Software Configuration Management Undergoes a Restoration
by Alan Radding
(The following is an excerpt from an article that appears in ADTmag.com, the online site of Applications Development Trends on October 1, 2005 )
Meeting Compliance Requirements
Regulatory compliance, such as required by Sarbanes-Oxley, is driving much of the most recent interest in advanced SCM products. In general, the mandates require that managers attest to the integrity of the information they are reporting. To do that, the managers need mechanisms that monitor and report what is happening to the systems and applications that generate the information.
An SCM tool, for example, would capture changes to an application that might alter the way financial data is calculated or reported. This could become very important if questions were to arise about the accuracy or integrity of the data. The SCM tool would help auditors and investigators identify which changes were made, when they were made, who made them, and who approved them. Compliance also typically mandates the separation of duties. In application development, that translates into separating programming from testing and promotion of code to production.
“SCM is definitely a solution for some compliance issues, but before you rush out to purchase a product for compliance, we recommend that you talk with your auditors first. There are a lot of SCM tools and a lot of capabilities. You need to figure out which specific compliance needs you want the SCM tool to help you meet,” Schwaber says.
Masterbrand Cabinets turned to the Aldon SCM tool to help with compliance. “Our primary reason for getting SCM was for SOX [Sarbanes-Oxley]. It would guarantee and prove that the objects we created and tested are the same objects we moved into production,” says William Storey, the company’s deputy CIO.
The company chose the Aldon product primarily because it offered an AS/400 version. Since then, the company has expanded its use of the tool to other platforms. Previously, the company relied on an informal process of checks and balances and controls based on the use of a library. Essentially, the developer would pull out a module and put it in a test library. With only about 15 developers on staff, plus periodic contractors, the system worked reasonably well. With the arrival of SOX and the need to separate development from testing, the informal system proved inadequate.
The Aldon tool provides version control through the check-in/out facility and manages the development process from programming through testing to promotion to production. Most importantly to Masterbrand, the tool allows the company to separate duties, isolating development and testing. “If developers could get access to test results, they could go back and change things after users signed off on the code,” Storey explains. The SCM tool, however, “locks the developers out of the test environment,” he notes. With the Aldon tool, critical points in the process are automated, taking it out of the hands of individuals.
