Audit of development processes – should it be carried out?

What is a comprehensive IT audit?

When we think about verifying the way technology or manufacturing departments work in our company, the first idea that usually comes to mind is to check it in-house. In fact, in every company that seriously approaches work on providing high-quality products or services, such verification mechanisms are (or at least should be) defined. However, is this the simplest solution? Will we be able to accurately identify the causes of key problems and the mistakes we make if we have been working within the framework of clichés and using the same tools for years? Do we have enough knowledge to effectively identify problems and their underlying causes?

Key factors contributing to an effective audit

So what will allow us to effectively verify our actions and procedures? The above-mentioned knowledge is of course crucial – being up to date with the latest tools, good practices and market trends (often very broadly understood) is the basis for an effective audit. However, it should not be limited only to selected aspects, e.g. technological ones. Only a holistic look at the processes in the company, including those not directly related to the work of IT teams at first glance, will allow you to reach sensible conclusions.

Another important thing is the so-called fresh look at the subject. When conducting an audit with our own resources, unless we are talking about a really large company with dedicated internal audit departments, we will not always be able to objectively assess all aspects of our work. Using the services of an external, independent company with experience in verifying, improving and optimizing manufacturing processes in the IT industry will allow for constituting  an objective assessment.

Components of an effective audit

When we think about a comprehensive audit, we need to think about what it really is. What aspects of work on delivering an IT product or service should be verified in order to come to specific conclusions? Naturally, the more we investigate the subject, the better the results we will achieve, which will allow us to improve our work even better. After all, that is the main goal of any audit – optimizing the way you work to increase your income – for example, by making more savings or delivering better quality products.

When deciding on a comprehensive IT audit, it is certainly worth considering the audit of the following processes, steps or elements of work on a product or service:

• Business and sales processes – this will allow you to identify elements that need improvement at the very beginning of product or service development. Already at the stage of thinking about new functions or services, in conversations with potential customers or pricing changes, we can make mistakes that we have to combat for the rest of the development process;
• Analysis and preparation for implementation – here, in turn, we will specify the elements whose improvement will result in a more accurate definition of requirements and will allow for a better assessment of the main assumptions;
• Change planning and change management – verification of this process will allow for proper definition of work schedules for teams and optimization of their use for parallel projects;
• Development and implementation of new functionalities – an audit in this area will most often result in a more efficient way for teams to work, for example through efficient monitoring of work progress and more effective prediction of threats in the timely delivery of products before they occur;
• Quality assurance and QA processes – this part of software development is often downplayed in favor of development, and yet it has a key impact on how our current and future customers perceive us. Therefore, it is worth paying special attention to this area, as it directly affects the continuity of cooperation with current clients, as well as our reputation in the industry;
• Maintenance and post-implementation service – if our product or service also deals with the post-implementation period, verification of the number of errors and work required to maintain the product will allow for a better estimation of implementation costs in the future;

The above-mentioned elements that are worth paying attention to during an audit are quite extensive, and yet there are other elements that such an audit should also cover. These are primarily:

• Technological stack audit – is the technology we use still market-leading and suitable for our needs?
• Cybersecurity audit – is our product, as well as the generally understood tools used to create it, secured for us and our clients?
• Audit of compliance with the requirements of the GDPR – if our product is in any way related to the processing of personal data, do we do it in a legal and safe way?
• Audit of accessibility for people with disabilities – in the case of software with graphical interfaces, is it sufficiently accessible for people with disabilities? Does it meet the general guidelines for such products (e.g. WCAG)?

How to identify the most important areas to explore?

The above areas, which are most often examined as part of a comprehensive audit, are very extensive, and yet there are certainly other areas that are worth taking a closer look at, often specific to specific industries (e.g. fintech or medical). A full audit will allow for a broad view of our processes, but not everyone wants or can afford such a comprehensive solution. Then it is worth considering carrying out an initial verification (experienced audit companies in the IT industry often have such a service), which can be carried out, for example, in the form of reconnaissance workshops. Their result will be the initial identification of the main areas in the company on which the IT audit should focus and where there is a lot of room for optimization. And although such an initial audit will not provide answers to most of our generally understood problems in manufacturing processes, it should certainly allow defining the first directions leading to their improvement and optimization.

IT audit – what are the next steps?

A common mistake made after an audit is finished is to shelve its results. This happens for various reasons – due to lack of funds to introduce in-depth changes in the organization, reluctance to change among low- and middle-level managers, misunderstanding of audit conclusions. However, if you said “A”, you must say “B”. Before the audit, the lack of changes in processes or attempts to improve efficiency or quality of work can be justified by ignorance of the causes of problems. However, if we have in front of us the defined problems, indicators to measure the effectiveness of our processes and preliminary tips on how to improve them, there is no good reason for passivity – the next step after the audit is to think about how to start improving our work. If we do it gradually and start with the key areas, the effects of improvement can often be seen relatively quickly. This will convince people who were initially reluctant to change that their introduction makes sense, also directly for them. We can then gain more support in subsequent repair processes, and such support is always crucial in achieving the goals we have set ourselves.