Systems Development Lifecycle (SDLC) is used to manage risk within the development of new computer systems. Which THREE of the following…

Effective risk management within the Systems Development Lifecycle (SDLC) involves implementing specific controls at each phase.

(A) A formal business case during the planning phase is a critical control. It ensures the project is aligned with strategic objectives, has defined scope, and is financially viable, mitigating the risk of investing in a system that provides no business value.

(D) During the analysis phase, meticulously defining data specifications and user requirements is essential. This control mitigates the risk of developing a system that fails to meet business needs or produces inaccurate output.

(C) In the development phase, enforcing programming standards and conducting component testing are key controls to manage technical risk, ensuring the system is reliable, maintainable, and free from critical defects.

B. The objective of a new system is often to improve processes, not merely replicate old functionalities, which may be inefficient or obsolete. This approach introduces the risk of failing to innovate.

E. Parallel running is only one implementation strategy and is not always feasible. Furthermore, a new system's output may be intentionally different (and more accurate) than the old one.

F. A Post-Completion Review is most valuable after the system has been operational for a period (e.g., 3-6 months), allowing for a realistic assessment of benefits and operational issues.

---

1. Hoffer, J. A., Ramesh, V., & Topi, H. (2019). Modern Systems Analysis and Design (9th ed.). Pearson.

Page 10, Figure 1-4: This figure outlines the SDLC phases. The text emphasizes that the first phase, Planning, involves a formal request and an assessment of feasibility, which is encapsulated in a business case (supports A).

Page 11, "Analysis" section: This section describes the determination of requirements, stating, "the analyst studies the requirements and structures them according to their interrelationships," which directly supports the detailed specification mentioned in option D.

Page 12, "Implementation" section: This section details coding, testing, and installation. It notes that testing is a vital activity to find and fix errors, and programming standards are a prerequisite for quality code (supports C).

2. Laudon, K. C., & Laudon, J. P. (2020). Management Information Systems: Managing the Digital Firm (16th ed.). Pearson.

Chapter 13, Section 13-2, "Establishing the Business Value of Information Systems": This section explains that a strong business case is required to justify the investment in a new system, detailing its costs, benefits, and alignment with the firm's strategy (supports A).

Chapter 13, Section 13-3, "Testing": This section highlights the importance of unit (component) testing, system testing, and acceptance testing to ensure the system is free of errors and performs as specified (supports C).

3. CIMA (2019). CIMA Professional Qualification Syllabus, P3 Risk Management. Chartered Institute of Management Accountants.

Section C: Information Systems, Topic: Systems development and implementation (Weighting 15%): The syllabus explicitly requires candidates to evaluate the controls at each stage of the SDLC. It specifies the need for "a feasibility study and a business case" (supports A), "specification of user requirements" (supports D), and "testing" (supports C). It also discusses post-implementation reviews as a control to assess if benefits were achieved, which implies a time lag after implementation (refutes F).