System Development and Change Management
System development and change management controls are critical topics on the ISC section of the CPA exam. CPAs must understand how organizations develop, implement, and modify information systems while maintaining appropriate controls and minimizing risk.
System Development Life Cycle (SDLC)
The SDLC is a structured approach to developing information systems. The traditional waterfall model includes these sequential phases:
| Phase | Activities | Key Deliverables |
|---|---|---|
| Planning | Define project scope, objectives, feasibility study, resource allocation | Project charter, feasibility report, project plan |
| Analysis | Gather and document business requirements, analyze current systems | Requirements specification, use cases, process models |
| Design | Create system architecture, database design, interface design, security design | System design document, data models, interface prototypes |
| Development | Write code, build database, develop interfaces, create documentation | Working software, technical documentation, user manuals |
| Testing | Unit testing, integration testing, system testing, user acceptance testing (UAT) | Test plans, test results, bug reports, sign-off |
| Implementation | Deploy system, migrate data, train users, go-live | Deployed system, training materials, support procedures |
| Maintenance | Ongoing support, bug fixes, enhancements, performance monitoring | Change requests, patch releases, performance reports |
Agile Development Methodology
Agile is an iterative approach that delivers working software in short cycles (sprints):
- Scrum: Framework with defined roles (product owner, scrum master, development team), events (sprint planning, daily standup, sprint review, retrospective), and artifacts (product backlog, sprint backlog, increment)
- Sprints: Time-boxed iterations (typically 2 to 4 weeks) that produce a potentially shippable product increment
- User stories: Requirements expressed from the user's perspective ("As a [user], I want [functionality] so that [benefit]")
- Continuous integration/continuous deployment (CI/CD): Automated build, test, and deployment pipelines that enable frequent, reliable releases
For CPA exam purposes, understand that agile still requires appropriate controls: code reviews, automated testing, access restrictions, and documentation of changes.
Change Management Controls
Change management ensures that modifications to production systems are properly controlled:
- Change request: Formal documentation of the proposed change, including business justification, scope, risk assessment, and rollback plan
- Impact analysis: Evaluate potential effects on existing systems, data, users, and business processes
- Authorization: Appropriate management approval before changes are developed or implemented
- Development and testing: Changes built in a development environment, tested in a separate testing/QA environment, never directly in production
- Deployment approval: Final review and sign-off before promoting changes to production
- Post-implementation review: Verify the change works as intended and no unintended side effects occurred
Environment Segregation
A critical IT control is maintaining separate environments:
- Development environment: Where code is written and initially tested by developers
- Testing/QA environment: Where changes undergo formal testing, including integration and UAT
- Production environment: The live system used by the business. Developers should not have direct write access to production.
Segregation prevents untested or unauthorized changes from affecting live operations and financial data.
Implementation Strategies
| Strategy | Description | Risk Level | Cost |
|---|---|---|---|
| Parallel | Old and new systems run simultaneously until new system is verified | Lowest | Highest (double operations) |
| Phased (modular) | New system implemented in stages or modules | Moderate | Moderate |
| Pilot | New system tested in one location or department before full rollout | Moderate | Moderate |
| Direct cutover (big bang) | Old system replaced entirely at once | Highest | Lowest |
Data Conversion and Migration
Moving data from legacy systems to new systems requires careful planning:
- Data mapping between old and new system structures
- Data cleansing to correct errors before migration
- Validation and reconciliation to ensure completeness and accuracy after migration
- Rollback procedures in case migration fails or data integrity issues are discovered
Strengthen your SDLC knowledge with ISC flashcards and timed mini exams. Sign up free for complete CPA exam prep.