Internal Audit and Management Review Procedure

1. Introduction

A management system that is never examined drifts: procedures stay on paper while practice moves on. Internal audit is the Organisation's own periodic examination of whether the service management system conforms to its requirements and to the standard, and whether it is working. Management review is the point at which top management looks at all of the evidence, including audit results, and decides what to change.

The two activities are in one procedure because the output of the first is a main input to the second, and because corrective action ties them to the improvement register in the Service Reporting and Continual Improvement Procedure.

2. Purpose

The purpose is to provide information on whether the service management system conforms to the Organisation's own requirements and to the requirements of ISO/IEC 20000-1:2018 and is effectively implemented and maintained; to make sure that nonconformities are corrected and their causes removed; and to make sure that top management reviews the system at planned intervals and records its decisions.

3. Objectives

• Every clause of the standard and every service in scope is audited at least once in each [12 month] cycle, with higher-risk areas audited more often.
• Audits are carried out by auditors who are competent and who do not audit their own work.
• Every finding is recorded, classified and given an owner and a due date within [10 business days] of the audit report.
• Major nonconformities are corrected and their cause removed within [60 days]; minor within [90 days].
• Management review takes place at least [twice a year] and its decisions are recorded and tracked to completion.

4. Scope

• In scope: the whole service management system as defined in the SMS Scope and Service Management Plan, all clauses 4 to 10 of the standard, every documented process, every service in scope, and the organisational locations and teams that deliver them.
• In scope: processes or services delivered by suppliers, to the extent that the Organisation retains accountability, through audit of supplier management and, where the contract allows, a supplier audit.
• In scope: the conduct of management review.
• Out of scope: external certification or surveillance audits and customer audits, which are planned separately and which this procedure supports by supplying the latest internal audit evidence.
• Out of scope: audits of information security alone, which follow the Information Security Monitoring and Compliance Policy; they are combined with service management audits where practical.

5. Terms and Definitions

6. Roles and Responsibilities

7. Audit Programme

7.1 Planning principles

• The programme covers a [12 month] cycle and is approved by Top management by [the end of the first month] of the cycle.
• Frequency and depth are set by the importance of the process to customers, results of earlier audits, recent change, incident history and supplier dependence.
• A process with a major nonconformity open, a failed target or a recent significant change is audited again within [3 months] or sooner.
• Audits cover a sample of services across the cycle, so that every service is examined at least once and critical services at least [twice].
• The programme may be changed during the year by the Management representative, with changes noted to Top management, but a planned audit may not be cancelled because of workload alone.

7.2 Audit calendar

The calendar below is the default programme over the clauses of ISO/IEC 20000-1:2018. Dates are set at the start of each cycle in the audit plan.

8. Auditor Independence and Competence

8.1 Independence

• Auditors do not audit work they designed, carried out, managed or are accountable for. A person who is the process owner of a process cannot audit it, nor can their direct report.
• Where the Organisation is too small to staff independent audits, it uses an auditor from another team or [an external auditor under contract], and records why.
• Auditors are free from pressure on findings. A manager may not change a finding; disagreement is recorded and resolved by the Management representative.
• Auditors declare any conflict of interest before the audit, and the Lead auditor decides whether they can take part.
• The Management representative may not lead an audit of the audit process itself; Top management appoints another.

8.2 Competence

9. Audit Procedure

9.1 Inputs and outputs

9.2 Steps

1. PlanThe Lead auditor prepares the audit plan with scope, criteria, team, dates, interviews and sampling, and sends it to the Process owner at least [10 business days] before the audit.
2. PrepareThe team studies the procedures, earlier reports and recent performance and prepares the checklist in Annexure B. Target: [3 business days].
3. Opening meetingThe Lead auditor confirms scope, schedule, method and confidentiality with the Process owner. Target: first day, [15 minutes].
4. Collect evidenceThe team interviews staff, observes work, examines records and samples tickets, changes and releases. A sample of at least [10 percent or 10 records, whichever is greater] is taken from each population. Evidence is recorded with identifiers.
5. Judge findingsThe team compares evidence with criteria, records conforming practice as well as nonconformities and rates each nonconformity as major or minor. The Lead auditor confirms findings with the team.
6. Closing meetingThe Lead auditor presents the findings to the Process owner and Service owner, who may challenge facts but not the evidence. Target: last day of the audit.
7. ReportThe Lead auditor issues the audit report in Annexure C to the Management representative and Process owner. Target: [5 business days] after the closing meeting.
8. Corrective actionThe Process owner returns a corrective action plan for each nonconformity under the next section. Target: [10 business days].
9. VerifyThe Lead auditor verifies that actions were done and effective. Target: within [30 days] of the due date of the action.
10. CloseThe Management representative closes the audit when all findings are closed or accepted with a recorded decision.

9.3 Process flow

1. Top management approves the audit programme.
2. The Management representative appoints the audit team, checking independence and competence.
3. The Lead auditor issues the audit plan to the Process owner.
4. The team prepares, holds the opening meeting and collects evidence.
5. Findings are judged and presented at the closing meeting.
6. The audit report is issued and findings are entered in the improvement register.
7. The Process owner plans corrective action and carries it out.
8. The Lead auditor verifies effectiveness and the finding is closed.
9. Audit results go to management review.

10. Findings, Nonconformity and Corrective Action

1. ReactThe Process owner stops the nonconformity spreading and corrects its immediate effect, such as repairing a missing record or informing an affected customer. Target: as the table shows.
2. Find the causeThe Process owner, with the Lead auditor consulted, finds the root cause using a method such as five whys or a cause diagram and records it. Time target: [10 business days].
3. Decide the actionThe Process owner decides what will remove the cause, who owns it, the date and the evidence that will show it worked. Similar nonconformities elsewhere are checked.
4. Carry outThe action owner completes the action by the date. Any change to live services follows the Change Management Procedure.
5. Check effectivenessThe Lead auditor reviews the evidence and, where needed, re-tests. A nonconformity that recurs is raised again as major.
6. Record and closeThe Management representative updates the nonconformity register and the improvement register, closes the item and reports status to Top management monthly.

11. Management Review

11.1 Frequency and participants

Top management reviews the service management system at least every [6 months]. The meeting is chaired by [the Chief Executive Officer or delegate]. Required attendees are Top management, the Management representative, the Head of Service Management and process owners who present items. The review may be called sooner after a major incident, a significant change or an adverse audit result.

11.2 Inputs

11.3 Outputs

11.4 Steps

1. ScheduleThe Management representative sets the date [4 weeks] ahead and sends the agenda and input list.
2. Collect inputsInput owners supply their items in the agreed format. Target: [5 business days] before the meeting.
3. PackThe Management representative assembles a pack with a one-page summary and sends it [3 business days] before the meeting.
4. HoldTop management works through the agenda in Annexure E, challenges data and records decisions.
5. MinuteThe Management representative issues minutes in Annexure F within [5 business days] with actions, owners and dates.
6. ActAction owners deliver; actions enter the improvement register. The Management representative reports status monthly to Top management.
7. Report backThe outcomes are communicated to staff under the Communication Procedure within [10 business days].

12. Interfaces with Other Processes

13. Key Performance Indicators

14. Records and Evidence

Annexure A: Audit plan

Annexure B: Audit checklist

Annexure C: Audit report

Annexure D: Nonconformity and corrective action record

Annexure E: Management review agenda

Annexure F: Management review minutes

Annexure G: Audit programme register

Annexure H: Document history

15. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

16. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

17. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 20000-1:2018 references

Related documents

• Service Management System Manual
• Service Management Policy
• SMS Objectives
• SMS Scope and Service Management Plan
• Service Reporting and Continual Improvement Procedure
• Communication Procedure
• Documents and Records Management Procedure
• Information Security Monitoring and Compliance Policy