System Development Life Cycle - Audit Checklist

System Development Life Cycle (SDLC) Audit checklist Objective #1 - SDLC Methodology 1. Determine the extent of the responsibilities of management, internal audit, users, quality assurance, and data processing during the system design, development, and maintenance. 2. Review SDLC workpapers to determine if the appropriate levels of authorization were obtained for each phase. 3. Obtain and review requests for DP services. Determine if the University's procedures are being followed. Objective #2 - Needs Analysis 1. Review and evaluate the procedures for performing a needs analysis. 2. Review a needs analysis for a recent project and determine if it conforms to standards. Objective #3 - Systems Design and Development 1. Review and evaluate the procedures for systems design and development. 2. Review design specifications schedules, look for written evidence of approval, and determine if the design specifications comply with the standards. 3. Determine if an audit trail and programmed controls are incorporated in the design specifications of a recent project. 4. Review samples of source documents used for data entry which are included in SDLC workpapers of a recently developed application. Determine if they are designed to facilitate accurate gathering and entry of information. 5. Obtain and review programs to determine if they comply with the University's programming standards. Objective #4 - Testing Procedures 1. Review and evaluate the procedures for system and program testing. ------- Page 1 of 3 ------- 2. Review documented testing procedures, test data, and resulting output to determine if they appear to be comprehensive and if they follow University standards. 3. Review the adequacy of testing performed on the manual phases of an application. Objective #5 - Implementation Procedures 1. Review and evaluate procedures for program promotion and implementation. 2. Review documentation of the program promotion procedure. Determine if the standards are followed and if documentation of compliance with the standards is available. Trace selected program and system software changes to the appropriate supporting records to determine if the changes have been properly approved. 3. Review documentation of the conversion/implementation of a newly developed application. Determine if the University's implementation procedures were followed. Objective #6 - Post-implementation Review 1. Review and evaluate the procedures for performing post-implementation reviews. 2. Review program modifications, testing procedures, and the preparation of supporting documentation to determine if the University's standards are being followed. Objective #7 - Maintenance of Applications 1. Review and evaluate the procedures for the maintenance of existing applications. 2. Review program modifications, testing procedures, and the preparation of supporting documentation to determine if the University's standards are being followed. Objective #8 - Control over Systems Software 1. Review and evaluate the procedures for modifying systems software. ------- Page 2 of 3 ------- 2. Review systems software modifications, testing procedures, and the preparation of supporting documentation to determine if the University's standards are being followed. 3. Review and evaluate documentation of in-house developed systems software and the features/options of proprietary systems software in use. Objective #9 - Documentation Standards 1. Obtain and review the documentation standards to determine if they are complete. ------- Page 3 of 3 -------