Systems Development, Acquisition, and Project Management
Domain 4 covers Systems Development, Acquisition, and Project Management. The exam tests whether you can follow a system from requirements to retirement, keep development controls segregated, and interpret project performance metrics.
Life cycle and controls
A traditional SDLC runs requirements, design, build, test, implement, and maintain, with approvals at each gate. Agile delivers in iterations with continuous feedback, but it does not remove controls: product backlog, definition of done, peer review, automated testing, and change traceability still apply. DevOps joins development and operations, so segregation must be enforced through pipelines and role-based access. Developers should not have production access; changes need approval, testing, and a separate migration step.
Testing and conversion
Unit tests check components; integration tests check interfaces; system tests check the whole system; user acceptance testing confirms fitness for business use; regression testing confirms changes broke nothing. Conversion approaches: big bang (fast, risky), parallel (safe, costly because both run), phased (by module or location), and pilot (one site first).
Worked example
A project reports planned value (PV) of $200,000, earned value (EV) of $160,000, and actual cost (AC) of $180,000.
Reasoning: CPI = EV / AC = 160 / 180 = 0.89, so the project is over budget: each dollar spent returns about $0.89 of earned value. SPI = EV / PV = 160 / 200 = 0.80, so it is behind schedule. Cost variance is EV − AC = −$20,000 and schedule variance is EV − PV = −$40,000. The project manager should address scope, resourcing, and estimates rather than only reporting the variance.
Acquisition
Build versus buy turns on fit, cost, and control. An RFP should state requirements, evaluation criteria, and contract terms. For SaaS, review SOC 2 reports, data ownership, breach notification, uptime SLAs, and exit provisions. The critical path is the longest path through the network and has zero float.
Traps
- Confusing UAT with system testing.
- Believing agile means no documentation or approvals.
- Letting developers migrate their own code to production.
- Inverting CPI and SPI.
- Assuming parallel conversion is cheap; it duplicates processing.
- Assuming the critical path is the shortest path.