The Requirements Document

A "requirements document" is intended to record the requirements and expectations of the

system. Although system requirements documents vary in design, each, in general, provides the
following information:

■ The intended users of the system. The users of the system include those who actually interact with it
as well as those who use the information that it produces.

■ The scope and objectives for the system. The scope should be "holistic," incorporating both the
technical environment as well as a business perspective.

■ A statement of the problem needing to be solved by the system.

■ The system goals and objectives. Be sure to include goals and objectives from a technical as well as a
business perspective.

■ Feasibility analysis. Feasibility analysis defines the constraints or limitations for the system from a
technical as well as a business perspective. Feasibility should be assessed in the following categories:
economic, technical, operational, schedule, legal or contractual, and political. Feasibility can include
those things that are tangible, intangible, one-time, or recurring.

■ Other assumptions made regarding the system such as compliance with existing business practices.

■ Expected system junctions to be provided such as authorizing payments and providing account

■ System attributes such as ease of use, fault tolerance, response time, and integration with existing
platforms.

■ The context or environment in which the system is expected to operate. This includes a description of
the system that is expected to fit or interface within the environment (industry context, company
culture, technical environment, etc.).

Identifying Various Alternatives

Many options exist in procuring software solutions, which include any combination of the following:

 purchasing an off-the-shelf product,

 contracting for development,
 developing the system in-house, or
 outsourcing a system from another organization.
Off-the-Shelf Solutions

Purchasing commercially available products requires that the organization's business adapt to
the functionality of the system. This business adaptation process requires that the organization could
also customize the software product and subsequently maintain those customizations within the
processes that have been modified and changed. The advantages of using off-the-shelf products are
shorter implementation time, use of proven technology, availability of technical expertise from outside
the company, availability of maintenance and support, and easier-to-define costs. The disadvantages
include incompatibility between packaged system capabilities and the company's requirements, long-
term reliance on a supplier for maintenance and support, specific hardware or software requirements,
and limitations on the use or customization of the software.

Purchased Package

Suppliers develop packaged systems for wide distribution that satisfy a generic business
problem. For example, a pay roll system is somewhat generic for most organizations. Often, a purchased
package can satisfy the business needs for much less than developing a system internally. If various
packages are available, organizations will develop a request for proposal that defines the system
requirements and asks for the supplier's solution to those requirements. Organizations then weigh how
well each package meets the business requirements and whether a purchased application makes sense.
When selecting a supplier package, organizations should consider the following:

■ Stability of the supplier company

■ Volatility of system upgrades

■ Existing customer base

■ Supplier's ability to provide support

■ Required hardware or software in support of the supplier application

■ Required modifications of the base software

Although packaged applications may appear to be less costly to implement than building a new
system internally, there are risks to consider before selecting this option. A packaged application may
not meet the majority of the business needs, resulting in extensive modification or changes to business
processes. Also, any future releases of this software may require extensive programming to retrofit all of
the company-specific code. Because packaged systems are generic by their nature, the organization may
need to modify its business operations to match the supplier's method of processing. Changes in
business operations may be costly due to training and the new processes may not fit into the
organization's culture or other processes.
Contracted Development

Contracted development requires that the organization procure personnel to develop a new
system or customize an existing system to the company's specifications. Contracting for systems
development can provide increased control over costs and implementation schedules, legal and
financial leverage over the contractor, additional technical expertise, and the ability to adhere to
company policies, processes, and standards. Disadvantages associated with contracting for development
include higher labor costs when compared to in-house staff, turnover of contract staff, business viability
of the contracted company, exclusion of maintenance in development costs, and a lack of organizational
understanding by the contractor.

Outsourcing a System from Another Organization

Many companies choose to outsource system functionality from another organization.

Outsourcing allows the company to cost-effectively remain focused on their core competencies and
quickly respond to business needs as well as take advantage of the expertise of another organization.
Outsourcing provides increased control over costs without the need to acquire or maintain hardware,
software, and related staff. However, outsourcing systems increases reliance on the outsourcer, limits
the company to what is provided by the outsourcer, and decreases the ability of the company to acquire
related experience and expertise.

Performing a Feasibility Analysis

A feasibility analysis defines the constraints or limitations for each alternative from a technical
as well as a business perspective. Feasibility analysis includes the following categories: economic,
technical, operational, schedule, legal or contractual, and political.

Economic feasibility analysis provides a cost-benefit justification. The expenses of a system

include procurement, start-up, project specific issues, and impact to operations. It includes one-time
and recurring costs. Sample of costs include consultants, start-up infrastructure, support and leases.
Benefits include cost reduction or avoidance, error reduction, increased speed, improved management
decisions, improved response to business needs, timely information, improved organizational flexibility,
better efficiency, and better resource utilization.

Technical feasibility analyzes the technical practicality of the proposed system. It evaluates the
consistency of the proposed system with the company's technical strategy, infrastructure, and
resources. It answers the question of whether the organization has the resources to install and support
the solution. Technical feasibility evaluates whether the company has the necessary hardware, software,
and network resources to support the application as well as whether it provides reliability and capacity
for growth. It also assesses the technical expertise requirements and compares it with those provided by
the organization.
 Operational feasibility examines how well the proposed system solves business problems or
provides opportunities to the business. It also evaluates the extent of organizational changes required to
accommodate the system. These changes can include personnel, business processes, and products or
services offered.

Legal and contractual feasibility reviews any related legal or contractual obligations associated
with the proposed system. Legal constraints include federal or state law as well as industry-related
regulations. In addition to any new contract obligations introduced by the new system, existing
contracts are also reviewed to ensure that there are no pre-existing commitments that regulate the
installation or use of the proposed system. Legal counsel should be involved in this process and is one of
the critical points for IT auditors to review. Note that the underlying theme is protection of the company
and the establishment of the remedy process should the contractor fail to perform or deliver as
promised. Organizations looking for assistance in this area should refer to their legal counsel or an
organization such as the Computer Law Association whose members specialize in this area.

Political feasibility evaluates how the internal organization will accept the new system. This
includes an assessment of the desirability of the system within the organization as well as its fit with the
organization's corporate culture.

Conducting a Risk Analysis

A risk analysis reviews the security of the proposed system. It includes an analysis of security
threats and potential vulnerabilities and impacts, as well as the feasibility of other controls that can be
used to reduce the identified risks. Controls include systematic or automated methods as well as audit
trails. Risks affect control objectives in the areas of confidentiality and privacy of information, integrity
and accuracy of the data, timeliness of the information for decision making, ability to access the system,
as well as staff organization and knowledge required to support the system.

Defining Ergonomic Requirements

The goal of ergonomics is to provide a work environment that is safe and efficient for the
employee. In the context of a computer system, ergonomics includes the design of the computer
workstation and human interface components such as the monitor, keyboard, or mouse. Repetitive
motion injuries and eyestrain are two of the most common ergonomic considerations in computer-
related systems. A company's risk management or occupational safety department may provide
guidelines for ergonomic requirements.
Carrying Out the Selection Process

The selection process includes identifying the best match between the available alternatives and
the identified requirements. The selection process consists of soliciting proposals from interested
providers, evaluating the proposals in terms of the identified requirements, and selecting the best
available alternative. The selection process should be structured to ensure that the process would be
completed diligently and in a timely manner. If done correctly, the selection process promotes buy-in for
the selected solution.