Systems Development & Change Management

System development life cycle (SDLC)

Planning → requirements → design (build in controls) → development → testing (unit, integration, system, user acceptance) → implementation → maintenance and post-implementation review.

Conversion

Direct (riskiest, cheapest) · parallel (safest, costliest) · pilot · phased. Reconcile record counts and control totals.

Approaches

Waterfall (gated sign-offs) · agile (sprints, controls each iteration) · DevOps with continuous integration and delivery (automated pipeline controls).

Change management

1. Request → impact assessment → authorize
2. Develop in non-production; test incl. user acceptance
3. Independent approval → migrate by someone other than developer → verify

• Emergency changes: after-the-fact review.
• Separate environments; configuration baselines; patch management.
• Compensating control: review production change logs against approved tickets.

Exam traps

• Testing in production with live data is a control failure — use separate environments with masked data.
• User acceptance testing is done by users, not by the developers.
• The post-implementation review comes after go-live and asks whether the system met its objectives — it isn't part of testing.