds the management-system layer of the SMS: the master audit schedule, a plan for each audit with auditor, auditee, location and date, alerts for audits due, and findings passed to the nonconformity module for root cause, corrective action and the effectiveness check. Tickets stay in your ITSM tool as referenced evidence. Effivity, used in 50+ countries, is included with the engagement, at no additional cost.

Internal audit versus the certification audit, and who should audit

The certification body, accredited to ISO/IEC 17021-1 and to ISO/IEC 20000-6, samples a few days of evidence to reach a decision; your internal audit runs all year and exists to find problems while there is time to fix them. At Stage 1, its readiness review, the certification body checks that internal audits and management reviews are planned and performed; at Stage 2 and each surveillance audit it examines them. The certification process guide covers those stages in full.

ISO/IEC 20000-1 names no qualification for internal auditors. They fall under clause 7.2: competence determined for the role, gained through education, training or experience, and shown by records. An SMS auditor needs audit technique and enough service management knowledge to read a change record critically; engineers from one team can audit another's processes. Internal auditor training for your team is part of a Sterling engagement, as applicable to your standard; the training guide sets out who needs what and the evidence of competence.

ISO 20000-1 internal audit: questions buyers ask