ISO/IEC 20000-1:2018 Internal Auditor Training

Opens with a self-assessment of your service management knowledge, then walks through three real outages: the July 2024 CrowdStrike Falcon update that Microsoft estimated affected about 8.5 million Windows devices, the February 2024 AT&T mobile outage where the FCC reported more than 92 million blocked calls after a misconfigured network element, and the August 2023 NATS flight planning failure that affected more than 700,000 passengers. Turns each into audit questions on release, change and major incidents. Introduces Kestrel IT Services, a worked example of a managed IT service provider in Singapore with about 650 staff and three services in scope. Contrasts two auditors of change management, explains clause 9.2, the scope of ISO/IEC 20000-1:2018 and its 2024 amendment, the definition of a service, and the clause 1.2 rule on other parties, then sets out the course structure, exam and four study habits.

What you will be able to do

• Explain what the CrowdStrike, AT&T and NATS outages teach a service management auditor
• Describe the purpose of internal audit under clause 9.2 of ISO/IEC 20000-1:2018
• Apply the clause 1.2 rule on other parties to an organisation that outsources parts of its services

Why it matters

Shows IT service managers and new auditors why evidence-based internal audits find release, change and incident weaknesses before an outage does.

Practice: Practice: Welcome: why service management audits matter · 3 questions

Starts with a new auditor at Kestrel IT Services demanding a documented capacity plan that the 2018 edition no longer requires. Introduces Parts 1, 2, 3, 5 and 10 of the series. Maps clauses 4 to 10 to the high level structure and walks through the seven groups of clause 8, from operational planning to service assurance. Explains that organisations may combine requirements into their own processes but cannot exclude any, using a London hospital IT department that does not charge for services. Defines service component, configuration item, asset, service catalogue, incident, problem, known error, service request, customer, user, internal and external supplier, request for change, release, SLA and service requirements. Covers the climate change points of Amendment 1 of 2024, five documents removed in 2018, how the standard relates to ITIL, and an exercise classifying a Mumbai bank's record.

What you will be able to do

• Identify the seven process groups of clause 8 and place an audit question in the right one
• Distinguish an incident, a problem, a known error and a service request in audit evidence
• Check whether a requirement still exists in the 2018 text before raising a nonconformity

Why it matters

Stops auditors raising findings from old checklists or misread terms, so every nonconformity rests on a real ISO/IEC 20000-1:2018 requirement.

Practice: Practice: The standard through an auditor's eyes · 3 questions

Begins with an auditor at Kestrel IT Services, eight months into its system, finding incident management working but capacity, budgeting and demand barely started. Introduces ISO/IEC 20000-5 and its typical steps: initiation, planning, implementation, evaluation and future action. Explains why the auditor reads the business case and how to run a baseline assessment or gap analysis as a real audit. Covers the two phasing approaches, starting with resolution and fulfilment, the risk of silos and the need to define interfaces between live and unfinished processes. Walks through the three maturity levels and Table 1, including how internal audit itself looks at each level, with a Sydney university IT team as a Level II example. Shows why a strong finding names a Part 1 requirement rather than a maturity level, gives four practical audit moves, contrasts a long-certified Dubai airline IT division, and ends with an exercise.

What you will be able to do

• Place a service management system in the typical implementation steps of ISO/IEC 20000-5
• Use the three maturity levels to decide where to look and how deep to audit
• Write findings that cite a Part 1 requirement rather than a maturity level

Why it matters

Helps auditors read a young or mature system in context, test the handovers where risks sit, and give management a report useful for planning.

Practice: Practice: What to expect at each stage · 3 questions

Opens with Kestrel IT Services' change manager auditing his own process for three years and reporting no findings while unapproved emergency changes continue. Walks through clause 9.2.1 and 9.2.2: audits at planned intervals, an audit programme that considers process importance, changes and previous results, and the duties on criteria, impartiality, reporting and records. Introduces ISO 19011:2026, the fourth edition published in May 2026, with its expanded remote auditing guidance. Defines an audit, objective evidence and the three sources of evidence, shown through major incident reviews where interviews, records and the ticket tool disagree. Builds the chain of criteria, evidence, finding and conclusion, then covers first, second and third-party audits, audit roles, programme, scope and plan, and combined, joint and remote audits. Explains the seven principles with Kestrel examples, cross-auditing for independence, a New York payments firm with one IT manager, and a canteen-rumour exercise.

What you will be able to do

• Explain what clause 9.2 requires of an internal audit programme and of each audit
• Link audit criteria, evidence, findings and conclusions into a finding that stands
• Apply the seven principles of auditing, especially independence and the evidence-based approach

Why it matters

Gives internal auditors the method and independence that make management trust their reports, so audits find problems instead of confirming them.

Practice: Practice: Internal audit, terms and principles · 3 questions

Begins with a Managed Backup service that appears on two bank clients' invoices at Kestrel IT Services but not in the scope statement. Explains clause 4.1 issues with four Kestrel examples, and the 2024 amendment's decision on whether climate change is relevant. Covers clause 4.2 interested parties and their requirements, then clause 4.3 scope, comparing a weak and a strong scope statement and reading scope where a public cloud provider operates components. Explains clause 4.4 and why the auditor follows one handover from problem to change, release and configuration record. A London hospital IT department shows that internal customers and suppliers count. Sets out what to expect at each Part 5 maturity level, the auditor's questions and evidence, the test of comparing scope with the catalogue and invoices, two worked findings including an unrecorded Singapore data location requirement, and a Toronto exercise.

What you will be able to do

• Audit the issues register, including a recorded decision on whether climate change is relevant
• Test a register of interested parties against a sample of contracts and SLAs
• Compare the SMS scope with the service catalogue and invoices to find services left undefined

Why it matters

Helps auditors confirm that the SMS covers the services actually delivered and the requirements customers actually set, the base for every other question.

Practice: Practice: Context, parties, scope and the SMS · 3 questions

Opens with three people at Kestrel IT Services giving three different answers on who may approve an emergency change at two in the morning. Walks through the twelve clause 5.1 duties in three groups, including the plan, levels of authority, value and control of other parties. Explains the definition of value and how to compare what leaders say customers value with objectives and targets. Covers the clause 5.2 policy and its two commitments, contrasting a weak and a strong policy, and the clause 5.3 roles of ensuring conformity and reporting performance, shown in Kestrel's revised roles. Gives four habits for interviewing top management and an example of six months of IT committee minutes at a Mumbai bank. Covers Part 5 maturity, the questions and evidence to seek, two worked findings on emergency change authority and a vacant SMS manager role, and a Hong Kong policy exercise.

What you will be able to do

• Audit top management's leadership duties under clause 5.1 through decisions and records
• Check a service management policy for its required purpose, framework and two commitments
• Interview top management briefly and confirm each answer against minutes, reports or budgets

Why it matters

Lets auditors test whether leaders truly run the SMS, finding gaps in authority and reporting that cause confusion during real incidents.

Practice: Practice: Leadership, policy and roles · 3 questions

Starts with Kestrel IT Services' forty-risk register that omits the public cloud provider hosting all three services. Covers clause 6.1.1 and the more specific clause 6.1.2, which requires documented risks related to the organisation, not meeting service requirements and other parties, their impact on customers, risk acceptance criteria and the approach to risk. Gives one risk from each source and an opportunity, shows how customer impact changes priority, and explains how to sample accepted high risks. Covers clause 6.1.3 actions, the options for treating risk and ISO 31000, and how a risk should travel into continuity plans, supplier contracts and management review. A Frankfurt logistics company's unfunded server replacement shows a rated but unaddressed risk. Explains clause 6.2 measurable objectives, SMART wording, a cascade from 99.95 per cent availability to team targets and the five planning answers, then maturity, evidence, a worked finding and a New York exercise.

What you will be able to do

• Check that a risk register covers all three risk sources in clause 6.1.2 and customer impact
• Trace a risk from the register to integrated actions in SMS processes and management review
• Assess whether service management objectives are measurable and have the five planning answers

Why it matters

Helps auditors find the risks that would hit customers hardest, such as supplier failure, and objectives that cannot be measured or achieved.

Practice: Practice: Risks, opportunities and objectives · 3 questions

Opens with Kestrel IT Services' service management plan, sound but two years old, while a second cloud region, a new ticket tool and a departed service management lead go unrecorded. Explains clause 6.3: create, implement and maintain the plan, what planning must consider, alignment of other plans, and the eight items it must include or reference, from known limitations to technology and measurement. Compares the old plan with reality and a continuity plan still listing a retired service. Covers clause 7.1 human, technical, information and financial resources, and clause 7.2 competence for everyone under the organisation's control, using Kestrel's change approvers. Explains the five clause 7.3 awareness points and how to test them through the job, and clause 7.4 communication, recalling the NATS review. A Toronto retailer's contractor engineers show competence still applies. Ends with maturity, auditor questions, evidence, a worked finding and a Mumbai service desk exercise.

What you will be able to do

• Compare the service management plan with current services, parties and technology item by item
• Audit competence records for staff and contractors who work under the organisation's control
• Test awareness and communication by asking people about their own work and recent incidents

Why it matters

Gives auditors a fast test of whether the SMS is alive, by checking the plan and the people against how services really run today.

Practice: Practice: The plan, resources and people · 3 questions

Opens in Kestrel IT Services' network operations centre, where a night engineer restores a database from an obsolete runbook saved on his laptop. Explains the two kinds of documented information in clause 7.5.1 and walks through the clause 7.5.4 list of key documents, from scope and policy to SLAs, supplier contracts, required procedures and records. Covers clause 7.5.2 identification, format and approval, the clause 7.5.3 controls, external documents and document change control. Distinguishes documents from records and shows how to audit records held in ticket and change tools: silent edits, retention and tool migrations. Lists records that clause 8 names process by process, and checks protection of sensitive ticket data that every agent can read. Explains clause 7.6 knowledge, with a Sydney university whose only exam-system engineer left. Ends with maturity, auditor questions, evidence, two worked findings including a missing major incident procedure, and a London exercise.

What you will be able to do

• Use the clause 7.5.4 list to check that key documented information and required procedures exist
• Audit the document version in use at the point of use against the approved version
• Test the integrity, retention and access controls of records held in service management tools

Why it matters

Helps auditors find obsolete procedures, unprotected tickets and knowledge held by one person before they cause a failed restore or a long outage.

Practice: Practice: Documents and knowledge · 3 questions

Begins with a five-hour bank database outage that Kestrel IT Services' hosting manager blames on the cloud provider, though the bank's contract is with Kestrel. Covers clause 8.1: performance criteria for each process, with four Kestrel examples, documented information for confidence, planned and unintended changes to the SMS, and control of outsourced processes. Explains the service portfolio in clause 8.2.1 and clause 8.2.2 planning: documented service requirements, criticality, dependencies and duplication, shown by a service desk tool that ran on the platform it supported. Sets out clause 8.2.3.1: retained accountability, selection criteria, the documented list of what other parties provide or operate, and integration. Covers the two kinds of control in clause 8.2.3.2 and the clause 1.2 limit on reliance. A Dubai airline's lowest-bid network supplier shows missing selection criteria. Ends with maturity, auditor questions, evidence, a worked finding on an unmeasured monitoring partner and a Mumbai exercise.

What you will be able to do

• Check that each process has performance criteria based on requirements and results against them
• Audit service dependencies and duplication under clause 8.2.2 for critical services
• Assess control of other parties through documented scope, selection criteria and measurements

Why it matters

Prepares auditors to test that the organisation stays accountable for outsourced service components and measures what suppliers actually deliver.

Practice: Practice: Operation, planning and other parties · 3 questions

Starts with Kestrel IT Services' configuration records listing 1,200 hosting servers while the cloud console shows 1,370. Explains clause 8.2.4: catalogues that describe services, intended outcomes and dependencies and checking the customer view. Covers clause 8.2.5 asset management against clause 6.3 obligations, with four Kestrel assets from database licences to secure disk destruction. Sets out clause 8.2.6: defined CI types, services as CIs, the five items recorded for each CI, detail matched to criticality, traceable changes, updates after deployment and verification at planned intervals. Shows how records drift when engineers create servers outside change management, why the auditor tests in both directions, and why relationships between items matter for incidents and changes. A Hong Kong insurer with 640 accounts on a 500-user licence shows a quick asset test. Covers baselines before release, maturity, evidence, two worked findings and a Sydney catalogue exercise.

What you will be able to do

• Check that catalogue entries describe outcomes and dependencies and match the SLAs
• Sample assets against their obligations, such as licence counts, data locations and disposal
• Test configuration records in both directions against the live environment

Why it matters

Lets auditors expose unknown servers, licence overuse and missing catalogue entries that slow incident response and create contract and cost risk.

Practice: Practice: Catalogue, assets and configuration · 3 questions

Opens with Kestrel IT Services' largest bank client, green on every target yet inviting other providers to bid. Explains clause 8.3.1 and how business relationship, service level and supplier management fit together. Covers clause 8.3.2: documented customers and users, named relationship owners, communication about the customer's evolving business, reviews of trends and outcomes, satisfaction measured on a representative sample, and complaints managed to closure with escalation. Shows a 96 per cent survey that only asked users with closed tickets, and traces a complaint about overly technical reports. Covers clause 8.3.3: agreeing services, SLAs with targets, workload limits and exceptions, the hosting SLA at 99.95 per cent in trading hours, and monitoring workload against limits. Describes a quarterly business review, compares weak and strong service reports under clause 9.4, and uses a London hospital's repeated missed target. Ends with maturity, questions, evidence, two worked findings and a Toronto exercise.

What you will be able to do

• Audit whether satisfaction surveys use a representative sample that includes decision-makers
• Check that each SLA includes service level targets, workload limits and exceptions
• Follow missed targets and service complaints through to improvement and closure

Why it matters

Helps auditors spot a customer relationship at risk even when targets are green, before the organisation loses a contract it thought was safe.

Practice: Practice: Relationships and service levels · 3 questions

Begins with Kestrel IT Services' four-hour restore promise to a bank while its data-centre operator's contract allows an eight-hour response. Explains clause 8.3.4.1: designated supplier managers, a documented contract with scope, requirements, targets and authorities, checked against Kestrel's public cloud agreement. Covers the requirement to assess supplier targets against customer SLAs and manage the risk, defined interfaces, monitoring at planned intervals, contract review against current requirements, impact assessment of contract changes and disputes managed to closure. Shows why the organisation checks the supplier's 99.995 per cent figure against its own monitoring, and rejects a cheaper support tier that would break two bank SLAs. Covers clause 8.3.4.2 agreements with internal suppliers and a bank acting as a supplier through its sign-in platform. A London retailer's unmanaged payment gateway contract, a monthly cloud supplier review, maturity, evidence, two worked findings and a Sydney exercise complete the module.

What you will be able to do

• Compare supplier contract targets with the customer SLAs they support and check risks are managed
• Audit supplier monitoring against the organisation's own data, not only supplier reports
• Check documented agreements with internal suppliers and customers acting as suppliers

Why it matters

Helps auditors find supplier contracts that cannot support customer promises, so one supplier outage does not become a broken SLA.

Practice: Practice: Supplier management · 3 questions

Opens with Kestrel IT Services' hosting storage filling at month-end after six weeks at 85 per cent, failing two banks' batch jobs, while a bank had already told its account manager its data would double. Covers clause 8.4.1 budgeting and accounting per service with Kestrel's hosting budget 18 per cent over on cloud costs, and compares weak and strong financial control. Explains clause 8.4.2 demand management and four places future demand hides: customer plans, the portfolio, trends and seasonal peaks. Covers clause 8.4.3 capacity for human, technical, information and financial resources, planning that includes forecast capacity, the impact of SLAs and continuity, and thresholds and timescales such as ordering storage at 75 per cent. Links rising cloud costs to unrecorded servers and uses a Frankfurt logistics service desk understaffed for holiday peaks. Ends with maturity, evidence, two linked findings and a Toronto exercise.

What you will be able to do

• Follow a cost overrun from the service budget to its cause and the decision taken
• Check that demand forecasts draw on customer plans, the portfolio, trends and seasons
• Audit capacity planning for people and technology, including thresholds and lead times

Why it matters

Prepares auditors to spot capacity and cost risks early, so known customer growth turns into capacity before a month-end failure.

Practice: Practice: Budgeting, demand and capacity · 3 questions

Opens with a Friday-night firewall change at Kestrel IT Services that took a bank's mobile app offline with no request, approval or back-out plan. Explains clause 8.5.1.1: a documented change policy defining items under control, categories including emergency change, and criteria for major impact, with Kestrel's revised standard, normal and emergency categories. Covers clause 8.5.1.2 initiation and when changes must go through service design and transition. Walks through clause 8.5.1.3: decisions considering risks, benefits and impacts, preparation and testing, communication, back-out planning, investigation of failed changes, effectiveness reviews and trend analysis. Explains why emergency changes are sampled first and why the auditor traces from firewall and server logs back to approvals. A trend analysis on Friday network changes and a Toronto retailer's failed checkout upgrade lead to maturity, evidence, a worked finding and a Hong Kong exercise.

What you will be able to do

• Check a change management policy for categories, emergency change and major impact criteria
• Trace changes from system logs back to their requests and approvals
• Audit back-out plans, failed change investigations and change trend analysis

Why it matters

Lets auditors find unapproved and emergency changes before they cause the next outage, one of the most common sources of service failure.

Practice: Practice: Change management · 3 questions

Begins with Kestrel IT Services' Managed Backup service, which went live without acceptance criteria or a tested restore, and whose first real restore took nine hours. Covers the eight planning items in clause 8.5.2.1, including acceptance criteria and measurable intended outcomes, plus planning for services that are removed or transferred. Explains the design contents in clause 8.5.2.2 and build and transition in clause 8.5.2.3, with recorded decisions when criteria are not met and reports on outcomes. Sets out clause 8.5.3: defined release types including emergency release, deployment planned with change management, verification against criteria, a baseline of configuration items and monitoring of post-release incidents. Revisits the CrowdStrike update, staged deployment and Kestrel's finding that a quarter of successful releases caused incidents. A New York payments firm's missing knowledge transfer leads to maturity, evidence, a worked finding and a Hong Kong exercise.

What you will be able to do

• Check that new services are planned with acceptance criteria and measurable intended outcomes
• Audit release verification, baselines and staged deployment, including emergency releases
• Measure release success using incidents in the period after deployment

Why it matters

Helps auditors stop new services and releases going live untested, reducing the risk of a failed launch or a release that breaks customers' services.

Practice: Practice: Design, transition and release · 3 questions

Starts with forty identical Monday-morning incidents at Kestrel IT Services, each restored within target but never linked to a problem record. Explains clause 8.6.1: incidents recorded, classified, prioritised by impact and urgency, escalated, resolved and closed, with records updated with actions. Covers major incident criteria, the documented procedure, informing top management, ownership and post-incident review, with a timed Kestrel storage incident and lessons from the November 2024 NATS review. Sets out clause 8.6.2 service request management and why access requests need the data owner's approval and instructions people can find. Explains clause 8.6.3: analysing incident trends, root cause analysis, changes through change management, known errors shared with the service desk, and reviewing effectiveness, following the Monday chain to closure. A Sydney university's problems closed without causes leads to maturity, evidence, two worked findings including unreviewed major incidents, and a Dubai exercise.

What you will be able to do

• Check incident priorities against impact and urgency and records against actions taken
• Audit major incidents by comparing the tool's count with the reviews held on file
• Count repeat incidents yourself and trace them to problem records and root causes

Why it matters

Prepares auditors to find repeat incidents nobody investigates and major incidents nobody reviews, so the same failures stop recurring.

Practice: Practice: Incidents, requests and problems · 3 questions

Opens with Kestrel IT Services' forty-page hosting continuity plan, never tested, with its contact list stored only on the office file server. Covers clause 8.7.1: assessing availability risks, documented requirements and targets, monitoring against them and investigating unplanned non-availability, and why availability measured from the users' side during trading hours beats a server figure. Explains clause 8.7.2: continuity risks and requirements, plans with five items including returning to normal, access to the plan and contacts when the normal location is unavailable, testing, re-testing after major change, and reports after real invocation. A Dubai airline's quiet Sunday failover test shows a test that does not prove the requirement. Covers clause 8.7.3 information security policy, risk assessment, documented control decisions, external organisations, and security incidents analysed by impact, and how to use an existing ISO/IEC 27001 system. Ends with maturity, evidence, a worked finding and a Mumbai exercise.

What you will be able to do

• Assess whether availability is measured from the user's side against agreed targets
• Test whether continuity plans and contact lists can be opened away from the normal location
• Audit information security control decisions and incident analysis for the services in scope

Why it matters

Helps auditors prove that continuity plans would work in a real disruption and that availability figures reflect what customers actually experience.

Practice: Practice: Availability, continuity and security · 3 questions

Begins with two twelve-page management review minutes at Kestrel IT Services that report every input but record no decision. Explains clause 9.1: what to monitor, valid methods, timing, analysis and the two evaluations, shown by a 92 per cent first-call resolution figure that falls to 74 per cent once reopened tickets are counted. Covers how to audit clause 9.2 itself, where Kestrel's programme ignored a new cloud region, a new ticket tool and Managed Backup. Walks through the twelve clause 9.3 inputs and the required outputs, with Kestrel's revised review recording three owned decisions. Explains clause 9.4 service reporting with trends and actions. Covers clause 10.1 nonconformity and corrective action, the difference between correction and corrective action, and clause 10.2 evaluation criteria, targets and measurement for improvements, with a Toronto retailer's thirty unmeasured improvements. Ends with maturity, evidence, a worked finding and a Hong Kong exercise.

What you will be able to do

• Recalculate a key service measure from raw records to check its method gives valid results
• Audit management review outputs and follow each recorded decision to its result
• Distinguish correction from corrective action and check similar nonconformities were sought

Why it matters

Lets auditors turn management review into a place where decisions are made, and confirm corrective actions and improvements actually work.

Practice: Practice: Evaluation and improvement · 3 questions

Opens with Kestrel IT Services' one-line audit plan that never reached change management before a firewall change took a bank offline. Places planning in Figure 1 of ISO 19011:2026, the audit programme cycle and the steps of a single audit. Revisits clause 9.2.2 and shows how importance, changes and previous results set priorities while every clause is still covered. Builds an example programme grid for Kestrel and adjusts it when a second cloud region raises failed changes. Covers selecting impartial and competent auditors, then defining objectives, scope, and criteria with clause titles, using a hosting change audit and a London hospital major incident audit. Sets out a one-day audit plan, choosing on-site or remote methods, preparation sources, four checklist types including a risk and SLA based checklist, a four-column format, and weak and strong checklist lines. Ends with a night-shift planning exercise and four common mistakes.

What you will be able to do

• Plan an audit programme that gives most time to high-risk, low-performing processes
• Define the objectives, scope and criteria of a single audit, naming clauses by number and title
• Write checklist questions that ask for evidence and name a sample

Why it matters

Helps auditors spend audit time where failures are most likely, so the audit finds the change or incident weakness before customers feel it.

Practice: Practice: Planning the audit programme to checklist · 3 questions

Opens in Kestrel IT Services' network operations centre, where an auditor skips the opening meeting, takes an engineer's keyboard and changes a live monitoring filter. Explains the three purposes of the opening meeting in clause 6.4.3 of ISO 19011:2026 and the eight points to confirm with a short version for small audits and a ten-minute Kestrel example. Covers on-site advice from Annex A: keep the site's rules, avoid disturbance and never touch equipment or live consoles, plus screenshots and the role of guides. Explains Table A.1 remote and on-site methods, four rules for remote auditing and a remote change record session with a tested plan B. Describes the qualities of a good auditor, five traits of a bad one, ten habits and two interviews of the same night-shift engineer, then two exercises on guides and borrowed logins.

What you will be able to do

• Run an opening meeting that confirms the plan, introduces the team and checks activities can run
• Apply on-site and remote audit methods with read only access and permission before screenshots
• Use auditor behaviours that build trust and draw complete and accurate information

Why it matters

Helps internal auditors earn the trust that makes engineers share what really happens, without disturbing live operations during the audit.

Practice: Practice: Conducting the audit, I opening, site, people · 3 questions

Explains investigating to the depth necessary, following a trail from a May storage outage to its change record and five more changes. Walks through Figure 2 of ISO 19011:2026, from sources of information through sampling and verification to findings and conclusions. Sets out the four checks of complete, correct, consistent and current, and applies them in a Frankfurt logistics company where a late patch turns out to be explained. Compares judgement-based and statistical sampling and the risk that samples are not representative. Covers open, closed, leading and appreciative questions, the tell me and show me technique, and talking to engineers, customers and suppliers. Shows what a good note holds, then follows Managed Cloud Hosting at Kestrel IT Services through nine clauses, from clause 6.1 risk to clause 9.3 management review. Adds guidance on context, leadership, risk and compliance, a defensible hosting sample and two exercises.

What you will be able to do

• Verify information as complete, correct, consistent and current before accepting it as evidence
• Choose and record a sample sized to the risk, using judgement or statistical sampling
• Follow one service end to end across clauses to test how SMS processes interact

Why it matters

Gives auditors findings that stand up at the closing meeting because every one rests on verified evidence, a recorded sample and clear notes.

Practice: Practice: Conducting the audit, II evidence, one service · 3 questions

Explains sharing findings with the auditee as you go and reviewing each nonconformity before the closing meeting, as clause 6.4.8 of ISO 19011:2026 describes, seeking acknowledgement of the evidence rather than acceptance of the finding. Covers generating findings and the guidance on grading, then Sterling's major and minor grading criteria, applied to Kestrel IT Services examples. Distinguishes opportunities for improvement and good practice, and four nonconformities that will not stand. Sets out the four parts of a nonconformity from Annex A, with worked statements on approver training under clause 7.2 and emergency change under clause 8.5.1.1, and weak and strong statements side by side. Covers the closing meeting in clause 6.4.10, the report contents in clause 6.5.1, the auditee's clause 10.1 response, a four-part nonconformity report form, reviewing a weak and a strong response, four ways follow-up fails, and an engineer error exercise.

What you will be able to do

• Grade nonconformities against defined criteria, separating them from improvements and good practice
• Write nonconformity statements with criteria, evidence, the statement and the grade
• Review corrective action responses and close nonconformities only on evidence that they work

Why it matters

Gives auditors findings that management acts on and follow-up that closes on evidence, so audit results lead to lasting fixes, not promises.

Practice: Practice: Findings, closing and follow-up · 3 questions

Starts with a new auditor who asks Kestrel IT Services for all its documents and receives two thousand files. Begins with one request for the key documents of clause 7.5.4, then gives targeted requests and a typical finding for each function: top management and value, the SMS manager's risks and audit programme, service owners and relationship managers, the service level manager's SLAs and workload, and the supplier manager's list of outsourced components and contract alignment. Continues with change and release logs and baselines, configuration and asset records tested in both directions, the service desk and problem management, capacity, demand and finance, service assurance, and HR competence records including contractors. Shows the one-page request sent before Kestrel's change audit. Covers using all three sources of evidence, pulling records live from tools instead of prepared spreadsheets, four red flags, and a Dubai exercise.

What you will be able to do

• Prepare a one-page evidence request of key documents and three items per function
• Match each request to the clause behind it and the typical finding in that function
• Pull records live from tools and treat evidence that looks too perfect as a question

Why it matters

Lets auditors arrive prepared with a short, targeted request, saving the auditee's time and spending the audit day on sampled records.

Practice: Practice: The evidence, function by function · 3 questions

Walks through six steps of an effective internal audit: start from ISO/IEC 20000-1 requirements before procedures, understand the setting, check documents against the work, test risks, objectives and awareness, review controls, changes and results, and close properly with follow-up. Follows a mock audit of incident and problem management at Kestrel IT Services by the supplier manager, independent of the area: the opening meeting, counting six major incidents against four reviews, forty identical Monday incidents with no problem record. Shows her two four-part nonconformities, one minor and one major, the closing meeting, the report two days later, the root cause, and closure on evidence after sixty days. Draws out four habits, four places audits go wrong and five takeaways, adds a quick check, an opportunity for improvement and a good practice, then describes the thirty-question final exam and how to start a first internal audit.

What you will be able to do

• Apply the six steps of an effective internal audit to any service management area
• Run a mock audit from opening meeting to nonconformities and verified closure
• Plan a first internal audit in an area outside your own work

Why it matters

Prepares learners to plan, conduct and report internal audits of their own SMS as clause 9.2 requires, with results that keep services reliable.

Practice: Practice: An effective audit, end to end · 3 questions