Procedure Guidelines and Controls Documentation: SDLC Controls in COBIT~· 4.0

摘要

Teams preparing their annual audit work papers (controls evidence) often ask, "What about software development life cycle (SDLC)-related artifacts such as VSS/CVS, test events and source code libraries?" Software development work products have particular control requirements satisfied through the appropriate use of tools such as workflow and event management, integrated development environments (IDEs), and storage libraries for the purpose of source control. Unlike controls designed to enforce and manage the policy of production environments, however, software development must allow for both creative genius and water-tight tests over what can sometimes be bleeding-edge or "nonconforming" code.