ISO 20000's Improvement Requirement
Clause 10.2 of ISO 20000 requires more than reactive corrective action—it requires proactive, systematic identification and implementation of improvement opportunities. The SMS should demonstrably improve over time. Organizations that only fix problems when auditors find them are not in compliance. Organizations where improvement is embedded in daily practice—continuously reviewing performance data and identifying better ways to work—are the organizations that maintain certification and deliver genuine value.
Sources of Improvement Opportunities
Improvement opportunities come from multiple sources: internal audit findings (nonconformities require corrective action; observations suggest improvement opportunities); management review outputs (decisions and action items); customer satisfaction survey results and complaints; incident and problem trend analysis (three months of increasing P1 incidents suggests an improvement area); SLA performance data (sustained underperformance on a specific SLO identifies an improvement target); staff suggestions from daily operational experience; external benchmarks and industry developments; and regulatory changes requiring SMS adaptation.
The Improvement Register
The improvement register is the central repository for all improvement opportunities. It is a simple document—spreadsheet or dedicated tracking tool—with columns for: improvement ID, source (where it came from—audit finding, customer complaint, trend analysis, etc.), description, priority, owner, target completion date, implementation status (planned, in progress, completed, cancelled), measured outcome (what metric changed after implementation?), and closure date. The register is a required documented information artifact under ISO 20000.
Improvement Prioritization
Not all improvements are equal. Prioritization framework: customer impact (will this improve the customer experience? serious if not), risk reduction (will this reduce the likelihood or severity of incidents or audit nonconformities?), efficiency gain (will this reduce cost or effort?), and compliance improvement (will this close a gap against standard or regulatory requirements?). A simple approach: rate each dimension 1–3 (low/medium/high), sum the scores, rank by total. This ensures improvements addressing customer needs and regulatory gaps get priority over nice-to-haves.
The Improvement Lifecycle
An improvement passes through stages: identified from a source → registered in the improvement register → prioritized against other opportunities → assigned to an owner → planned (with resources and timeline) → implemented (the actual change or activity) → measured (was the intended effect achieved?) → closed or iterated (if the metric did not improve, investigate why and try a different approach). The lifecycle is tracked in the register; anyone can see the current status and reason for each improvement.
Connecting Improvement to Performance Data
Improvements must be traceable to a specific performance problem. An improvement to incident resolution time must be measured against resolution time data before and after the improvement. An improvement to change success rate must show that change-related incident rate decreased post-improvement. This before/after evidence is what demonstrates that continual improvement is achieving real outcomes, not just keeping busy. Improvements without measured outcomes are indistinguishable from activity; measured outcomes are the proof.
| KEY CONCEPT | Continual improvement requires measurement. Every improvement action must have a defined success metric established before implementation, not after. The metric should connect to a performance problem; improvement without measurement is wishful thinking. |
The Improvement Register at Management Review
The improvement register should be a standing agenda item at every management review. Management reviews the current state: what is overdue? what has been closed? what new items have been added since the last review? Management makes decisions about prioritization and resource allocation; these decisions are documented in the management review output. If an overdue improvement lacks progress, management escalates to the owner or reassigns. The management review ensures that continual improvement is not forgotten in the routine operational work.
Continual Improvement Culture vs Compliance Checkbox
The difference is observable in the dates of improvement register entries. An organization in compliance checkbox mode shows all improvement entries dated within a week before the scheduled audit. An organization with genuine improvement culture shows a steady stream of entries throughout the year. Auditors detect this pattern through the register dates, the quality of outcome measurements, and by asking staff: "Tell me about a recent improvement." If staff cannot name a recent improvement or describe its impact, improvement is a paper exercise. If staff can speak credibly about improvements and their effects, the SMS is genuinely learning.
Improvement Across the SMS
Improvements are not limited to service delivery (reducing incident resolution time). Equally valid improvements include: governance improvements (better management review structure, more effective CAB meetings), documentation improvements (cleaner document control, more usable procedures), supplier management improvements (better supplier performance tracking), and audit program effectiveness (more focused audits). This breadth signals a mature, self-improving SMS.
| IMPORTANT | Auditors distinguish between corrective action (responding to a nonconformity) and continual improvement (proactively making things better). Both are required. An SMS that only does corrective action is reacting, not improving. |
| BITLION INSIGHT | Bitlion GRC improvement register with automatic feed from internal audit findings, customer satisfaction data, and SLA performance metrics. Templates guide improvement planning and measurement; dashboard shows improvement velocity (number and pace of closures). |