3 ms·
> your SOX narrative doesn't cite code review Thats not for all code. Only the parts of code that need sox compliance. Plus its usually implemented as person d
by dominotw 5y ago
> your SOX narrative doesn't cite code review
Thats not for all code. Only the parts of code that need sox compliance. Plus its usually implemented as person doing the deploy is different from person writing the code. So yea code review isn't a requirement, requirement is that a single person cannot make change in the production.
- dekhn 5y agoI think most lawyers look at this and say "all code needs sox compliance" because you can't easily guarantee some bit of code won't end up being checked into a server binary that runs in prod at some point. I think as long as you have a good enough narrative about production change control (IE, review all code that is added to a release candidate, when the RC is about to be promoted) then you don't need code review of all code required. That said, I find that in many cases, people make good code review comments and I've learned how to push back against unnecessary nits (at google, it's called "Ack.")