SDLC Methodologies

What It Is and Why It Matters

The Software Development Life Cycle (SDLC) is a structured process for planning, creating, testing, deploying, and maintaining information systems. For the CISA exam, understanding SDLC methodologies is essential because auditors must evaluate whether systems are developed with appropriate controls, whether security is integrated into the development process, and whether the chosen methodology is suitable for the project's requirements.

Different SDLC methodologies offer different strengths. The traditional Waterfall model provides clear milestones and documentation, while Agile methodologies emphasize flexibility and iterative delivery. DevOps integrates development and operations to accelerate deployment. The auditor's concern is not which methodology is "best" in the abstract, but whether the chosen approach incorporates adequate controls, produces sufficient documentation, and manages risk effectively.

Auditing the SDLC also involves verifying that business requirements are properly gathered and validated, that systems are tested before deployment, that appropriate approvals are obtained at each phase, and that post-implementation reviews confirm that systems meet their intended objectives.

Key Concepts and Terminology

Waterfall Model

The Waterfall model follows a sequential, linear approach where each phase must be completed before the next begins. The typical phases are: requirements gathering, system design, implementation (coding), testing, deployment, and maintenance. It is well-suited for projects with stable, well-defined requirements but struggles with changing requirements. The Waterfall model produces extensive documentation at each phase, which is valuable for audit purposes.

Agile Methodologies

Agile approaches (such as Scrum, Kanban, and Extreme Programming) emphasize iterative development, collaboration, and responsiveness to change. Work is organized into short iterations or sprints (typically two to four weeks), with working software delivered at the end of each iteration. Agile can present challenges for auditors because documentation may be less formal, and requirements evolve continuously. Auditors should verify that adequate controls exist even within the flexible Agile framework.

DevOps and DevSecOps

DevOps combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle through automation, continuous integration, and continuous delivery (CI/CD). DevSecOps extends this by integrating security practices into the DevOps pipeline. From an audit perspective, the key concern is that automated deployment does not bypass necessary controls such as code reviews, testing, and change approval.

SDLC Phases and Audit Concerns

• Feasibility Study: Evaluate whether the proposed system is technically, economically, and operationally viable. The auditor checks that alternative solutions were considered and that the business case is sound.
• Requirements Definition: Verify that business and technical requirements are documented, complete, and approved by stakeholders.
• Design: Assess whether the system design addresses all requirements, includes security controls, and considers performance and scalability.
• Development: Review coding standards, version control practices, and developer access controls.
• Testing: Verify that testing is comprehensive (unit, integration, system, user acceptance) and that test results are documented.
• Implementation: Evaluate deployment procedures, data migration plans, and rollback procedures.
• Post-Implementation Review: Confirm that the system meets its objectives and that lessons learned are captured.

Prototyping and RAD

Prototyping involves creating an early working model of the system to validate requirements and design concepts with users. Rapid Application Development (RAD) emphasizes quick development through prototyping and iterative feedback. Both approaches reduce the risk of building systems that do not meet user needs but may produce less documentation than traditional approaches.

How This Appears on the CISA Exam

SDLC questions on the CISA exam typically ask you to:

• Identify which SDLC phase a described activity belongs to.
• Determine the appropriate audit concern or control for a given phase.
• Compare methodologies and identify which is most suitable for a described scenario.
• Recognize risks associated with skipping phases or reducing documentation.
• Evaluate whether user involvement is adequate at key decision points.

Study Tips

• Know the phases of the traditional Waterfall SDLC and what occurs in each phase.
• Understand the key differences between Waterfall, Agile, and DevOps from an audit perspective.
• Focus on where controls should be applied: approvals at phase gates, separation of duties between developers and operations, and the importance of testing.
• Remember that the auditor's primary concern is adequate controls and documentation, regardless of methodology.
• Review the concept of post-implementation review and why it is important.

Related Subtopics

• Change management controls
• Application controls (input, processing, output)
• Testing strategies and types
• Project management and governance
• Configuration management
• System acquisition and procurement