Auditing Software Development and DevOps

4.5 CPEAuditing

Learn how to audit modern software development and DevOps environments. This course explores SDLC controls, CI/CD pipelines, code repositories, and security testing—helping auditors assess risk, evaluate evidence, and ensure strong governance in fast-paced development settings.

VIDEO COURSE

Included with any paid Wisdify plan

Choose a plan to enroll and earn CPE.

View plans Already enrolled? Sign in to continue

About this course

Course 6 of 9 in our IT Audit Learning Path! Today’s organizations build and deploy software faster than ever through agile development, DevOps, and automation—but that speed introduces new risks and control challenges. Auditing Software Development and DevOps equips auditors and IT risk professionals with the knowledge to confidently evaluate these environments. You’ll explore how software is planned, designed, developed, tested, and deployed, and learn to identify control weaknesses at each stage of the SDLC.

Through real-world examples and walkthroughs of repositories, CI/CD pipelines, and security testing processes, this course demonstrates how to gather audit evidence, assess automated controls, and validate the integrity of modern development workflows. By the end, learners will be prepared to audit software development and DevOps practices with a clear understanding of both the technology and the risks that surround it.

This course covers topics that align with concepts addressed in Domain 3 of the Certified Information Systems Auditor (CISA®) exam framework. It is not affiliated with, endorsed by, or sponsored by ISACA®, nor does it guarantee exam preparation or certification outcomes.

What you’ll learn

Upon completion of this course, you will be able to:

To explain common software development methodologies (Waterfall, Agile, DevOps/CI-CD) and their implications from an audit perspective.
To identify risk and control considerations within the software development lifecycle (SDLC).
To evaluate code repository controls, including access restrictions, change approvals, and segregation of duties.
To assess the role of automated pipelines and CI/CD workflows in managing changes securely.
To understand the principles of security testing (SAST, DAST, threat modeling) and how to evaluate evidence related to these processes.
To conduct walkthroughs and sample tests of development and release processes to identify potential deficiencies.
To recognize common audit findings, red flags, and leading practices when auditing software development and DevOps processes.

Your instructor

Michael Carroll, CPA, CISA, CISM

Course content

7 lessons · 26 steps · 2h 1m of video

01LESSON 1Foundations of Software Development Auditing4 items

02LESSON 2Auditing Development Methodologies4 items

03LESSON 3DevOps and CI/CD Environments3 items

04LESSON 4Code Repositories and Source Control Auditing3 items

05LESSON 5CI/CD Pipelines – Risks, Controls, and Evidence5 items

06LESSON 6Security Testing and Secure Development Practices4 items

07LESSON 7Integrated Audit Case Study and Wrap-Up2 items

Locked

Final assessment

Course access is required to take this assessment.

30 questions70% to passUnlimited attempts

On course completion: 4.5 CPE and a certificate

Course details

CPE: 4.5
Field of study: Auditing
Course level: Not specified
Delivery method: QAS™ Self Study
Prerequisites: Completion of prior courses in Wisdify’s <a href="https://wisdify.com/it-auditing-learning-path-cpe-courses/">IT Audit Learning Path</a> is recommended.
Advance preparation: Not specified
Course content: 7 lessons · 26 steps
Assessment: Final assessment · 30 questions · pass 70%
Completion deadline: 365 days from enrollment
Last updated: January 2026
Registration: A Wisdify account, eligible subscription, and course enrollment are required.