ISO 20000 Certification Auditor 4 — Questions and Answers
Question 1: When determining audit sample size for an ISO 20000 audit, which factor is most important?
- The annual revenue of the organization
- The number of auditors assigned to the audit team
- The risk level, volume of activity, and previous audit findings in the area (Correct answer)
- The personal preference of the lead auditor
Correct answer: The risk level, volume of activity, and previous audit findings in the area
Risk-based sampling ensures higher-risk or higher-volume areas receive proportionally more scrutiny, making the sample both efficient and representative.
Question 2: An organization claims conformity to ISO 20000-1 for a specific service but excludes capacity management from scope. What should the auditor determine?
- Exclusions are always permitted as long as documented
- Exclusions are only valid if the excluded process has no impact on service delivery conformity (Correct answer)
- The certification is automatically invalid
- Capacity management is an optional requirement and may always be excluded
Correct answer: Exclusions are only valid if the excluded process has no impact on service delivery conformity
ISO 20000-1 permits exclusions only when the excluded requirement does not affect the ability to deliver conforming services; the auditor must verify this justification.
Question 3: Which of the following best describes the role of 'audit criteria' in an ISO 20000 audit?
- The set of policies, procedures, and requirements against which audit evidence is compared (Correct answer)
- The list of personnel to be interviewed during the audit
- The scoring rubric used to rate the auditor's performance
- The timeline for delivering the audit report
Correct answer: The set of policies, procedures, and requirements against which audit evidence is compared
Audit criteria are the reference standards, policies, and requirements used as the benchmark for evaluating collected evidence.
Question 4: During a closing meeting, the auditee disputes a minor nonconformity finding. What is the auditor's appropriate response?
- Immediately withdraw the finding to maintain a positive relationship
- Escalate the finding to a major nonconformity to emphasize its importance
- Listen to the auditee's evidence; revise the finding if new evidence supports it, otherwise maintain it (Correct answer)
- Defer all disputed findings to the certification body without discussion
Correct answer: Listen to the auditee's evidence; revise the finding if new evidence supports it, otherwise maintain it
Auditors must remain objective — new factual evidence may warrant revision, but findings should not be changed due to pressure alone.
Question 5: What is the key output of an ISO 20000 stage 2 certification audit?
- A list of improvement recommendations for the service desk
- An audit report detailing conformity findings, nonconformities, and a certification recommendation (Correct answer)
- An updated service catalog approved by the auditor
- A financial assessment of the organization's IT budget
Correct answer: An audit report detailing conformity findings, nonconformities, and a certification recommendation
The stage 2 audit report documents the evidence reviewed, findings, any nonconformities, and the auditor's recommendation regarding certification.
Question 6: An auditor finds that the organization's business relationship management process lacks a mechanism for capturing customer satisfaction. What is the most likely applicable requirement?
- Clause 8.3.3 — Service level management
- Clause 8.3.1 — Business relationship management
- Clause 9.1.2 — Customer satisfaction (Correct answer)
- Clause 6.1 — Risk management
Correct answer: Clause 9.1.2 — Customer satisfaction
ISO 20000-1 Clause 9.1.2 explicitly requires the organization to monitor customer perceptions and satisfaction.
Question 7: Which ISO 20000-1 clause requires the organization to retain documented information as evidence that audit programs are being carried out?
- Clause 9.2 — Internal audit (Correct answer)
- Clause 7.2 — Competence
- Clause 8.1 — Operational planning and control
- Clause 10.1 — Nonconformity and corrective action
Correct answer: Clause 9.2 — Internal audit
Clause 9.2 explicitly requires the organization to maintain and retain documented information about the audit programme and audit results.
ISO 20000 Certification Auditor 4
When determining audit sample size for an ISO 20000 audit, which factor is most important?