ITPEC FE Subject A October 2025 Question 45

The user department takes part in reviewing the system design documents — that control catches requirements that were missed or misread before they are built.

The risk named is that the finished system will not meet the users' requirements. In the system design phase the requirements are turned into design documents, so the control an auditor looks for is that the people who stated the requirements check those documents. When the user department joins the design review, gaps are found while they are still cheap to fix.

Answer (d)

Why not others:

• •(a) — following coding conventions and standards is a control of the programming phase; it protects code quality, not the fit to requirements
• •(b) — deriving program specifications from the design documents is a control of program design; it keeps programs consistent with the design but cannot detect a design that misses the users' needs
• •(c) — a test plan approved by the system operations department belongs to the test phase, and it involves operations rather than the users

Key rule: Match an audit checkpoint to both the phase and the risk: a risk about user requirements is controlled by user participation in the reviews of that phase.

System Audit · AI-written, may contain errors