ISO/IEC 20000-1 IT Service Management Certification in China
itmad audits ISO 20000-1 IT service management in China: two-stage audit, three-year certificate, China-based and travelling auditors.
ISO/IEC 20000-1 is the international standard for IT service management systems, and itmad audits ISO 20000-1 IT service management systems for organisations in all industries in China. itmad audits with both China-based auditors and a travelling team, and has worked in China for more than 10 years. ISO 20000-1 certification from itmad follows a two-stage audit and produces a certificate that runs for three years with annual surveillance audits.
What ISO 20000-1 is
ISO/IEC 20000-1 specifies requirements for an IT service management system: defining what services an organisation delivers, agreeing what level of service is committed, running the processes that sustain the service, and demonstrating improvement over time. ISO 20000-1 certification is independent confirmation that the service is managed rather than merely provided.
Who ISO 20000-1 applies to
An organisation in China needs ISO 20000-1 certification when a customer or supplier programme asks for independent proof of its IT service management. ISO 20000-1 applies to any organisation that delivers IT services, including:
- Managed service providers and IT outsourcers
- Data centres and hosting providers
- Software and SaaS companies operating a support function
- Internal IT departments serving a large organisation
- Government technology entities and their suppliers
- Telecommunications and network service operators
itmad audits ISO 20000-1 for organisations in all industries in China.
Why organisations certify to ISO 20000-1
For managed service providers and outsourcers, ISO 20000-1 gives a client assurance that service management is systematic rather than dependent on individuals. For internal IT functions, ISO 20000-1 is the framework that turns informal practice into something that survives staff turnover. ISO 20000-1 also pairs with ISO 27001 for technology providers: ISO 27001 covers whether the service is secure, and ISO 20000-1 covers whether the service is reliably delivered.
What ISO 20000-1 requires
- Service portfolio and catalogueWhat services are delivered, to whom, and on what terms, documented rather than assumed, and kept current as services change.
- Service level managementAgreed, measurable service levels with defined reporting, and performance measured against the service levels rather than against internal convenience.
- Incident and service request managementLogging, prioritisation, escalation and resolution, with evidence that the process is followed under pressure rather than bypassed.
- Problem managementIdentifying underlying causes behind recurring incidents and removing the causes, a process that is often documented but less often practised.
- Change managementAssessment, authorisation and controlled release of changes, including emergency changes and the retrospective approval that governs emergency changes.
- Configuration managementA configuration management database that reflects reality, since change and incident processes depend on knowing what is actually deployed.
- Capacity and availabilityPlanning to meet agreed demand and availability targets, with monitoring that gives warning before a threshold is breached.
- Service continuityContinuity requirements derived from service commitments, with plans that have been tested rather than written.
- Supplier managementControl of suppliers and their contribution to the service, including cloud and subcontracted components that the organisation depends on but does not operate.
- Service reporting and improvementReporting against commitments, and a continual improvement process with evidence of changes actually made.
ISO 20000-1 and ITIL
ISO 20000-1 and ITIL are frequently confused. ITIL is a body of guidance describing how service management can be done; ISO/IEC 20000-1 is a standard stating what a management system must contain, and ISO/IEC 20000-1 is the one that an organisation can be certified against. An organisation working to ITIL is well positioned for certification but is not thereby certified, and the gap is usually in evidence rather than in practice: the processes run, but the records demonstrating that the processes run are incomplete.
Where ISO 20000-1 audits find gaps
Change management under pressure is the recurring gap in ISO 20000-1 audits: a documented process that is followed for planned work and bypassed for anything urgent, with emergency changes never retrospectively authorised. Configuration data that has drifted from reality is the second gap. Service reporting produced for the audit rather than used by anyone is the third gap, because a report nobody reads is not evidence of service management.
Scope of an ISO 20000-1 certificate
The ISO 20000-1 certificate states which services and locations are covered, and a client checks that the service the client buys is inside the scope. Scope also has to account for services delivered through suppliers: an organisation remains accountable for components that the organisation does not operate, and the standard requires the organisation to demonstrate control over those components.
Certification in China
An ISO 20000-1 certificate states the certified scope, including the services and locations covered, and a Chinese buyer or supplier programme checks that scope wording. Each Chinese buyer or supplier programme sets acceptance conditions for ISO 20000-1 certificates.
How itmad delivers ISO 20000-1 in China
itmad delivers ISO 20000-1 audits in China through China-based auditors and a travelling team, and certifies organisations in all industries. ISO/IEC 17021-1 prevents a certification body from designing, implementing or consulting on the management system that the body certifies, and itmad does not. itmad provides the audit, the certification decision, and optional pre-assessment that identifies gaps against the standard without prescribing how an organisation closes those gaps.
The ISO 20000-1 certification process
Stage 1 of an itmad ISO 20000-1 audit reviews the documented system, confirms the scope and the services covered, and establishes readiness. Stage 2 of an itmad ISO 20000-1 audit assesses implementation: incident and change records, service level performance against commitments, problem investigations and their outcomes, and whether personnel describe the process that the documentation claims.
ISO 20000-1 timeline
An ISO 20000-1 certificate from itmad runs for three years, with annual surveillance audits in each intervening year and recertification before the certificate expires.
What itmad provides
- Stage 1 report identifying readiness gaps before the main audit
- Stage 2 audit report with findings supported by objective evidence
- Nonconformities classified by severity with defined response timescales
- Certificate of registration stating the certified scope and services
- Certification mark for use under the terms of itmad's mark and seal policy
- Annual surveillance audits and reports through the three-year cycle
Frequently asked questions
What is ISO/IEC 20000-1?
ISO/IEC 20000-1 specifies requirements for an IT service management system: defining what services an organisation delivers, agreeing what level of service is committed, running the processes that sustain the service, and demonstrating improvement over time. ISO 20000-1 certification is independent confirmation that the service is managed rather than merely provided.
How does ISO 20000-1 certification work with itmad in China?
itmad audits ISO 20000-1 in two stages. Stage 1 reviews the documented system, confirms the scope and the services covered, and establishes readiness. Stage 2 assesses incident and change records, service level performance against commitments, and problem investigations and their outcomes. The ISO 20000-1 certificate runs for three years with annual surveillance audits.
Does itmad use auditors based in China?
itmad uses both China-based auditors and a travelling team for ISO 20000-1 audits in China. itmad has worked in China for more than 10 years.
What is the difference between ISO 20000-1 and ITIL?
ITIL is a body of guidance describing how service management can be done, while ISO/IEC 20000-1 is a standard stating what a management system must contain. ISO/IEC 20000-1 is the one that an organisation can be certified against.
What are the most common ISO 20000-1 audit findings?
Change management under pressure is the recurring gap in ISO 20000-1 audits: a documented process followed for planned work and bypassed for anything urgent, with emergency changes never retrospectively authorised. Configuration data that has drifted from reality is the second gap, and service reporting produced for the audit rather than used by anyone is the third.
How does ISO 20000-1 relate to ISO 27001?
ISO 27001 covers whether an IT service is secure, and ISO 20000-1 covers whether the service is reliably delivered. ISO 20000-1 therefore pairs with ISO 27001 for technology providers.