ISO/IEC 20000-1: Is Your IT Service Management Keeping Up With Your Business?

Primary keyword: ISO/IEC 20000-1 IT service management
Secondary keyword: Benefits of an ISO consultant’s support

Your business has grown.

You have more employees. More customers. More software. More devices. More suppliers. More people working from different locations.

But have the processes behind your IT services grown with it?

Or are you still managing IT in much the same way you did when the business was half the size?

That gap can cause problems.

An employee cannot access a system, but nobody is quite sure who should deal with it.

Software is changed and something else unexpectedly stops working.

The same IT issue keeps returning.

A supplier blames your internal team. Your internal team blames the supplier.

People send messages directly to whoever they think can help because the proper support route takes too long.

Small problems are fixed quickly but nobody asks why they keep happening.

Eventually, this becomes normal.

People accept that systems occasionally fail.

Employees develop their own ways around IT problems.

The IT team spends more time reacting than improving.

Management sees IT costs increasing but struggles to understand whether the service is actually getting better.

This is where ISO/IEC 20000-1 IT service management can help.

ISO/IEC 20000-1 is not simply about having good computers, fast internet or the latest software.

It is about managing IT services in a structured way so they continue to support what the business and its customers need.

Because technology can change quickly.

Your IT service management needs to keep up.

IT is no longer sitting quietly in the background

Think about how much of your organisation depends on IT.

Email.

Customer records.

Finance systems.

Cloud platforms.

Phones.

File storage.

Websites.

Project systems.

Communication tools.

Stock systems.

Remote working.

Customer portals.

For many organisations, even a relatively small IT problem can affect normal work.

If email stops working, communication slows.

If employees cannot access files, jobs can be delayed.

If a customer system becomes unavailable, service can suffer.

If an important software update causes another system to fail, people may be unable to work.

IT services are therefore closely connected to business performance.

Yet some organisations still manage them as though IT is simply there to repair computers.

That view is becoming increasingly difficult to maintain.

IT services need planning, control, review and improvement just like other important business processes.

What is ISO/IEC 20000-1?

ISO/IEC 20000-1 is an international standard for an IT Service Management System.

That sounds complicated.

The basic idea is much easier to understand.

Your organisation provides IT services.

Those services need to meet requirements.

They need to be planned.

Responsibilities need to be clear.

Problems need to be managed.

Changes need control.

Suppliers need to be considered.

Performance needs to be reviewed.

And the service needs to improve over time.

ISO/IEC 20000-1 provides a framework for doing this consistently.

It helps organisations move away from managing IT purely through individual problems and towards managing the service as a whole.

That difference matters.

Fixing an employee’s laptop solves one issue.

Understanding why 20 employees experienced the same problem can improve the service.

Growth can expose weaknesses that were always there

A small business can sometimes manage IT informally.

Someone has a problem.

They walk across the office and ask the person who knows about computers.

Problem solved.

That might work with ten employees.

What happens when there are 50?

Or 200?

What happens when people work from home?

What if you have several offices?

What if part of your IT service is provided by external companies?

The informal approach starts to struggle.

Requests get missed.

Priorities become unclear.

People do not know whether an issue has been reported.

Several employees may report the same problem separately.

Nobody has a clear picture of what is happening.

This does not necessarily mean the IT team is performing badly.

The business may simply have outgrown the way IT services are managed.

That is an important distinction.

Processes that worked perfectly well five years ago may no longer be suitable today.

Being busy does not mean the service is working well

An IT team can be extremely busy while the service continues to struggle.

Tickets are being closed.

Calls are being answered.

Problems are being fixed.

Everyone is working hard.

But step back.

Why are the same issues returning?

How long are employees waiting?

Which services cause the most problems?

Are urgent issues being identified correctly?

Are changes creating new incidents?

Are suppliers meeting expectations?

Does anyone know?

Activity and performance are not the same thing.

A team can close hundreds of support requests every month.

That number tells you very little on its own.

If many of those requests are caused by the same preventable issue, there may be a bigger problem.

Good IT service management asks more useful questions.

Not simply:

“How much work did we complete?”

But:

“Is the service getting better?”

The same IT problem should not keep surprising you

Something breaks.

IT fixes it.

A week later, it happens again.

IT fixes it again.

Then it happens again.

At some point, the question needs to change from:

“How do we fix this?”

to:

“Why does this keep happening?”

This is one of the important differences between reacting to incidents and managing problems.

An incident needs attention because somebody’s service has been affected.

Restoring that service may be the immediate priority.

But if the same type of incident happens repeatedly, there may be an underlying cause.

Finding and addressing that cause could prevent future incidents.

That saves time for employees.

It saves time for the IT team.

It can also improve confidence in the service.

Repeated problems should provide information.

Use it.

Employees need to know where to go for help

IT support can quickly become confusing when there is no clear route for requests.

One employee sends an email.

Another sends a Teams message.

Someone calls.

Another person walks over to an IT employee’s desk.

A manager sends a message directly because their request is urgent.

Now support information exists in several places.

Which request came first?

Which is most important?

Has somebody already dealt with it?

Is there a record of what happened?

A clear process can help.

Employees need to know how to request support.

The IT team needs enough information to understand and prioritise requests.

And the business needs records that can help identify patterns.

This does not mean making support difficult.

Quite the opposite.

The process should be easy enough that employees actually use it.

If the official route takes too long or is unnecessarily complicated, people will find another way.

That tells you something about the process.

Priority needs to mean more than who shouts loudest

Not every IT issue has the same impact.

One employee having difficulty printing is not normally the same as a customer-facing system becoming unavailable.

Yet without a clear approach to priority, IT teams can find themselves dealing with whoever complains most loudly.

That is not a good use of resources.

Priority should consider the effect on the organisation.

How many people are affected?

Which service is involved?

Are customers affected?

Is important work unable to continue?

Does the issue create another significant risk?

Clear priorities help IT teams focus attention where it matters most.

They also help employees understand why their request may not be dealt with first.

Communication matters here.

Waiting is frustrating.

Waiting without knowing what is happening is usually worse.

Communication is part of the service

Imagine an important system stops working.

The IT team knows about it.

They are investigating.

Employees do not know that.

So they start reporting the problem.

Emails arrive.

Calls come in.

Managers ask for updates.

The IT team now spends valuable time telling individuals that they are already dealing with the issue.

One clear update could reduce much of that noise.

Communication is part of IT service management.

People need to know when important services are affected.

They need realistic information.

They may need to know what alternative arrangements are available.

And they need to know when the service has returned to normal.

Technical work matters.

So does keeping people informed.

Changes need control

Many IT problems do not begin with something breaking unexpectedly.

They begin with a planned change.

Software is updated.

A new system is introduced.

A setting is changed.

Equipment is replaced.

A supplier makes an alteration.

The change was meant to improve something.

Instead, another service stops working.

Change is necessary.

Businesses cannot freeze their technology because they are worried about problems.

But changes need thought.

What is being changed?

Why?

What could be affected?

Who needs to know?

Has it been tested where appropriate?

When should the change happen?

What will happen if it does not work?

These questions can reduce avoidable disruption.

Not every small change needs a huge approval process.

The level of control should make sense for the risk involved.

The aim is not to stop change.

It is to make change more reliable.

Do your IT services still match what the business needs?

This question is easy to forget.

IT services can continue operating long after the reason for them has changed.

A business introduces a system.

Five years later, the company works differently.

But the system remains.

Employees have created extra spreadsheets to fill gaps.

Manual processes have appeared.

People enter the same information in several places.

The software is technically working.

But is the service still suitable?

ISO/IEC 20000-1 IT service management encourages organisations to consider requirements.

What does the business need?

What do customers need where relevant?

What has been agreed?

Is the service delivering it?

Technology should support business processes.

The business should not spend years working around unsuitable technology simply because changing it feels difficult.

Service levels need to mean something

Businesses sometimes create targets because they believe they should have them.

Respond within a certain time.

Resolve a percentage of requests.

Maintain a certain level of availability.

Targets can be useful.

But only when they relate to something that matters.

Imagine an IT team has a target to respond to support requests within 30 minutes.

They respond to every ticket within ten minutes.

Excellent.

Except the response simply says:

“We have received your request.”

The employee then waits three days for help.

Technically, the response target has been achieved.

Has the service improved?

Perhaps not.

Measures should help you understand performance.

They should not exist simply so a report can turn green.

Ask what customers and users actually need from the service.

Then measure things that help you understand whether those needs are being met.

Your suppliers are part of your IT service

Few businesses manage every part of IT themselves.

You may rely on cloud providers.

Software companies.

Internet providers.

External IT support.

Data centres.

Phone providers.

Other specialist services.

When one of these suppliers has a problem, your employees may experience the effect.

From their point of view, the IT service is not working.

Telling them:

“That’s the supplier’s fault”

does not solve the problem.

Supplier relationships therefore need managing.

What service has been agreed?

Who is responsible for what?

How is performance reviewed?

How are problems raised?

What happens when a supplier fails to meet expectations?

Does the supplier notify you about important changes?

Are there several suppliers involved in delivering one service?

These questions can become especially important as IT becomes more complex.

The business needs to understand the full service, not just the parts it controls directly.

Knowledge should not live in one person’s head

Most organisations have someone who “just knows”.

They know how the old system works.

They know which supplier to call.

They know the unusual fix that solves a particular problem.

They know where an important setting is hidden.

That person is valuable.

They are also a risk if all the knowledge stays with them.

What happens when they are on holiday?

What if they leave?

What if they are dealing with another major problem?

Useful knowledge needs to be available to the people who need it.

That does not mean documenting every tiny action.

Focus on information that helps the service operate consistently.

Common fixes.

Responsibilities.

Supplier details.

Important processes.

Known problems.

Recovery information where appropriate.

Knowledge sharing makes the service less dependent on individual memory.

IT service management needs business involvement

IT cannot understand business priorities if nobody tells IT what they are.

A system might look unimportant from a technical point of view but be essential to a particular department.

An hour of downtime might have very little effect on one service and a major effect on another.

Business teams need to communicate their needs.

Senior management also has a role.

Resources need approval.

Priorities need agreement.

Risks need consideration.

Changes may affect the wider organisation.

This is why ISO/IEC 20000-1 should not become an IT department project that nobody else understands.

IT service management supports the business.

The business needs to be involved.

What happens when an important service fails?

Problems will happen.

Even well-managed IT services can experience failures.

The question is how prepared the organisation is to respond.

Which services are most important?

Who needs to be contacted?

What needs to happen first?

Are alternative arrangements available?

How will employees be informed?

What happens if a supplier is involved?

How will normal service be restored?

Thinking about these questions during a major failure is difficult.

Thinking about them beforehand is much easier.

Planning does not remove every risk.

It can make the response clearer.

Information security and IT service management need to work together

IT service management and information security are closely connected.

A service needs to be available.

But it also needs to be appropriately protected.

A rushed change could create a security weakness.

Poor access control could expose information.

A supplier issue could affect both service availability and security.

This does not mean ISO/IEC 20000-1 and ISO/IEC 27001 are the same thing.

They have different purposes.

But organisations using both can benefit from making sure their processes work together rather than creating two separate worlds.

A change process, for example, can consider both service impact and information security risk.

That is more useful than departments working independently.

Internal audits should look beyond whether a process exists

An internal audit should not simply ask:

“Do we have an incident process?”

and then tick a box when a document appears.

The more useful question is:

“Does the incident process work?”

Look at actual examples.

Were incidents recorded?

Were priorities sensible?

Were people kept informed?

Were repeated incidents identified?

Were actions completed?

Talk to employees.

Do they know how to get IT support?

Talk to the IT team.

Does the process help them, or are people constantly finding ways around it?

Internal audits should help identify gaps between what the organisation says happens and what really happens.

That is where useful improvement begins.

The benefits of an ISO consultant’s support

ISO/IEC 20000-1 can look daunting when an organisation first reads the requirements.

There are many parts to consider.

Services.

Customers.

Users.

Suppliers.

Incidents.

Problems.

Changes.

Performance.

Responsibilities.

Improvement.

The organisation may already be doing much of this work without calling it an IT Service Management System.

This is where the benefits of an ISO consultant’s support can become useful.

A consultant can help the business understand what it already has.

Which processes work well?

Where are the gaps?

Which existing records can be used?

Where are responsibilities unclear?

What needs to change?

Good consultant support should not begin by producing a large set of generic IT procedures.

The system needs to fit the organisation.

A small IT provider and a large internal IT department may manage services very differently.

The standard provides requirements.

The organisation needs processes that work for its own situation.

An experienced consultant can also bring an outside view.

People become used to their own problems.

“We always have issues after that update.”

“That supplier is always slow.”

“Everyone messages Steve directly.”

“We’ve always done it that way.”

These comments can reveal areas worth reviewing.

An outside person can ask the question that internal teams may have stopped asking:

Why?

Why does the issue keep happening?

Why does the process get ignored?

Why does one person hold all the knowledge?

Why is the supplier problem being accepted?

Why is this measure being collected if nobody uses it?

Those questions can help turn ISO/IEC 20000-1 from a certification exercise into an opportunity to improve the service.

Do not build the system for the auditor

This is one of the most important points.

A management system designed purely to pass an audit can become difficult to maintain.

Documents are created because someone thinks the auditor will want them.

Forms are introduced.

Extra approvals appear.

Employees follow the new process for a few weeks.

Then the audit ends.

Gradually, people return to the old way of working.

That is a sign that the system was never truly part of the business.

Instead, start with how the service needs to work.

Then consider the requirements of ISO/IEC 20000-1.

Where possible, use processes employees already understand.

Improve what is not working.

Add controls where there are genuine gaps.

Keep things as simple as the organisation allows.

A good system should help people manage IT services.

Not give them extra work with no clear purpose.

Management review should lead to decisions

Senior management needs to understand whether IT services are supporting the organisation.

That does not mean directors need to study every support ticket.

They need useful information.

Are important services meeting requirements?

What problems keep returning?

Are suppliers performing?

Are customers or users raising concerns?

Are planned improvements working?

Have risks changed?

Are resources suitable?

Does anything require management action?

Management review provides an opportunity to bring this information together.

It should not be a meeting held simply because the standard requires one.

It should help leaders make decisions about the service.

If the information presented does not help anyone make a decision, question whether it is the right information.

Improvement should be part of everyday IT management

There will always be opportunities to improve.

Some will be large.

Replacing an old system.

Changing a supplier.

Redesigning a support process.

Others may be tiny.

Improving an email template.

Updating instructions.

Removing an unnecessary approval.

Adding a useful piece of information to a support form.

The important part is recognising opportunities and deciding what is worth doing.

Listen to users.

Review incidents.

Look at repeated problems.

Consider audit findings.

Review supplier performance.

Look at service data.

These sources can tell you where improvements may be needed.

Then check whether the change actually helped.

Improvement is not complete simply because an action was closed.

Did it make things better?

Ask whether your IT team is constantly reacting

This can be a useful warning sign.

If almost every day is spent dealing with urgent problems, when does anyone have time to improve the service?

Constant firefighting can become a cycle.

Problems take all the available time.

Because everyone is busy, underlying causes are not investigated.

The same problems return.

Everyone becomes even busier.

Breaking that cycle may require management support.

Teams need time to investigate.

Processes may need changing.

Investment may be required.

Supplier issues may need addressing.

ISO/IEC 20000-1 can provide a framework for taking that wider view.

The aim is not to stop incidents completely.

It is to manage services in a way that reduces unnecessary disruption and supports continual improvement.

A useful IT service check for your business

Choose one IT service your organisation depends on.

It could be email.

Your customer management system.

A finance platform.

Cloud storage.

A production system.

Your help desk.

Then ask some simple questions.

Who depends on this service?

What do they need from it?

Who is responsible for it?

Which suppliers are involved?

What happens when it fails?

How do people report problems?

Do the same issues keep happening?

How are changes controlled?

How do you know whether the service is performing well?

When was it last reviewed?

Most importantly:

Does the service still meet what the business needs today?

The answer may be yes.

If so, good.

But if the business has changed while the service and its processes have stayed still, you may have found an area that needs attention.

Your IT services need to grow with your business

Businesses rarely stand still.

Teams grow.

Customers change.

Technology develops.

Working practices evolve.

New suppliers appear.

People work from different locations.

Services that were once useful become critical.

Processes that once worked become too informal.

Your IT service management needs to respond.

That is the real value behind ISO/IEC 20000-1 IT service management.

It provides a structured way to understand services, manage responsibilities, respond to problems, control changes, work with suppliers, review performance and keep improving.

Not because every IT department needs more paperwork.

But because modern businesses depend heavily on IT services working reliably.

So do not only ask whether your technology is keeping up.

Ask whether the way you manage that technology is keeping up too.

Because adding more systems, software and suppliers to weak processes does not necessarily create better IT.

Sometimes it simply creates more problems to manage.

As your business grows, your IT services need to grow with it. And so does the way you manage them.