Three reasons why ISO20000 certification is NOT ITIL V3 certification

A new publication from OGC highlights three good reasons why an ISO20000 certification of an organisation does not provide ITIL V3 certification (and the last one applies to ITIL V2 as well).

OGC have replaced the white paper on differences between ISO20000 and ITIL by Jenny Dugmore and Alison Holt (summarised here - does anybody have the original document?) with a new paper by Jenny Dugmore and Sharon Taylor, updated for ITIL V3 and more systematically addressing the differences.

This paper is second in a 'series' from OGC, following on from one that covered ASL. The conclusion of that ASL paper is that ITIL and ASL are "Living Apart Together". The IT Skeptic's interpetation: they have divorced but stay in touch occasionally. More on ASL in another post.

We look forward to the remaining COBIT paper as perhaps the most useful of the three (and probably the hardest to do).

Studying this latest ISO20000 paper reveals three reasons why ISO20000 certification of an organisation is NOT ITIL certification:

  1. ISO20000 only recognises the management of financial assets, not assets which include "management, organization, process, knowledge, people, information, applications, infrastructure and financial capital", nor the concept of a "service asset". So ISO20000 certification says nothing about the management of 'assets' in an ITIL sense.
  2. ISO20000 does not recognise CMS or SKMS, and so does not certify anything beyond CMDB
  3. An organisation can obtain ISO20000 certification without recognising or implementing the ITIL concept of Known Error, usually considered essential ITIL.

N.B. Yeah yeah, I know it is called ISO/IEC 20000. "Stop calling him Bert. His name is Engelbert".

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Of course it isn't

Well, Skep..

I assume that you are doing just an analysis of the OGC document, because of course it is impossible that a pre-V3 certification can be V3 "compliant". It is so obvious that I had to tell... :-)

Antonio

under the illusion

It isn't obvious to everyone - there are a lot of people under the illusion that ISO2000 does in fact indicate ITIL compliance.

And in fact this POST-V2 certification isn't version 2 compliant either, unless Known Error doesn't matter...

It doesn't matter...

Of course KE can be important in someone's business. On the other hand, there are companies with only IM and rudiments of Change Management implemented, braging on their "ITIL compliancy", and they stay alive.
Some businesses implement pieces of SLM and CMDB and they talk about ITIL like they invented it.

ISO2k introduced Supplier Management and Business Relationship Management in V2 era, which are also kind of important to some people. ISO2k is probably impossible to implement without ITIL (V2) help, but at least can be done. And it will be some time before someone will show us an ITIL V3 compliant company. Until then, we should work with what we have...

Compliance auditing is all about pedantry

Certification is a precise process. Certification says you have done it right. In theory certification says your systems will work with the systems of your suppliers and customers, in a value chain.

If you don't even acknowledge the existence of a Known Error then this is an issue. A pedantic issue but an issue nevertheless. Compliance auditing is all about pedantry :-D

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.
Syndicate content