Definition
The SDLC covers how an organization takes a system from idea to production: requirements, design, development, testing, approval, data conversion and release, followed by maintenance. Controls inside it include documented approvals, testing in a separate environment, user acceptance, and review of data migrated from the old system. Some ITGC frameworks treat program development as its own domain and program change as another.
Why it matters in an audit or review
If a client implements a new accounting system during the year, the auditor evaluates controls over its implementation and over data conversion, because errors in opening balances or configuration can affect many transactions. If the auditor relies on automated controls in the new system, SDLC evidence supports that reliance.
Example
Illustrative: a client moves to a new ERP in July. The auditor reviews the approval of the go-live, the conversion reconciliation of accounts receivable from the old system, and user acceptance results, and tests the new system's controls for the second half of the year.
Common mistakes
- Testing the new system's controls without looking at the data conversion.
- Applying the same SDLC testing to a vendor-hosted system without considering the vendor's report.
Sources
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (as revised by SAS No. 145), application material on general IT controls
- AICPA, TSP Section 100, criterion CC8.1 on change management
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error