System Development Life Cycle (SDLC) for CISA
Understand the phases of the SDLC and how CISA candidates should evaluate controls at each stage of system development.
The System Development Life Cycle (SDLC) is a foundational concept for CISA candidates. It provides a structured framework for developing information systems, and auditors must understand each phase to evaluate whether appropriate controls are in place throughout the process.
Core Phases of the SDLC
While different organizations may use variations, the traditional SDLC includes the following phases:
- Feasibility Study: Evaluates technical, economic, and operational feasibility before committing resources.
- Requirements Definition: Captures business and functional requirements through stakeholder engagement.
- Design: Translates requirements into system architecture, data models, and interface specifications.
- Development: Involves actual coding or configuration of the system based on approved designs.
- Testing: Validates that the system meets requirements through unit, integration, system, and acceptance testing.
- Implementation: Deploys the system into the production environment using an approved conversion strategy.
- Post-Implementation Review: Assesses whether the system met its objectives and identifies lessons learned.
Audit Considerations by Phase
IS auditors should verify that each phase produces documented deliverables subject to management review and approval. During the feasibility study, auditors look for evidence that alternatives were evaluated and a business case was approved. In the requirements phase, auditors verify that stakeholders signed off on documented requirements.
Design and Development Controls
During design, auditors should confirm that security requirements are incorporated early (security by design). In development, code reviews, coding standards, and version control practices are key areas of focus. Segregation of duties between developers and those who approve or migrate code is critical.
Testing and Implementation Controls
Auditors should verify that test plans exist, test results are documented, and defects are tracked to resolution. For implementation, the conversion strategy (parallel, phased, or direct cutover) should be risk-appropriate, and rollback plans should be in place.
Why SDLC Matters for the CISA Exam
The CISA exam frequently tests whether candidates can identify control weaknesses at specific SDLC phases. Common exam scenarios include:
- Missing sign-off on requirements documents
- Lack of segregation between development and production environments
- Inadequate testing before go-live
- Absence of a post-implementation review
Understanding the SDLC also helps auditors assess whether an organization's methodology is appropriate for the size and complexity of the project. Smaller projects may use a simplified lifecycle, while large enterprise initiatives require rigorous phase gates and steering committee oversight.
Key Takeaways
For CISA preparation, focus on knowing what deliverables each phase should produce, what controls should be present, and what risks arise when phases are skipped or compressed. The SDLC is not just a development methodology; it is a control framework that auditors rely on to assess project governance and quality assurance.