Controls should be defined during the design phase of system development because:

 Controls are the mechanisms or procedures that ensure the security, reliability, and quality of an IT system or process. Controls can be preventive, detective, or corrective, and can be implemented at various levels, such as physical, logical, administrative, or technical. Controls should be defined during the design phase of system development because it is more cost-effective to determine controls in the early design phase. The design phase is the stage where the system requirements are translated into a detailed technical plan, which includes the system architecture, database structure, user interface, and system components. The design phase also defines the system objectives, goals, and performance criteria. Defining controls during the design phase can help ensure that the controls are aligned with the system requirements and objectives, and that they are integrated into the system design from the start. Defining controls during the design phase can also help avoid or reduce the costs and risks associated with implementing controls later in the development or operation phases, such as rework, delays, errors, failures, or breaches. References = THE SYSTEM DEVELOPMENT LIFE CYCLE (SDLC), p. 2-3, System Development LifeCycle - GeeksforGeeks, 7.3: Systems Development Life Cycle - Engineering LibreTexts, What Is SDLC? 7 Phases of System Development Life Cycle - Intetics.