How to audit code and database development?

Question

Hello All,

My management wants me to see if our development team is actually making the software and database design properly. they think that because they do not have any technical experience at such a detailed level that they would like to get a second opinion on if the current development management team is properly qualified to do a good job, or are they just patching things together to make it all work.

They are looking to expand their business and want to make sure they have the best designs for scalability and the proper people in place to make it happen.

Is there some sort of software build auditors or database design auditors that can be hired to do something like this? I was thinking about a database architect and software architect to do a review of the code and setup to see where the short falls are. Is this the best way to do something like this? Does anyone have any suggestions?

Thanks in advance.

Answer 1

I work for a consulting company that gets projects like this from time to time, and am frequently the lead auditor or am at least heavily involved in the audit process. So to answer your main question, yes, there are companies and/or individuals that do this.

With that said, you need to consider the following questions:

1. How will you know you are getting good advice, if you didn't already have the necessary skills to have done it right in the first place?
2. Is upper management willing to consider and execute based on the findings?
3. What message does this send to the employees who built the system?
4. Will the management deal with political issues immediately when they arise?

For #1, I would suggest that you research in your local area to find companies that do this sort of thing AND have a proven track record. I.e., they are willing to let you talk to their customers and find out their impressions. I would also find out the following:

1. Do they have a standard checklist or review template that they follow? Can you see an example? Will they also take into consideration any internal style guides, etc. that you already have?
2. Do they have expertise in the platform, language, etc.? Certifications are good, customer recommendations are better.
3. Perhaps less important, but have they worked within your industry previously? If so, can you talk to that previous customer? If not, how much will be involved in bringing them up to speed on industry-specific terms or practices?

For the other three items, you're on your own. :) This is already a tricky situation, and poor management here will quickly make things much worse.