How should internal audit test code review controls?

author: AcadiFi Team

• Related article: cia-software-defect-root-cause-controls-map
• Related question-bank placeholders: ["code-review-control-evidence", "requirements-change-defect-risk"]
• Question: How should internal audit test code review controls?
• Question detail:
• The development team says every pull request is reviewed. What evidence should I inspect?
• Answer:
• Internal audit should select a sample of changes and inspect whether code review occurred before merge or release, whether the reviewer was appropriate, whether required checks passed, whether comments were resolved, and whether exceptions were approved.
• For higher-risk changes, the auditor may also trace the change back to a requirement or defect ticket, inspect test results, and confirm that segregation exists between developer approval and independent review where the methodology requires it.
• The audit concern is not only whether a review box was checked. A review control should be designed to challenge quality, security, and completeness before the change reaches production.