Information Systems Acquisition, Development and Implementation
Life cycle and audit points
Typical SDLC phases: feasibility/business case, requirements definition, design, development or configuration, testing, implementation and post-implementation review. Auditor focus: an approved business case with measurable benefits, meaningful user involvement, documented requirements sign-off, segregation between developers and the production environment, and test data that is synthetic or masked rather than live production data.
Methods
Waterfall suits stable requirements and heavy documentation; agile/iterative delivers in increments with continuous user feedback but lighter documentation - the auditor confirms that product-level controls (version control, review, testing) still exist. Also recognize prototyping, RAD, and commercial off-the-shelf versus custom build. Control objectives apply regardless of methodology.
Testing
Unit (developer), integration, system, user acceptance (business users), regression, and parallel/pilot/phased implementation. UAT is the key acceptance gate and auditors examine its evidence. Data conversion demands record counts, control totals, reconciliation and a rollback plan.
Project and change control
Project governance: sponsor, charter, WBS, baselines, milestones, risk register. Red flags include scope creep, missing baselines and no user sign-off. Change management flow: request → impact assessment → authorization → testing → approval by someone independent of the developer → implementation with back-out plan → post-implementation review. Emergency changes are reviewed retrospectively.
Post-implementation
The PIR compares actual costs and benefits against the business case once the system has stabilized; it is the evidence of benefits realization.
Traps
The developer approving their own change; IT performing UAT; and the auditor participating in system design - all wrong.
Rule of thumb
Whoever builds it should not be the only one testing it, and should never promote it to production.