Targeted Code Reviews in Regulated Industries
Editorial Note: I originally wrote this post for the SmartBear blog. You can check out the original here, at their site. While you’re there, check out the work of the other authors writing for them as well.
For a lot of people out there developing software, life is pretty simple. I say this not because there’s anything simple about software development, but because life around the practice of software development is simple. You come in around 9, spend the day doing what the software needs to have done to it, and you go home at 5. Maybe every now and then you stay late some days to make a push.
As organizations get bigger and more specialized, however, the outlook starts to change. Growth brings larger and larger headcount, which, in turn, means more communication channels and general, bureaucratic overhead. Growth also brings more outsider scrutiny and general public interest, particularly as companies go public and make headlines. Such organizations start to become regulated.
Simply put, a regulated organization is one in which the government takes an interest. Legislation about how the organization must behave is created, enacted, and enforced, the latter often coming in the form of check-ups, inspections, or audits. Large companies may find themselves regulated in ad hoc fashion, or it may happen due to their size and public influence. Other companies are regulated at any size, simply by virtue of their industry. This latter designation applies to the finance, energy, healthcare, and defense industries, to name a few.
The Productivity Impact of Regulation
However your company comes to be regulated, the impact on you, as a software developer, is noticeable. You have to do stuff with which your peers at other organizations needn’t bother. You need to follow certain protocols for database access or document your code in certain ways. Often times, and at larger organizations, this takes on a “death by a thousand cuts” status in your life, and it starts to feel as though you do a lot more box-checking than software development.
This, in spite of the importance of complying with this regulations, is an untenable state of affairs for a group. To put a point on it with hyperbole, one surefire way to have your software comply with all regulations is not to write any software. And, while that’s clearly never the actual mission of your company, it can sometimes feel that way as regulation compliance starts to swallow your time.