System Development and Change Management
The ISC section of the CPA exam tests your understanding of how information systems are developed, implemented, and maintained. System development life cycle (SDLC) concepts and change management controls are fundamental to IT governance and directly affect the reliability of financial reporting systems.
System Development Life Cycle (SDLC)
The SDLC provides a structured approach to building information systems. The traditional waterfall model includes these sequential phases:
- Planning: Define the project scope, objectives, feasibility, and resource requirements. Conduct cost-benefit analysis.
- Analysis: Gather and document detailed requirements. Understand current processes and define what the new system must do.
- Design: Create the system architecture, database design, user interface design, and security specifications.
- Development: Write code, build components, and create the system according to design specifications.
- Testing: Verify the system works correctly through unit testing, integration testing, system testing, and user acceptance testing (UAT).
- Implementation: Deploy the system to production. Strategies include parallel operation, direct cutover, pilot implementation, and phased implementation.
- Maintenance: Ongoing support, bug fixes, enhancements, and monitoring after deployment.
Agile vs. Waterfall
| Aspect | Waterfall | Agile |
|---|---|---|
| Approach | Sequential, linear phases | Iterative sprints (2-4 weeks) |
| Requirements | Defined upfront, changes costly | Evolving, embraces change |
| Delivery | Full system at end of project | Working increments each sprint |
| Documentation | Extensive formal documentation | Working software over documentation |
| Testing | After development phase | Continuous throughout each sprint |
| Best for | Stable requirements, regulatory systems | Evolving requirements, rapid delivery |
Change Management Controls
Change management ensures that modifications to IT systems are properly authorized, tested, and implemented. Key controls include:
- Change request documentation: All changes must be formally requested, documented, and justified before approval.
- Impact assessment: Evaluate the potential effects of the change on existing systems, security, and business processes.
- Authorization: Changes must be approved by appropriate management before implementation. Emergency changes should be documented and approved retrospectively.
- Segregation of environments: Maintain separate development, testing/staging, and production environments. Developers should not have direct access to production.
- Testing before deployment: All changes must be tested in a non-production environment, including regression testing to ensure existing functionality is not affected.
- Rollback planning: Document procedures to reverse changes if problems occur after deployment.
- Post-implementation review: Evaluate whether the change achieved its objectives and identify lessons learned.
Testing Methodologies
- Unit testing: Testing individual components or modules in isolation.
- Integration testing: Testing how components work together as a group.
- System testing: Testing the complete system against requirements.
- User acceptance testing (UAT): End users verify the system meets business requirements before go-live.
- Regression testing: Retesting after changes to ensure existing functionality still works correctly.
- Penetration testing: Authorized simulated attacks to identify security vulnerabilities.
Master SDLC and change management with ISC flashcards and practice exams. Start free today.