ISO 20000 vs ITIL: what is the difference?

ITIL is a framework of recommended practice for IT service management. ISO 20000-1 is a standard with requirements, and only a standard can be certified.

That single distinction answers most of the confusion. The two are not competitors. One tells you how you might run IT services. The other defines what a management system for IT services must contain, so that an outsider can check it.

What ITIL is

ITIL is a body of guidance for planning, delivering and improving IT services. It started in the UK as a set of government publications and is now maintained by PeopleCert. The current version, ITIL 4, describes a service value system and a set of practices such as incident management, change enablement and service desk.

ITIL does not say "you must". It says "this works, adapt it". A company can follow ITIL closely, loosely or only in parts, and nobody checks. That flexibility is the strength of the framework. It is also why a supplier cannot hand a customer a document that proves compliance.

ITIL certification exists, but it applies to people. An employee can pass ITIL 4 Foundation or a higher level. The exam shows that this person knows the framework. It says nothing about how your organisation works on a Tuesday afternoon when a customer system is down.

What ISO 20000-1:2018 is

ISO/IEC 20000-1:2018 is the international standard for an IT service management system. It contains requirements. An organisation meets them or it does not.

The standard follows the high level structure used by other management system standards such as ISO 9001 and ISO 27001:

• Clause 4, Context of the organization
• Clause 5, Leadership
• Clause 6, Planning
• Clause 7, Support
• Clause 8, Operation
• Clause 9, Performance evaluation
• Clause 10, Improvement

Clause 8 is where the IT-specific content sits: service portfolio, service level agreements, change, incident and request handling, continuity and availability. The other clauses ask for the management side. Who is responsible, which objectives you set, how you measure them, what you do when something goes wrong.

Because the structure is shared, a company that already holds ISO 9001 will recognise most of the skeleton. The IT service content is what is new.

ISO 20000 vs ITIL side by side

The last row matters most in daily work. ITIL helps you decide how a change should be approved. ISO 20000-1 asks you to show that you have a defined way of approving changes, that you follow it, and that you review whether it works.

Can an organisation be ITIL certified?

No. You will see phrases such as "ITIL certified company" on websites and in tenders, but there is no certificate for an organisation against ITIL. What the phrase usually means is that some employees hold ITIL qualifications, or that the company says it works along ITIL.

A purchasing department that wants proof about the organisation needs something else. That is the role ISO 20000-1 plays. A certificate against the standard says that the organisation has a service management system that meets the requirements, and it can be verified by the party asking.

Which one does your customer ask for?

Look at the wording in the supplier questionnaire or the tender.

If it asks for "ISO 20000" or "a certified service management system", ITIL qualifications will not answer the question. You need the certificate.

If it asks for "processes aligned with ITIL", you can usually answer in writing and describe how your service desk and change process work. A certificate against ISO 20000-1 is often accepted as stronger evidence, but the customer decides.

If the tender is silent on both, think about who reads your offer. Public bodies, larger enterprises and regulated sectors tend to ask for formal evidence. Smaller customers often ask only whether you have a ticket system and a contact for emergencies.

For small providers, the question is rarely "which of the two is better". It is "which gap costs me orders". The guide on ISO certification for small and medium businesses goes into how to weigh that against your size and customer base.

Using ITIL and ISO 20000-1 together

Many IT providers do both, and the combination is sensible. ITIL supplies the practical vocabulary and methods. ISO 20000-1 supplies the frame that makes those methods auditable.

A typical example: your team uses ITIL terms for incident and problem management. ISO 20000-1 then asks you to document the process, assign responsibilities, record incidents, review trends and act on them. If your team already does this in a ticket tool, most of the evidence exists. It only has to be organised.

The reverse also happens. A company has a certificate but no one on staff has formal ITIL training. That is acceptable. The standard does not require ITIL, and ITIL does not require the standard.

Checklist: are you ready to pursue ISO 20000-1?

Go through these points before you start. Every unchecked item is something to settle first.

• You can name the IT services you provide and who receives them.
• There is a service catalogue or at least a written list of services.
• Service levels or response times are agreed with customers, in a contract or an offer.
• Incidents and service requests are recorded in a ticket tool or comparable system.
• Changes to customer systems follow a defined approval step.
• Someone in management is responsible for the service management system.
• You review incidents or customer feedback at least once a year and write down what you change.
• You know which of your suppliers affect the services you deliver.
• You have a plan for service continuity, even a short one.
• You know which customer or tender is asking for the certificate.

If you can tick most of these, the work is mainly one of documentation. If you tick only a few, the gaps are real and the self-assessment will show you where they are.

Do you need an on-site audit?

The classic route to an ISO 20000-1 certificate is an on-site audit by a certification body. It takes time to schedule, it involves auditors visiting your premises, and the cost reflects that. Some customers specifically require this route, and if yours does, you should follow it.

Other customers only want a verifiable certificate that shows a management system is in place. For those cases there is a different approach, described in the article on ISO certification without an audit. It is based on an online self-assessment instead of a visit.

How Zertify fits in

Zertify issues an ISO 20000-1 certificate based on an online self-assessment. There is no on-site audit. You answer questions about your IT service management system, a member of the SICE Certification Board reviews the assessment, and the certificate is issued by G6 Agency AG under licence from SICE.

On the ISO 20000-1 page you can see what the assessment covers. The questions follow the clauses of the standard, so the structure above is what you will work through. If the assessment is passed and payment is made, the certificate is issued within 4 hours. It is a PDF with a QR code that leads to a public verification page, so a purchasing department can check it without contacting you.

The certificate is valid for three years and is confirmed each year with a short online re-audit, which is part of a yearly subscription. The pricing page sets out the details.

When you are ready, you can start the assessment. It makes sense to have your service list, your ticket tool and your contract templates open next to you while you answer.

Practical advice

Do not choose based on the acronym. Read what your customer wrote, then decide whether you need a document about your organisation, a qualification for your staff, or both.

If your team has never worked with ITIL, you do not need to start there to become certified. If your team knows ITIL well, you probably already do more of what ISO 20000-1 asks than you think. The difference is that the standard asks you to prove it.