ISO/IEC 20000-1 audits how a company runs its IT services for customers: how services are defined, how incidents and changes are handled, and how suppliers are managed. The auditor tests whether the service management system works in practice, using tickets, change records and review minutes as proof. This checklist follows the current edition, ISO/IEC 20000-1:2018.
Last reviewed: 17 October 2026. Facts checked. A web search confirmed that ISO/IEC 20000-1:2018 is the base edition and that ISO published Amendment 1:2024, "Climate action changes", in February 2024. National standards body listings describe it as current. The search did not describe the clause-level changes, so we say nothing about them. We did not open the standard, a paid document, so the process areas below are audit prompts based on common practice, not the standard's own list. Read the clause text before you audit.
What the standard is for
ISO/IEC 20000-1 sets requirements for a service management system (SMS). In plain words, an SMS is how a service provider plans, delivers and improves its services so that customers get what was agreed. It can apply to an in-house IT team serving its own business or to an outside provider serving clients.
It is not the same as an IT general controls review. That work asks whether financial reporting systems are reliable. This audit asks whether the service is run well. For the controls view, see our ITGC audit guide.
Before you start
Agree the scope: which services, which customers, which sites and which teams. Get the service catalogue, the service level agreements, the incident and change records for the audit period, and the last management review. Plan to sample, not to read everything. Our guide to running an ISO internal audit covers planning and interviews.
Checklist by area
| Area | Questions | Evidence |
|---|---|---|
| Context and scope | Are services, customers and interested parties defined? Is the climate relevance decision recorded? | Scope, interested party list |
| Leadership | Is there a service management policy and are roles assigned? | Policy, role descriptions |
| Planning | Are risks and objectives set for services? | Risk register, objectives, plan |
| Service catalogue and levels | Is each service described with agreed targets? | Catalogue, service level agreements |
| Service reporting | Are results against targets reported to customers? | Monthly or quarterly reports |
| Capacity and availability | Is demand watched and are outages analysed? | Capacity reports, availability records |
| Incident management | Are incidents logged, prioritised, resolved and closed with the customer's agreement? | Ticket sample |
| Problem management | Are repeat incidents traced to a root cause? | Problem records, known error list |
| Change management | Are changes assessed, approved and reviewed? | Change sample with approvals |
| Release and deployment | Are releases tested and reversible? | Release records, test results |
| Configuration | Is there a reliable record of what supports each service? | Configuration records |
| Suppliers | Are suppliers managed against agreed targets? | Contracts, supplier reviews |
| Continuity and security | Are plans tested? Are information security controls in place? | Test records, security policy |
| Improvement | Are findings and complaints turned into actions? | Improvement log |
Test incidents, changes and problems with samples
These three give the quickest view of whether the system is real.
Incidents. Pull ten tickets. Check the time logged, the priority given, the resolution time against the agreed target, and whether the customer confirmed closure. Look for tickets closed without a note.
Changes. Pull ten changes, including at least one urgent change. Check that each had an assessment, an approval from the right person before the work, a test, and a review afterwards. An urgent change approved a week later is a pattern to report.
Problems. Find an incident that repeated. Was a problem record opened? Was the root cause found and the fix tracked to completion?
Check the link between promises and reports
Match one service level agreement to its report. If the agreement says 99.5 percent availability, find the outage log and recompute the figure yourself. A report that cannot be rebuilt from raw records is a finding.
Suppliers and shared responsibility
Many services depend on cloud hosts, network providers or software vendors. Ask which parts of a service the company controls and which belong to a supplier. Check that supplier targets support the targets promised to customers. A promise of four-hour recovery backed by a supplier with a two-day target does not add up. See our guide on supplier and third-party audits.
Common findings
- Service targets exist but are not measured.
- Urgent changes skip approval and no one reviews them.
- Problem records are opened rarely, so the same incident repeats.
- The configuration record is out of date.
- Supplier performance is not reviewed.
- Management review does not look at service results.
Grade them using major vs minor nonconformities.
Frequently Asked Questions
Is ISO/IEC 20000-1 the same as ITIL?
No. ITIL is a set of good practice guidance. ISO/IEC 20000-1 is a standard with requirements that a company can be audited and certified against. Companies often use ITIL ideas to meet it.
Does the 2024 amendment change the audit?
It is titled "Climate action changes". We could not see the clause detail in our search, so check the amendment text. In practice, expect the company to show it has considered whether climate change is relevant to its service system.
Can an internal IT team be certified?
Yes, the standard applies to a service provider, which can be an internal team serving its own organisation. The scope should say so clearly.
How many tickets should we sample?
There is no fixed number in the standard that we verified. Choose a sample that covers each service, each priority level and the audit period, and increase it if you find errors.
How does this relate to ISO 27001?
ISO 27001 covers information security. ISO/IEC 20000-1 covers service delivery. Many companies run both. See our ISO 27001 internal audit guide.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error