The COSTAR Role of Code Reviewers

Kris Scott (MSIT '20) joined luxury travel company Preferred Travel Group as its director of data, artificial intelligence, and integrations in April 2024. In that role, he manages a small team of data engineers who write and maintain dozens of data pipelines, business intelligence reports, and dashboards. 

Soon after he joined the company, he taught his team an acronym to follow whenever reviewing code. Afterward, Scott's boss pulled him aside and asked where he learned the innovative framework. 

"I told him I was pretty sure I made it up," Scott said.

Scott was encouraged to share his creation with the general public. In September, he did just that.

Scott published "Introducing COSTAR Code Reviews" on Medium to showcase the different aspects of code he believes should always be evaluated before being deployed.

"A code review is like any other review of work," Scott said. "It is the building inspector coming to make sure everything is up to code. It is an editorial review making sure you followed the publication style guide and all facts have been checked. It is an important step in writing good software."

Unfortunately, what Scott's seen in his nearly 20-year career is that reviewing code often becomes a checkbox to mark among a litany of other work, and the quality and value of the review becomes inconsistent.

If the box is marked that the code's been reviewed, then it is assumed that the code must be good. Scott said that's not always the case.

In his experience, he said reviews often come in two extremes. One is "rubber stamping," where everything is approved almost immediately. "This often leads to a lot of bad work getting out real fast," he said.

The other extreme occurs when reviewers try to find as many faults as possible, no matter how trivial. "This often leads to only marginally better work getting out very slowly, if at all," he said.

This realization is what led Scott to develop COSTAR, which stands for clean, optimal, secure, tested, accurate, and resilient. Scott realizes none of those elements are groundbreaking when it comes to reviewing code. Instead, his hope with COSTAR is that it becomes a standard checklist to help code reviews become consistent and impactful across organizations.

"The point of COSTAR is not to grind all progress to a screeching halt, make code reviews take forever, and ensure your most insufferable reviewer gets his quota of junior developer tears," Scott wrote in his Medium post. "The point is to ensure code reviews are meaningful and actually improve code quality."

That focus on quality and its impact on the larger business is a mindset Scott developed in Northwestern Engineering's Master of Science in Information Technology (MSIT) program.

When Scott started in MSIT, he was a hands-on technical manager. He knew how to build teams of engineers and help them complete projects, but he didn't have a grasp on much outside of the IT department.

"I viewed most of the other departments as the enemy," he said. "If the darn business would just get out of our way, we'd make some great software!"

Realizing that was not an effective mindset, Scott turned to MSIT. While in the program, he read a financial statement for the first time, reviewed contracts, designed a marketing strategy, wrote a security policy, and countless other valuable business processes he'd never done before. Thanks to those experiences, he developed a more holistic perspective of how technology and business work together.

As a result, he's helped IT become a co-star and play a critical role in helping his company grow.

"Ultimately my job is still to make the computers do stuff," Scott said, "but hopefully my colleagues in other departments find I'm a lot easier to deal with now that I can better speak their language and know when to let some technical minutia go."  

The image with this story is an AI Image generated by Kris Scott using DALL-E 3.