Instiq
Chapter 5 · Security operations & supplier management·v1.0.0·Updated 7/11/2026·~15 min

What's changed: Initial version

5.4Service audit, corrective action & continual improvement

Key points

Covers the mechanisms that keep service management running and improving-the internal audit that detects nonconformities, the corrective action for findings (a permanent fix to the root cause, not a stopgap), CSI (continual service improvement), the PDCA cycle, and the KPIs/metrics that steer improvement by the numbers-framed as the judgment of a service manager improving the service based on measurements.

Service management is not finished once the mechanisms are built; it is the activity of periodically inspecting itself, fixing found problems at the root, and continually improving based on measurements. You surface nonconformities with internal audit, eliminate root causes as corrective action rather than a mere stopgap, and keep improvement cycling with the PDCA (plan-do-check-act) cycle and the CSI (continual service improvement) framework. In doing so, the point is not to drive improvement by assumption or by whoever is loudest, but to measure the current state and verify effect with objective numbers-KPIs/metrics. This section covers these "run-and-improve" mechanisms from the viewpoint of a service manager judging by the measurements.

5.4.1Internal audit and corrective action

  • An internal audit periodically checks, from an independent standpoint, whether your organization's service management conforms to the procedures and requirements it has set (e.g., JIS Q 20000-1). It detects nonconformities (gaps between rule and reality) and creates a starting point for improvement. An audit is conducted not to "hunt for faults and punish" but to find opportunities for improvement.
  • Corrective action is a measure that, for a detected nonconformity, identifies and removes the root cause to prevent recurrence. It is distinguished from a stopgap (correction) that temporarily suppresses the immediate symptom; corrective action traces back to the true cause and eliminates it permanently. This thinking is the same as problem management (root-cause analysis, permanent fix), aiming for "a state where the same finding never appears again."

5.4.2CSI, PDCA, and KPIs/metrics

  • PDCA (Plan-Do-Check-Act) is the basic cycle of continual improvement: plan, do, check the results, act as needed, and cycle into the next plan. CSI (continual service improvement) is the framework that continually turns this cycle over service management as a whole, incrementally raising the quality of services and processes (ITIL's continual improvement, the 7-step improvement, etc.). Its essence is not a one-off improvement but continually cycling.
  • KPIs/metrics are numeric indicators that objectively steer improvement. Examples: mean time to resolve incidents (MTTR), SLA achievement rate, first-response time, change success rate, count of recurring incidents. Because you cannot manage or improve what you cannot measure, first grasp the current state numerically (a baseline) and verify effect by comparing before and after an improvement. But metrics are a means to achieve an end; choose meaningful indicators tied to customer value and SLA targets so as not to fall into number-chasing (measuring for measurement's sake).
Exam point

Most-tested: "internal audit checks conformity from an independent standpoint and finds improvement opportunities", "corrective action is distinguished from a stopgap (correction) and eliminates the root cause to prevent recurrence", "PDCA/CSI incrementally raises quality by cycling continually, not once", and "KPIs/metrics-you cannot improve what you cannot measure, but choose indicators tied to customer value/SLA rather than falling into number-chasing." The point is that corrective action shares problem management's thinking of a permanent fix to the root cause.

Suppose an internal audit at a service operations organization flags a nonconformity: "many changes were found whose change-management records contain no rollback plan." In the post-audit review, one operator argues, "I was just too busy and forgot to write it, so if I retroactively add rollback plans to the ones found this time, the response is complete, isn't it?" But the service manager judges that this is merely a stopgap (correction) that patches the records in front of them, and does not amount to corrective action. To prevent the same finding from recurring at the next audit, one must pin down the root cause of why rollback-plan entries are being missed. On analysis, the true cause turns out to be that the change-request form did not make the rollback-plan field mandatory, so a request could pass without it. So the service manager remediates operations to make the rollback plan a required entry on the form, and to prevent a change without it from proceeding to CAB approval. This is corrective action that severs the root cause. Furthermore, to cycle this improvement with PDCA, they set a KPI of "rollback-plan documentation rate," measuring the pre-remediation baseline (e.g., 60%) and the post-remediation trend to objectively verify whether the measure is actually working. What matters here is not to close the audit finding with a "stopgap correction," but to make it a permanent fix to the root cause (corrective action), measure the effect with metrics, and keep cycling it as PDCA/CSI. The service manager's judgment in audit, corrective action, and improvement is to capture the current state and the effect with numbers (KPIs) and improve continually, rather than by loudness or assumption.

DistinctionStopgap (correction)Corrective action
TargetThe immediate symptom / the individual nonconformity itselfThe root cause that produced the nonconformity
AimPatch the current state for nowPrevent recurrence so the same finding never appears again
Remaining riskThe cause remains and the same finding recurs at the next auditEffect is verified by KPIs and kept cycling via PDCA/CSI
Warning

Trap: "A nonconformity found in an audit is fully addressed once you apply a stopgap such as adding the record on the spot" is wrong-that is merely a correction, and without corrective action that eliminates the root cause, the same finding recurs at the next audit (the same thinking as problem management). Also wrong: "improvement can be driven by frontline enthusiasm or loudness, and numbers are unnecessary"-because you cannot improve what you cannot measure, the correct approach is to objectively measure the baseline and effect with KPIs/metrics and keep cycling as PDCA/CSI. But choose indicators tied to customer value/SLA rather than falling into number-chasing.

From audit to CSI.
Keep improving via the loop

5.4.3Section summary

  • An internal audit checks conformity from an independent standpoint to surface nonconformities (improvement opportunities), and corrective action, distinguished from a stopgap (correction), eliminates the root cause to prevent recurrence
  • PDCA and CSI (continual service improvement) cycle continually, not once, incrementally raising the quality of services and processes
  • Steer improvement not by assumption but by objectively measuring the baseline and effect with KPIs/metrics; but choose indicators tied to customer value/SLA targets rather than falling into number-chasing

Sign in to track progress — Log in.

Quick check

(just a quick review)

Q1. An internal audit flagged that "many changes have no rollback plan recorded in the change records." An operator argues that "the response is complete once I retroactively add rollback plans to the ones found." Which corrective response by the service manager is most appropriate?

Q2. In advancing service improvement (CSI), which is the most appropriate way to judge the effect of a measure?

Q3. Which explanation of the role of internal audit and the difference between a stopgap (correction) and corrective action is most appropriate?

Check your understandingPractice questions for Chapter 5: Security operations & supplier management

Keep track of your progress

The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.