New IT Service Management Risk Entry
SLA Management — ISO/IEC 20000-1:2018 Clause 8.3.3
Clause 8.3.3 requires the organisation to define, agree, document and manage Service Level Agreements (SLAs) with customers. SLAs must be reviewed regularly and performance reported to appropriate parties. SLA risks must be identified and treated proactively.
SLA Content Requirements
ISO/IEC 20000-1 requires SLAs to cover: service description and scope, hours of service, availability targets, incident response and resolution times, service request fulfilment times, planned maintenance windows, reporting frequency and format, escalation procedures, and review schedule.
SLA Risk Indicators
Monitor these as early warning signals: availability trending below target, incident resolution times approaching SLA threshold, recurring incidents without permanent fix, capacity approaching limits, supplier performance degrading, change failure rate increasing, MTTR increasing over time.
Underpinning Contracts (UCs)
SLAs with customers must be underpinned by supplier contracts or Operational Level Agreements (OLAs) with internal teams. If a supplier cannot meet their contractual obligations, the service provider's SLA commitments are at risk. Map all SLA commitments to their underpinning agreements.
SLA Review Process
Review SLAs at least annually or when: service requirements change, repeated SLA breaches occur, new technology or suppliers are introduced, major incidents occur, customer feedback indicates dissatisfaction, or business priorities shift. Document outcomes and update agreements.
Availability % (target e.g. 99.9%) MTTR (Mean Time to Restore) P1 Response: <15min P1 Resolution: <4hrs P2 Response: <30min Change Success Rate >95% CSAT >85% First-Call Resolution >70%
Supplier Management — ISO/IEC 20000-1:2018 Clause 8.3.4
Clause 8.3.4 requires the organisation to manage its suppliers to ensure they meet their commitments and contribute to the delivery of services meeting customer requirements. Supplier risks must be actively managed.
Supplier Risk Assessment
Assess each supplier for: financial stability, single-supplier dependency, geographic concentration, SLA performance history, security posture, contract terms and exit rights, regulatory compliance, capacity to scale.
Underpinning Contracts
All supplier contracts must contain: clear SLA obligations aligned to customer SLAs, audit rights, security requirements, change notification obligations, exit and transition assistance provisions, data protection requirements.
Performance Monitoring
Regular supplier performance reviews: monthly for critical suppliers, quarterly for standard suppliers. Track: SLA metrics, incident trends, change success rates, security incidents, contract compliance, innovation and roadmap alignment.
Exit Management
Plan for supplier exit before it becomes necessary. Ensure: data portability, knowledge transfer, exit timeframes are contractually defined, transition assistance obligations, alternative supplier options identified (avoid vendor lock-in).
ISO/IEC 20000-1:2018 — Key Risk-Related Clauses
6.1 – Risks & Opportunities
Determine risks that could affect the SMS's ability to achieve its objectives. Plan actions proportionate to the potential impact on service quality, availability and customer satisfaction.
8.2 – Service Portfolio
Manage the service portfolio: catalogue of services in scope, relationships between services, dependencies and impacts. Risks to services in design, transition and live phases must be assessed.
8.4 – Capacity & Demand
Manage capacity to meet current and future demand. Monitor capacity metrics, forecast demand, plan infrastructure investments and identify risks from undercapacity or demand spikes before they cause service degradation.
8.7 – Service Assurance
Availability management (targets, monitoring, improvement), service continuity management (ITSCM plans, testing), information security management (integrated with ISO 27001), and configuration management (CMDB accuracy).
8.5 – Change Management
All changes must be assessed for risk before approval. Emergency change procedures must be documented. Change failure rate, rollback procedures, and post-implementation review are key risk controls.
8.6 – Incident & Problem
Incident management must restore service within SLA timeframes. Problem management addresses root causes to prevent recurrence. Known errors must be documented. Recurring incidents indicate problem management risk.
1–4: Low — routine monitoring 5–9: Medium — action plan needed 10–16: High — urgent action / P2 17–25: Critical — P1 escalation