Making Code Review Painless

Code review is an essential step in the development of concise and accurate SAS® programs. It is a required verification step in performing validation in a regulated environment. This paper will present techniques and a macro that can be freely downloaded to automate this task. The %coderev macro will perform many of the common tasks during a code review including:

1. Spell checking headers and comments
2. Reviewing all input and output datasets of the program
3. Comparing defined macro variables versus macro variable usage
4. Checking for multiple macro calls that are not in a macro library
5. Evaluating hard code logic Evaluating sort order of all datasets

These tasks are normally performed by an independent reviewer instead of the original programmer. By automating the tasks, the code review process will ensure that the smallest mistake can be captured through reports to ensure the highest quality and integrity. What normally is a dreaded task can now be done with ease.

Code Review Background
In the larger scheme of SAS program verification, code review plays a significant role in ensuring the quality and integrity of your analysis. However, it is sometimes not viewed as important because code review is a mundane task that is not fully appreciated for the value it delivers. The verification of SAS programs and output include some of the following tasks.

• Code Review - Systematic review of SAS programs according to a predetermined checklist of verification criteria.
• Code Testing - Perform testing on SAS programs or macros supplying valid and invalid inputs and verify expected output.
• Log Evaluation - Evaluate the SAS log for error, warning and other unexpected messages.
• Output Review - Visual or programmatic review of report outputs as compared to expected results.
• Data Review - Review attributes and contents of output data for accuracy and integrity.
• Duplicate Programming - Independent programming to produce the same output for comparison.

This list includes verification tasks that may not apply to all programs since not all programs produce output analysis datasets or output reports. However, if you are verifying a macro that is used many times among all your team members, the time invested in performing as many of these tasks as possible is worth the effort. In a regulated environment, these tasks are not just recommendations but become requirements.This paper will focus only on the first task of code review, although it will reference other aspects of SAS program verification. Even though the code review is the first item in the list of tasks, the order in which you perform your verification tasks can vary. They can be performed independently by different reviewers or by one reviewer either in parallel or serial. It is recommended that the reviewer is a different person from the original author of the SAS program to ensure objectivity. If possible, this effort can be outsourced to an external group so that there are no preconceived assumptions held from within your department. Once all the tasks are performed, a centralized summary report is compiled to capture all the findings. The process of reconciling these discrepancies goes beyond the scope of this paper but performing code review is an important step in this process.

Automating Review
Some critical analysis is performed during the code review process, but a large part of the task is repetitive. This is one of the main reasons why people dislike performing code reviews. After performing multiple iterations of the same review tasks, the work becomes mundane and the reviewer tends to get blurry eyed. This repetitive fatigue leads to sloppiness because the reviewer loses the fresh acuity of performing the very first verification task.

More details in MXI Papers and SAS Validation Software.