Establish and Document the Application's Design Reviews and Their Outcomes

This chapter explains how to establish and document the reviews an Application’s design undergoes, and what those reviews conclude.

Why Design Reviews and Their Outcomes Must Be Documented

Design reviews, such as architecture reviews, security design reviews, data reviews, and infrastructure reviews, are how the enterprise checks that an Application’s design is sound before significant money is spent building it. Their value is lost if their outcomes are not recorded: conditions imposed by a review are forgotten, concerns raised are never addressed, and later teams cannot tell whether a design was ever reviewed at all.

Establish the Application’s Design Reviews

Identify which design reviews the Application requires, based on the enterprise’s governance and the Application’s criticality, regulatory classification, and data sensitivity. Typical reviews include Enterprise Architecture or architecture review board reviews, security design reviews, data and privacy reviews, and infrastructure and operability reviews. Schedule them at the points in the SDLC where their findings can still change the design, and repeat them for Releases that make significant design changes.

Document and Share Design Review Outcomes

For each design review, record its type, date, scope, the reviewers, the materials reviewed, the outcome (for example approved, approved with conditions, or not approved), any conditions or recommendations, and how each condition was resolved. Link review records to the architecture and design documentation and to any Architecture Decision Records the review produced or affected.

Best Practice: Establish and Document the Application’s Design Reviews and Their Outcomes

It is a best practice to both establish and document the solution for design assurance: identify the reviews the Application’s design requires, hold them where their findings can still shape the design, and record each review’s outcome, conditions, and resolution.

Benefits: Recorded review outcomes ensure that conditions imposed by reviewers are actually met, rather than forgotten once the review is over. They also give auditors and future teams evidence that the design was examined, by whom, and with what result.

Connections to Related IF4IT Practices and Inventories

The Solutions Architecture Best Practices and Framework describes solution architecture review. The Systems Development Lifecycle (SDLC) Best Practices addresses decision and exit criteria for the Design phase.