QULDEXResources · Glossary
What is an SLA? Service level agreements in audit work
What does an SLA mean in audit work?
The term comes from service contracts, where a supplier commits to a level of service. Inside an organisation the same idea sets expectations between teams.
For audits, the useful SLAs are about time: how long an owner has to respond to a finding of a given severity, and how long a reviewer has to accept or return evidence.
What does a usable SLA define?
The event being timed and the limit, such as a response within two working days.
When the clock starts and stops, and what counts as meeting the target.
Who is told and what happens when the target is missed.
What do audit SLAs look like?
Example targets an organisation might set. The numbers are illustrative; choose your own.
| Event | Example target |
|---|---|
| Owner responds to a critical finding | 2 working days |
| Evidence supplied after a request | 5 working days |
| Reviewer accepts or returns evidence | 3 working days |
| Critical corrective action completed | 30 days, with escalation at day 20 |
This is an illustration written for this page, not a customer record.
Where do frameworks refer to service levels?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 20000-1 | Clause 8.3.3 | Service level management: agreed service levels, monitoring and review against targets. |
| ISO 27001 | Annex A 5.22 | Supplier services are monitored, reviewed and evaluated, including against agreed levels. |
| SOC 2 | Availability criteria | Commitments made to customers about availability are met and monitored. |
| ISO 27001 | Clause 9.1 | The organisation decides what is monitored and measured, and when. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What goes wrong with SLAs?
Targets nobody measures
The policy says five days, but nothing records the start time.
Instead: time it from the system, automatically.
One target for everything
A low-risk observation has the same deadline as a critical finding.
Instead: set targets by severity.
No consequence
Missed targets are noted and nothing follows.
Instead: tie each SLA to an escalation path.
How does QULDEX handle this?
Every audit, finding and deadline in one view, with overdue items surfaced first.
SLA: common questions
What does SLA stand for?
Service level agreement.
What is the difference between an SLA and a KPI?
An SLA is a commitment to a target. A KPI is a measure of performance. Whether an SLA was met is often reported as a KPI.
Are internal SLAs binding?
They are not contracts, but they can be set in policy and reported to management, which gives them weight.
Sources
- ISO/IEC 20000-1:2018, Service management system requirements
- ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO/IEC 27002:2022, Information security controls
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Deadlines that are timed and escalated automatically
Controls, evidence, findings and corrective actions in one audit workspace.