# Epicor Customization Code Review Checklist > Source: https://netray.co/tools/epicor-customization-code-review-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A checklist for reviewing Epicor custom code, BPM directives and customizations before promotion to live. ## Category epicor ## Erp Epicor Kinetic ## Audience - Epicor developer - Technical lead - ERP admin ## Tool **Kind:** checklist **Scoring Note:** Every critical item should be met before promotion. Anything else not met needs a recorded reason and an owner. **Groups:** #### Design and documentation **Items:** **Text:** A change request or design document exists and is approved **Critical:** true **Text:** The business need is stated in plain language **Critical:** false **Text:** The lightest solution was chosen: configuration before customization before code **Critical:** false **Text:** Object names follow the team naming convention **Critical:** false **Text:** Execution order of related directives is recorded **Critical:** false **Text:** A rollback step is written down **Critical:** true **Text:** Version and environment details are recorded **Critical:** false **Text:** Owner is named for ongoing support **Critical:** false #### Safety and data integrity **Items:** **Text:** Directive conditions are narrow and cannot fire on unrelated rows **Critical:** true **Text:** Behaviour is safe for DMT loads, scheduled tasks and integrations **Critical:** true **Text:** No prompts or message widgets block non interactive callers **Critical:** true **Text:** Custom code cannot call back into the same method in a loop **Critical:** true **Text:** Writes are limited to the fields listed in the design **Critical:** false **Text:** Null and empty values are handled **Critical:** false **Text:** Error messages tell the user what to do **Critical:** false **Text:** Transactions fail cleanly without leaving partial data **Critical:** true #### Performance **Items:** **Text:** No queries run inside loops over many rows **Critical:** true **Text:** Lookups use indexed keys **Critical:** false **Text:** Large tables are filtered before they are read **Critical:** false **Text:** Tested with realistic data volumes **Critical:** false **Text:** Directive runtime measured on a typical save **Critical:** false **Text:** No unnecessary calls to external services during a save **Critical:** false **Text:** External calls have timeouts and error handling **Critical:** true **Text:** Heavy work is moved to a scheduled process where possible **Critical:** false #### Security and compliance **Items:** **Text:** No passwords, keys or tokens are hard coded **Critical:** true **Text:** Security groups and menu access were tested for each role **Critical:** true **Text:** Sensitive data is not written to logs or email bodies **Critical:** false **Text:** Changes to controlled records leave an audit trail **Critical:** false **Text:** Export or integration targets are approved by the data owner **Critical:** false **Text:** Access to the customization itself is limited to developers **Critical:** false #### Testing and promotion **Items:** **Text:** Tested in a pilot or test environment, not live **Critical:** true **Text:** Positive and negative test cases are recorded **Critical:** false **Text:** Related screens and reports were regression tested **Critical:** false **Text:** Users or process owner accepted the result **Critical:** true **Text:** Export of the customization or directive is saved in source control **Critical:** false **Text:** Promotion steps are written and repeatable **Critical:** false ## Content **Intro:** Customizations in Epicor reach into the same transactions as standard code, so a careless one can slow saves, block imports or damage data. This checklist gives a second developer a repeatable way to review before promotion. **Sections:** #### How to use the checklist **Body:** Work through each group with the author, ideally in a short review session. Mark each item as met or not met, and record who will fix those that are not. Critical items protect data and availability and should be met before anything goes to live. Export the completed checklist and attach it to the change record. **Bullets:** - Review with the author present - Fix critical items first - Record reasons for exceptions - Attach the result to the change #### Safety for non interactive callers **Body:** Epicor logic runs not only from screens but from DMT, scheduled tasks, web services and integrations. A message that waits for a user click is fine at a screen and fatal in an import. Review each directive and code block by asking who else calls this method and what happens when no human is there. #### Performance and upgrade **Body:** Queries in loops, unfiltered reads of large tables and slow external calls inside a save are the usual causes of complaints. Check them with realistic data volumes. For upgrade, favour documented approaches, record dependencies on specific fields and keep an export of each customization so it can be reapplied or rebuilt. #### Common mistakes **Body:** Reviews often focus on whether code works for the happy path and skip security roles, large volumes and import behaviour. Another is reviewing only the code and not the conditions that trigger it. Review both, and make the checklist part of the promotion process so it is not optional. **Cta:** If you want an independent review of your Epicor customizations before an upgrade, Netray can assist. **Faq:** #### Who should perform the review? **Answer:** A second developer or technical lead who did not write the change, together with the process owner for the acceptance part. Independence matters: authors tend to test the paths they thought about and miss the ones they did not. #### Do small directives need a full review? **Answer:** Use judgement. Directives that write data, block saves or run on busy methods deserve the full list. Simple read only notifications can use the critical items only. Record which level you applied so the decision is traceable. #### How does this help with upgrades? **Answer:** Documented, narrow and well tested customizations are easier to retest and rebuild. The checklist also forces you to record dependencies and keep exports, which saves discovery time when you move to a newer version. #### Can the checklist be extended? **Answer:** Yes. Add items for your own standards, such as logging conventions, naming rules or approval flows. Keep the critical group small so it stays meaningful, and review the list after any production incident to see what it should have caught. ## Search terms epicor code review checklist, epicor bpm code review, epicor customization best practices, epicor custom code standards, epicor developer checklist, epicor kinetic customization review, epicor promote to live checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json