Software

Ask something
Discussion Locked

Auditing a Software Development Lifecycle

0 helpful
7 replies

by fahimdxb

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

In an internally developed application (created using Oracle 9i / Developer 2000) dealing with finance and accounts, I am thinking of bringing about best practices so that external auditors do not go about trying to push us into adopting extremely expensive (JOPS) or anyother ERP for lack of controls in the current environment.

Not being a software development company, I can think of bringing minimal segregation of duties to start with, which will involve, segregating application developers from database admin.

Then there would a separate Test environment where code changes would be tested by end users prior to being pushed into the production.

I am also thinking of hiring/identifying an independent Quality Control/Assurance function who would review the code prior to being pushed into the live environment.

Now, I am having a hard time to find out, how would I assure independent 'preventive' controls over DB admin activities? For detective controls, I have already tested a nifty utility which allows me to Audit Oracle tables and store it's historical/changed values in an independent database.

Also, is there a cheaper alternative to hiring a QA function?

What should I use for Version Control management for d2k?

Pls advise.

7 replies

by tony hopkinson

splitting the dba function from the developers in something that should not be taken too far.

Horses for courses, but any client server database system is inextricably linked and in general a series of compromises. You do not want either side going off and doing their own thing.

Code reviews is a hard one, that can tip over to a very divisive battle of egos in very short order.
They've got to be treated as the final check, quality should permeate the process. Somebody in the team to coordinate a framework and strategies for an environment where quality code is the norm would be far more valuable.

Ownership is also a big thing divorcing responsibility for testing from development is always a mistake. For a start you should be developing so you can test easily, to automate as much a possible. Otherwise you end up creating a bag of errors, which your QA types will not being to find except by being lucky.

Where I work we have the BA, a developer and a tester. An initial meeting to clear up the scope and maybe raise some issues and risks.
Then the tester starts formulating what they think should be tested, the developers start bashing an attempt together. Any thing that comes up including a change request from the BA is immediately discussed between all three.
Then there's a review before it goes into QA hands, then once any show stoppers (hopefully none !) are out of the way it goes into an iterative fixing cycle. Then the BA signs it off for admittance into live.

I've never worked anywhere where the 'throw it over the partition' concept worked , developing software is not a production line.
Don't put artificial barriers between you teams.

by fahimdxb

Thanks for the reply tony.

That was indeed a new perspective which I hadn't thought of before. Organisational polictics might become a hindrance and I agree...but there exists a larger issue of compliance.

OK..to discuss it further..I guess what you meant by BA is 'Business Owner..or Hmm?? Data Owner? You said, in your environ, BA signs off before it's sent to live...so I presume it's the End User.
Anyways..the issues I currently face are three, even if I take it your way and move towards compliance slowly, accepting the residual risks and telling it to our Auditors.

Q1. Is there a total segregation of Development and Live environment? I mean, technically, are they two separate VLANS with no connectivity or just two separate servers which are accessible from anywhere within the organisation. The reason I ask this, if I utterly segregate 'development' from live, I'll have to give at least two client (PCs) to my developers, one for checking their Emails/Internet etc, and one for connecting to their development/test servers.

Q2. How do I comply with auditors usual requirement of having preventive controls over DB Admin activities?

Q3. The auditors usually say that, developers retain no right over the application once they reach Live environment, is this etched in stone or is there a way out? Why I ask this, is because this finance application has a system manager module and no one in accounts knows how to create users/assign different module rights etc. Developers retain System Manager rights and they modify/delete/grant all rights etc., of course based upon users request with due authorisation process but little trail of such requests.

How can I work on these three aspects? Pls advise!

by tony hopkinson

for end users as customers. The BA's responsibility in terms of sign off, is what's going on the CD. The reason for them being wholly separate and the last word is we do tax , so legislative compliance is a non-negotiable item, the BA is a trained accountant.

I see you've run into the multiple hats scenario. You've got DBAs on the live system in development presumably.
I've satisfied auditors in the past on that front either by having as you say two complete segregated accesses where the only thing in common was me. They were more concerned with things like me accesses live and dev (and UAT) with the same login, and that documentation for release into live was highly visible and not soley reliant on my signature.
The other way I've worked is with what you proposed a reorganisation. Development to care of dev and test, and Operations took care of live. That way you could handover release into live and negotiate it between the two departments. Try not to bury yourself in too much red tape if you do that.
If you are going to mix developer and ops in one person(s) then singling out just DBA is pointless. Go for a team for both with procedures and a lot of discipline, or split it off completely.
The latter could of course require you to increase your manning.

Based on Q3, I think you need an ops department. DBA come admin and a wee helper as a start. Note the guy in charge must have the authority and the responsibility to say NO to the guys in development, otherwise you might as well not bother.

Talk to your auditors, they are usually far easier to negotiate with that manager with the 'RULES'. The big thing they want is visibility.

by boyotochi

a client requested for an auditing software that can be customized to their retail auditing package with all the neccessary data and information modeled to their everyday need,what and which do you suggest?

by wayne m.

As I understand it, a main auditing concern for financial operations is separation of staff responsibility. The staff who can make changes to production data (operations) must be separate and independent of the staff who can make changes to the production code (maintenance).

I am not an expert in this area, but I spent some time working with a consultant who was an ex-CIO at several large financial institutions. He was the one who drilled into my head the difference between operations and maintenance, which is rarely enforced outside of the world of finance.

by fahimdxb

Wayne..care to share some tips/templates/POWs etc. I am just a novice and keen on developing my capabilities in auditing financial applications and bringing about best/better practices in this area.

Pls advise!

by fahimdxb

What you say tony is indeed interesting.
So, let's start with finding the right tools and technologies that might be helpful to me here...i.e enhancing the visibility.

First, I feel that I should search for a centralised Change Management software that would enable me to keep track of the developers activities. Someplace where I (internal security analyst) can check and keep track of the number of requests authorised and pending from the Finance end users. Some of such requests are minor but other's require code change.

I need a central repository for all such change requests with a function of authorisation (workflow) built in.

Can you pls suggest something?

This discussion is closed to new replies.