I would tell my CIO that there are a lot of ways we can prevent backdoors from being made by the programmers and it's a good thing she asked! Firstly we should have all the code cross checked across all our programmers so that incase one programmer, another programmer can alert us. If all the programmers happen to be in on it, we have other things as well we can do the prevent it. The programs made should not be able to access or use root files of the operating system or change any administrative setting.