ISO 20000-1 vs ITIL 4: the auditable standard, the good-practice framework and how they fit together

ISO 20000-1 vs ITIL: the short answer

Choose between them only if you misunderstand them. ITIL 4 tells your teams how good IT service management tends to work. ISO/IEC 20000-1 states what a service management system (SMS) must contain and do, in terms an auditor can test, and it leads to a certificate your customers can verify. Most organisations that seek the certificate already use ITIL ideas, and most ITIL users that face customer audits, outsourcing contracts or government tenders eventually need the certificate.

So the practical question is rarely "which one". It is how far your ITIL-based practice already meets the standard, and what has to be added before a certification body will sample it.

What is ITIL 4, and what is ISO/IEC 20000-1?

ITIL 4: a framework of practices

ITIL is a framework with a set of practices for IT activities, of which IT service management is the best known. The current version, ITIL 4, was released in February 2019 and describes 34 practices. The ITIL trademark has been owned by PeopleCert since 2021. It is guidance: it does not say what an organisation shall do, and nobody audits a company against it. Qualifications in ITIL are awarded to individuals only.

ISO/IEC 20000-1: the requirements for a service management system

ISO/IEC 20000-1:2018, amended in 2024 to ask whether climate change is a relevant issue, specifies requirements to establish, implement, maintain and continually improve an SMS. Its clauses 4 to 10 follow the harmonised structure of ISO management system standards: context, leadership, planning, support, operation, performance evaluation and improvement. Operation covers the service portfolio, relationship and agreement, supply and demand, service design, build and transition, resolution and fulfilment, and service assurance. An independent certification body, accredited to ISO/IEC 17021-1 and ISO/IEC 20000-6, audits conformity and decides on certification. Sterling does not certify.

Side by side: scope, assessment, output and cycle

The table sets the two out on the points buyers usually compare.

How do ITIL 4 and ISO/IEC 20000-1 fit together?

Think of ITIL 4 as the playbook and the standard as the contract you sign with an auditor. ITIL helps a team decide how to triage an incident, run a change routine or manage a supplier relationship. ISO/IEC 20000-1 then asks for proof: that the incident was recorded and resolved to its target, that the change was assessed and approved under a change management policy, that the supplier's contract is aligned with the service level agreement it supports.

ISO recognised the overlap formally. ISO/IEC TS 20000-11:2021 gives guidance on the relationship between ISO/IEC 20000-1 and ITIL, maps ITIL 4 to the standard and states that ITIL can support the demonstration of conformity. The wording matters. A mapping shows where your ITIL practice is likely to help; it does not show that the records exist or that the system works.

What the standard requires that ITIL practice alone does not supply

• A defined SMS scope naming the services, customers and locations, and a service management policy top management actually uses.
• Risks and opportunities for the services and the SMS, measurable objectives, and the service management plan of clause 6.3.
• Control of documented information and of the knowledge teams need, under clause 7.
• A documented list of services, service components and processes operated by other parties, including group companies, under clause 8.2.3.
• Service reporting, an internal audit programme and a management review that makes decisions, under clause 9.
• Nonconformities corrected and improvements evaluated for effect, under clause 10.

The operational clauses will feel familiar to an ITIL team. The management-system clauses around them are where most ITIL-based organisations have gaps. The requirements guide covers each clause, and the documentation guide lists the documents and records the standard names.

Which one, or both?

Match the route to what you are trying to prove, and to whom.

Organisations already working to ITIL-based processes in an ITSM tool tend to reach certification at the shorter end of the six to twelve months a first ISO/IEC 20000-1 project usually takes. Those agreeing a catalogue and service levels with customers for the first time need longer. The certification process guide sets out the steps, and the ISO/IEC 27001 integration guide explains the combined system.

Common misunderstandings about ITIL and ISO/IEC 20000-1

"We are an ITIL-certified company"

No such certificate exists for an organisation. A tender response that says so invites an awkward question; say how many staff hold ITIL qualifications, and, if you have it, cite the ISO/IEC 20000-1 certificate and its scope.

"Our mapping to TS 20000-11 proves conformity"

A mapping is a planning aid. The certification body samples records: requests for change with their assessments, incidents against targets, continuity test results, supplier performance reviews.

"The ticketing tool is our SMS"

The tool holds operational records. Policy, objectives, risks, the service management plan, internal audit and management review sit around it, and without them there is no system to certify.

"Training everyone in ITIL gets us certified"

Clause 7.2 asks the organisation to determine and evidence competence for each role. ITIL qualifications can form part of that evidence; they cannot replace it. The training guide explains what proves competence.

ISO/IEC 20000-1 and ITIL 4: questions buyers ask