Description

A focused course, tailored for you

The ITSM Platform Governance Audit Playbook

Configure the platform controls that produce clean audit evidence on day one of the engagement, not the day before.

Your customer has an enterprise ITSM platform configured and running. Change records exist, CIs are populated, access reviews happen. But when the auditor asks for the evidence package, the gaps appear: approver fields empty, CI relationships stale, access recertification incomplete. The platform works operationally. It does not yet work as an audit artefact.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

ITSM governance professionals sit at the intersection of IT operations and external compliance requirements. The operational side runs fine. The audit-readiness side consistently shows the same pattern: the CMDB has usable data but not auditor-readable data, the change records document approvals but not in the field structure auditors query, the access reviews happen but do not produce the recertification evidence format that SOC 2 and ISO 27001 auditors accept. Three things need to be right at the same time: the configuration that captures the right fields, the governance process that keeps those fields populated, and the evidence export format that maps cleanly to the audit framework's specific control requirements. Getting all three aligned is the skill this course teaches.

What you walk away with

Identify the specific CMDB fields and relationship types that auditors query in SOC 2, ISO 27001, and ISO 20000 engagements.
Configure change management workflows so that every approval step produces a timestamped, auditor-readable record.
Build an access review and recertification process that produces evidence in the format external auditors accept.
Assemble a pre-audit evidence package from platform exports, mapped to the specific control requirements of the engagement.
Design a year-round governance operating model that keeps the platform audit-ready between audits, not just during them.

The 12 modules

Module 1. What Auditors Actually Extract from ITSM Platforms

Covers the specific data requests that arrive from SOC 2, ISO 27001, ISO 20000, and ITGC auditors. The field-level evidence they pull, the approval chain documentation they expect, and the reports they run on the instance. Distinguishes between what a control policy says and what the auditor's evidence request list specifies. Introduces the concept of audit evidence architecture as a design input for platform configuration.

Module 2. CMDB Data Quality Standards for Audit Integrity

Covers CI classification standards, relationship mapping requirements, and the ownership and accountability fields that auditors require to be populated. The difference between a CMDB that supports IT operations and one that holds up to audit scrutiny. How to build a data quality scorecard that the governance team can run monthly and that produces a defensible readiness indicator before the audit engagement begins.

Module 3. Change Management Controls That Produce Traceable Evidence

Covers the change record fields that must be populated for SOC 2 CC7, ISO 27001 A.12.1.2, and ITGC change management controls. CAB approval documentation requirements, emergency change procedures and their elevated documentation burden, and the workflow configuration that ensures every approval is timestamped and tied to the requester identity. Includes the common gap where approvals happen out-of-band and the change record shows no approval trail.

Module 4. Access Governance and User Lifecycle Evidence

Covers role-based access documentation requirements, joiner-mover-leaver process evidence, and privileged access management records that auditors review. How to extract access review reports that satisfy SOC 2 CC6.1 through CC6.3 and ISO 27001 A.9 access control requirements. Designing recertification schedules and producing completion evidence in the format auditors accept without triggering follow-up requests.

Module 5. Incident and Problem Management Audit Trail Requirements

Covers what auditors check in incident and problem records: categorisation accuracy, escalation documentation, resolution timestamps, and root cause linkage. How to configure incident workflows so that regulatory notification requirements leave a traceable record. Linking incident data to problem records to produce evidence of continuous improvement for availability and resilience control requirements across SOC 2 and ISO 27001.

Module 6. Integrating GRC and ITSM Workflows Without Audit Divergence

Covers the configuration patterns that keep GRC policy management and ITSM process records aligned. The audit failure mode where the GRC module shows a control in place but the ITSM change records do not reflect the procedure. How to map GRC risk registers to ITSM change categories and incident classifications so that evidence in both systems tells a consistent story to an auditor who pulls from both.

Module 7. Building the Pre-Audit Evidence Package

Covers how to construct a standard evidence response to common audit requests before the engagement begins. Which platform reports to pre-schedule, which exports to format, which dashboards to screenshot and timestamp. Creating a 90-day evidence preparation calendar that the governance team can run without scrambling. The specific SOC 2, ISO 27001, and ISO 20000 evidence request formats this package must satisfy.

Module 8. Continuous Compliance Monitoring as an Operating Discipline

Covers the shift from point-in-time audit preparation to year-round compliance monitoring. Which operational metrics serve as leading indicators of audit readiness: CMDB integrity scores, change success rates, access review completion percentages, and SLA compliance on critical services. How to configure dashboards that expose governance gaps early enough to remediate before audit pressure arrives.

Module 9. Regulatory Overlay Mapping for IT Platform Controls

Covers mapping SOC 2 Trust Services Criteria, ISO 27001 Annex A, ISO 20000 service management requirements, and ITGC control frameworks to specific ITSM platform configuration controls. The matrix format auditors find readable and maintainable. How to keep the overlay current as frameworks update their control sets and as the platform configuration changes. The governance team's role in owning this mapping.

Module 10. Handling Audit Findings and Producing Remediation Evidence

Covers how to respond to audit observations with remediation plans that auditors accept. The difference between telling the auditor something was fixed and showing a timestamped audit trail proving it. How to document evidence of closure that satisfies follow-up engagements. Identifying the systemic governance gaps behind repeat findings and the configuration or process changes that break the recurrence pattern.

Module 11. Platform Governance Policy Writing for External Audiences

Covers writing IT governance policies that reference platform controls with enough specificity to satisfy auditor review. The structure auditors expect: purpose, scope, ownership, control description, implementation evidence, and review schedule. The common gap between what the policy document claims and what the platform actually enforces. Templates for change management policy, access management policy, and CMDB governance policy.

Module 12. Year-Round Platform Governance Operating Model

Covers the team structure, governance cadence, and role definitions that keep an ITSM platform audit-ready between formal engagements. Monthly CMDB integrity reviews, quarterly access recertification, semi-annual change process assessments, and annual policy refresh cycles. How to delegate governance activities to process owners while maintaining central oversight and a single source of audit evidence.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Customer audit engagement is 60 days out and the CMDB has not been reviewed for data quality in two quarters.

Change management records are complete operationally but the approver field is consistently blank, triggering audit observations.

Access recertification happened but the completion evidence is in email threads, not platform records, and the auditor wants system-generated proof.

The GRC module has a clean risk register but the ITSM change records do not reference the relevant risk owners, creating a cross-system audit gap.

What you get with this course

12 written modules covering audit evidence architecture, CMDB governance, change and access controls, GRC integration, and operating model.
Downloadable templates: CMDB data quality scorecard, pre-audit evidence preparation calendar, regulatory overlay mapping matrix, governance policy templates for change management, access management, and CMDB.
Worked examples drawn from SOC 2, ISO 27001, ISO 20000, and ITGC audit engagements, showing the specific field-level evidence each framework requires.
The hand-built implementation playbook delivered alongside course access, scoped to your platform governance situation.

What you will have in hand by Day 1, Week 1, Month 1

Course access provisioned within 24 hours of purchase.

Hand-built implementation playbook delivered alongside course access.

Before and after

Before

Audit season triggers a scramble to locate evidence. CMDB exports are missing fields. Change records show no approver. Access reviews happened but left no system-generated proof. The audit observation list grows from gaps that were visible months earlier.

After

The governance team runs a pre-audit evidence package 90 days before the engagement. CMDB integrity is monitored monthly. Change records are configured to capture approver identity at the workflow level. Access recertification produces platform reports, not email threads. First-observation counts drop across consecutive audit cycles.

What happens if you do not address this

ITSM governance gaps that produce audit findings are rarely one-time events. The same three gaps, CMDB data quality, change approval trails, and access review documentation, appear in follow-up engagements unless the platform configuration and the governance process are both addressed. Each audit cycle that ends with repeat observations raises the compliance risk rating and the platform team's accountability for systemic underperformance.

Who it is for

Platform support and governance professionals responsible for ITSM implementation quality and compliance readiness. Technical enough to configure platform workflows and reports, accountable enough to answer for audit findings. Working with enterprise customers or internal IT organisations that face external audits against SOC 2, ISO 27001, ISO 20000, or IT General Controls frameworks.

Who this is NOT for. IT professionals with no audit-facing responsibility. Auditors themselves. Anyone whose platform is primarily operational with no external compliance requirement.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Approximately 6 to 8 hours to complete all 12 modules. Templates and the implementation playbook are ready to apply to active governance work immediately.

Why $199 is the right number

Generic ITIL or ITSM certification courses cover process theory without audit-evidence specifics. External consulting engagements address gaps reactively after audit findings arrive. This course teaches the configuration and process skills that prevent findings from recurring.

FAQ

Does this cover specific ITSM platforms or is it platform-agnostic?

The control configuration principles apply across enterprise ITSM platforms. The worked examples and templates reference field structures common to major platforms, with notes on how to adapt them to specific implementations.

Which audit frameworks are covered?

SOC 2 Trust Services Criteria, ISO 27001 Annex A, ISO 20000-1 service management requirements, and IT General Controls frameworks. The regulatory overlay mapping module covers all four and produces a single maintainable matrix.

Is this relevant for customer-facing platform support roles as well as internal governance teams?

Yes. The course is written for professionals accountable for ITSM platform audit readiness, whether that means advising enterprise customers through audit engagements or managing an internal platform governance function.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.