Post-implementation review means the first or subsequent review of an IT solution and/or the process of its implementation, performed after its implementation, to assess any or all of the following:
- Whether the intended objectives of the solution are realised
- The effectiveness and appropriateness of the implementation process
- Causes of deviations and/or performance issues, if any
- Compliance with relevant statutory requirements and organisational policies
- Opportunities for further improvement in either the solution or implementation process
The post-implementation review essentially seeks to determine whether the investment in the IT solution was worthwhile (as determined and measurable by the organisation) and whether the delivered IT solution can be adequately managed and controlled. These investment returns can be covered as a unique, separate review often called a benefits realisation review (section 8.1). The scope of a post-implementation review should consider:
- The nature of the IT solution
- The intended usage of the IT solution (for what purpose, by whom, when and where)
- The criticality of the IT solution in achieving business objectives
- The scope of the review agreed with the auditee (organisation) management
- Whether the IT solution was subject to audit review during the initiation, development and testing stage
- Where there has been any non-audit involvement of IS auditors during the project implementation
[Excerpt from ISACA]