Overview
ISO/IEC 20000-6:2017 specifies requirements and guidance for certification bodies that audit and certify a Service Management System (SMS) against ISO/IEC 20000‑1. It complements - and is used alongside - ISO/IEC 17021‑1, providing SMS‑specific criteria to harmonize certification practices. It does not alter ISO/IEC 20000‑1 requirements. Accreditation bodies can also use ISO/IEC 20000‑6:2017 when assessing certification bodies.
Key topics and requirements
The standard focuses on practical controls and processes a certification body must have to reliably assess IT service management systems:
-
Principles and general requirements
- Legal and contractual matters, impartiality, liability and financing.
-
Management of impartiality
- Conflict‑of‑interest rules (e.g., limits on consultancy, training content, pre‑audit readiness activities) and rules for maintaining objective certification decisions.
-
Structural and resource requirements
- Organizational structure, competence of personnel, use of external auditors and technical experts, personnel records, and outsourcing rules.
-
Information requirements
- Public information, certification documents, use of marks, confidentiality and information exchange with clients.
-
Process requirements for audits and certification
- Pre‑certification activities (application, application review), audit programme, determining audit time, multi‑site sampling, handling multiple management system standards, planning audits, team selection, audit plans, and conduction of audits (opening/closing meetings, evidence gathering, reporting).
-
Nonconformities and corrective actions
- Recording findings, cause analysis, verification of effectiveness of corrections and corrective actions.
-
Decision and post‑decision activities
- Certification decision, maintaining certification (surveillance, recertification), appeals, complaints and client record management.
Practical applications and users
ISO/IEC 20000‑6:2017 is primarily used by:
- Certification bodies seeking to develop, demonstrate or benchmark their SMS audit and certification processes for IT service management.
- Accreditation bodies assessing certification bodies for compliance with SMS‑specific criteria.
- Large organizations and auditors preparing for or participating in SMS certification audits who want clarity on how certification bodies operate.
- Consultants and trainers who need to understand the boundary between acceptable pre‑audit activities and prohibited consultancy.
Benefits include more consistent audits, improved impartiality, clearer auditor competence requirements, and predictable processes for multi‑site and complex SMS audits.
Related standards
- ISO/IEC 20000‑1 - Service management system requirements (audit target)
- ISO/IEC 17021‑1 - Requirements for bodies providing audit and certification of management systems (generic certification requirements)
- ISO/IEC TR 20000‑10 - Concepts and terminology for IT service management
Keywords: ISO/IEC 20000-6:2017, SMS certification, service management, certification bodies, audit and certification, ISO/IEC 20000-1, ISO/IEC 17021-1, impartiality, auditor competence, multi-site sampling.
Open preview (PDF)Information technology — Service management — Part 6: Requirements for bodies providing audit and certification of service management systems