ISO 20000-1 for financial services

A bank outsources payment processing. An insurer buys a policy administration platform. A wealth manager runs its portfolio system in a hosted environment. Each of them hands part of its operations to an IT provider, and the purchasing department wants evidence that the provider handles incidents, changes and availability in a defined way. The supplier questionnaire asks for it, and one certificate answers many of its questions.

If you are the provider, the request reaches you in tenders and customer audits. If you run an internal IT department, it comes from group management or from the business units that depend on you. ISO 20000-1 is certifiable, unlike ITIL, so you can attach it to a quote and name the number.

• ISO 20000-1 at a glance

The standard describes a service management system for IT services. It does not prescribe tools. It requires that the processes behind your services exist, are followed and are reviewed. The table links typical risks in financial IT to the requirement that covers them.

• ISO 27001 for information security

Auditors and purchasing departments use the same vocabulary. These are the terms you will meet in the assessment, each with an example from a financial company.

Service catalogue

The list of services you offer, for example payment file processing, client reporting portal or trade confirmation interface, each with a description and a service owner.

Service level agreement (SLA)

The agreed target for a service, such as availability of the portal between 07:00 and 19:00 on working days or a response time for priority 1 faults.

Incident

An unplanned interruption or loss of quality, for example clients cannot log in to the mobile banking app.

Problem

The underlying cause of one or more incidents, for example an expired certificate on an interface that caused three login failures in a month.

Change

Any addition, modification or removal that can affect a service, such as a new version of the settlement software.

Release

A bundle of approved changes put into the live environment together, with a test result and a rollback plan.

Most companies already do parts of this. The work lies in making it consistent and in writing it down. A practical order looks like this.

1. 01

   List the services your clients actually use

   Start from the client's view, not from the server list. A managed provider for private banks might name four services: workplace, core application hosting, reporting and backup.

2. 02

   Write one SLA per service

   Agree support hours, response times and availability with the client and keep the signed version. Clause 8 on operation expects the service to be delivered against these targets.

3. 03

   Route every disruption through one ticket queue

   Phone calls and emails from the trading desk end up as tickets with a priority. Recurring tickets become problems with an owner.

4. 04

   Put all changes through one calendar

   Changes are approved, scheduled around settlement windows and tested. Emergency changes get a short, documented approval path.

5. 05

   Review the figures every month

   Compare availability and ticket times with the SLAs, record the actions and follow them up. This is what clauses 9 and 10, performance evaluation and improvement, ask for.

You take an online self-assessment with 36 yes/no questions for ISO 20000-1. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Among the other 23 questions you need at least 16 yes answers. There is no on-site audit.

SICE reviews every assessment. After you pass and pay, the certificate is issued by G6 Agency AG under licence from SICE, within 4 hours. It is valid for 3 years and is confirmed every year by a short online re-audit. Your client can check it on the public verification page by certificate number or by the QR code on the PDF.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The yearly subscription can be cancelled at any time in your customer account, to the end of the current year. You do not need an account to buy.

• Start the free self-assessment
• See prices and multi-standard discounts
• Standard page ISO 20000-1

Ask the requester which evidence it needs. A supplier questionnaire often asks for a valid certificate and a way to verify it. Some clients prescribe the classic route with an on-site audit by a certification body. If that applies to your tender, you want to know before you decide.

The guides below compare the routes and explain what each costs and how long it takes.

• Compare the certification routes
• Certification without an on-site audit
• What certification costs