FFIEC IT Examination Handbook DAM-II.A: II.A Policies, Standards, and Procedures (Development, Acquisition, and Maintenance)

Management develops and implements comprehensive entity-wide policies, standards and procedures covering the development, acquisition and maintenance life cycle, regularly reviewed and approved by the board and designated owners, delineating responsibilities and communicated to personnel, stakeholders and third parties, with standards such as coding standards defining the processes and rules, procedures giving instructions adjusted to changes in the environment and to the board's risk appetite and threat environment, and deviations reviewed and approved by management.