The department has controls in place to:
• Assess the risk from system development and change management process; and
• Involve stakeholders in creating risk-based written requirements to control an outsourcing action;
• Evaluate the department’s process to assess the level of risk present in system development and change management arrangements. Consider risks pertaining to:
• Functional / Non-Functional Requirement
• Feasibility studies
• System analysyst and design
• Data security
• Testing
• Acceptance criteria and approval
• Management of outsource
• Service providers, including service and satisfaction