ISO 20000-1 training: who needs what, and the evidence of competence auditors accept

What ISO/IEC 20000-1 requires for people

ISO 20000-1 training is not a requirement in its own right. The standard places its people obligations in clause 7, Support of the service management system: 7.2 Competence, 7.3 Awareness, 7.4 Communication and 7.6 Knowledge. Clause 5.3 adds that roles, responsibilities and authorities for the SMS and the services are assigned, which is where competence criteria begin.

Competence follows the harmonised-structure cycle shared with ISO 9001 and ISO/IEC 27001. You decide what each role that affects the SMS and the services must be able to do, make sure the people in those roles meet it through education, training or experience, act where they fall short, check whether the action worked and keep documented evidence. Coaching, supervised shifts or hiring a qualified person count as actions too.

Awareness is lighter but reaches further: everyone working under your control should know the service management policy, the objectives that touch their work, how they contribute and what happens when they do not follow the system. Knowledge, clause 7.6, is the requirement ITSM teams most often miss. It asks you to determine and maintain the knowledge needed to operate the SMS and deliver the services, which in practice means the known-error records, runbooks, service designs and supplier contacts people rely on at two in the morning.

Who needs what: the roles in a service management system

Top management and service owners

Leaders need to understand what clause 5 expects of them, how service reports and SLA results reach the management review, and why they remain accountable for services other parties help deliver. Service owners need enough of the operational clauses to answer for their service end to end.

Process owners and the SMS coordinator

Each owner of incident, problem, change, release, capacity, availability, continuity or supplier management needs the requirements for their process, its measures and how nonconformities are corrected. The coordinator needs the whole standard, the service management plan and document control.

Service desk and support teams

Analysts need to classify, prioritise and escalate incidents and requests to the agreed targets, recognise a major incident, invoke its procedure and record known errors so the next person benefits.

Change, release and supplier roles

Change managers and advisory board members need the change policy, impact assessment and release acceptance criteria. Relationship and supplier managers need SLA review, complaint handling and contract alignment with internal and external suppliers.

Internal auditors

Auditors need the standard, audit method and enough ITSM practice to read a ticket history critically. The planning and conduct of the audit itself belong to ISO/IEC 20000-1 internal audit: planning, conduct and reporting.

An ISO/IEC 20000-1 training matrix: role, learning and evidence

A matrix ties every role to the learning it needs and to the evidence that shows it has landed.

Revisit the matrix whenever a service is added, a tool changes, a supplier takes over part of delivery or incident trends point to a skills gap.

What proves competence to an ISO/IEC 20000-1 auditor

Auditors sample people they meet while following a service. They ask for the criteria for that person's role, look at the training, qualification and experience record, and then test the person against live work: how this incident was prioritised, why that change was approved, what happened after the last supplier review. When the criteria, the record and the conversation agree, the evidence holds.

• Role criteria covering education, training, experience and skills, linked to the roles named under clause 5.3.
• Individual records: qualifications, internal authorisations, CVs and supervised-shift sign-offs, current and traceable to one person.
• Effectiveness checks: a test, peer review of ticket quality, a supervisor's observation or a look at later performance against targets.
• Work records: the ITSM tool already shows who resolved, escalated, assessed and approved what, strong evidence when read against the criteria.

Framework qualifications have their place. ITIL certification is awarded to individuals, never to organisations, so it tells an auditor the person knows the practices. What it cannot show is that the person follows your change policy or your major-incident procedure. The relationship between the framework and the standard is covered in ISO/IEC 20000-1 vs ITIL 4: framework, standard and how they fit.

Where training evidence fails in service management audits

• Criteria written only for the service desk. Change, capacity and supplier roles have no defined competence, so nothing can be measured.
• Certificates standing in for competence. A folder of ITIL and vendor certificates with no link to role criteria or to the organisation's own processes.
• Knowledge held in people, not records. One engineer knows how to restore a service and the known-error database is empty.
• Suppliers and group companies overlooked. Staff of other parties who operate service components work to your SMS without induction; the controls over those parties sit in clause 8.2.3 and in the supplier agreements.
• Awareness that stops at induction. New services, tools and policies arrive and nobody is briefed.

Sterling Academy and internal auditor training

Sterling consulting clients receive preferential Sterling Academy course access and special pricing, including complimentary awareness training for their people as part of the engagement. E-learning suits the awareness layer that reaches everyone in scope, while the role depth in the matrix comes from on-the-job coaching, supervised practice and your own procedures.

Internal auditor training, as applicable to your standard, is part of the same proposal, so your audit team is prepared before the first internal audit of the SMS rather than after it.

Contact us about Academy access

ISO/IEC 20000-1 training: questions buyers ask