Epicor Customization Code Review Checklist (Free)

0%

0 of 36 items complete

13 critical items still open - these are the highest-risk gaps.

Download checklist:

Design and documentation

A change request or design document exists and is approvedCRITICALThe business need is stated in plain languageThe lightest solution was chosen: configuration before customization before codeObject names follow the team naming conventionExecution order of related directives is recordedA rollback step is written downCRITICALVersion and environment details are recordedOwner is named for ongoing support

Safety and data integrity

Directive conditions are narrow and cannot fire on unrelated rowsCRITICALBehaviour is safe for DMT loads, scheduled tasks and integrationsCRITICALNo prompts or message widgets block non interactive callersCRITICALCustom code cannot call back into the same method in a loopCRITICALWrites are limited to the fields listed in the designNull and empty values are handledError messages tell the user what to doTransactions fail cleanly without leaving partial dataCRITICAL

Performance

No queries run inside loops over many rowsCRITICALLookups use indexed keysLarge tables are filtered before they are readTested with realistic data volumesDirective runtime measured on a typical saveNo unnecessary calls to external services during a saveExternal calls have timeouts and error handlingCRITICALHeavy work is moved to a scheduled process where possible

Security and compliance

No passwords, keys or tokens are hard codedCRITICALSecurity groups and menu access were tested for each roleCRITICALSensitive data is not written to logs or email bodiesChanges to controlled records leave an audit trailExport or integration targets are approved by the data ownerAccess to the customization itself is limited to developers

Testing and promotion

Tested in a pilot or test environment, not liveCRITICALPositive and negative test cases are recordedRelated screens and reports were regression testedUsers or process owner accepted the resultCRITICALExport of the customization or directive is saved in source controlPromotion steps are written and repeatable

Every critical item should be met before promotion. Anything else not met needs a recorded reason and an owner.

Customization review

An optional independent review of your Epicor custom code and directives.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Work through each group with the author, ideally in a short review session. Mark each item as met or not met, and record who will fix those that are not. Critical items protect data and availability and should be met before anything goes to live. Export the completed checklist and attach it to the change record.

Review with the author present
Fix critical items first
Record reasons for exceptions
Attach the result to the change

Safety for non interactive callers

Epicor logic runs not only from screens but from DMT, scheduled tasks, web services and integrations. A message that waits for a user click is fine at a screen and fatal in an import. Review each directive and code block by asking who else calls this method and what happens when no human is there.

Performance and upgrade

Queries in loops, unfiltered reads of large tables and slow external calls inside a save are the usual causes of complaints. Check them with realistic data volumes. For upgrade, favour documented approaches, record dependencies on specific fields and keep an export of each customization so it can be reapplied or rebuilt.

Common mistakes

Reviews often focus on whether code works for the happy path and skip security roles, large volumes and import behaviour. Another is reviewing only the code and not the conditions that trigger it. Review both, and make the checklist part of the promotion process so it is not optional.

Frequently Asked Questions

Who should perform the review?

A second developer or technical lead who did not write the change, together with the process owner for the acceptance part. Independence matters: authors tend to test the paths they thought about and miss the ones they did not.

Do small directives need a full review?

Use judgement. Directives that write data, block saves or run on busy methods deserve the full list. Simple read only notifications can use the critical items only. Record which level you applied so the decision is traceable.

How does this help with upgrades?

Documented, narrow and well tested customizations are easier to retest and rebuild. The checklist also forces you to record dependencies and keep exports, which saves discovery time when you move to a newer version.

Can the checklist be extended?

Yes. Add items for your own standards, such as logging conventions, naming rules or approval flows. Keep the critical group small so it stays meaningful, and review the list after any production incident to see what it should have caught.

If you want an independent review of your Epicor customizations before an upgrade, Netray can assist.

Talk to an Expert Explore More Free Tools

Related Tools

Epicor

More Epicor tools

See all

Epicor Customization Code Review Checklist