Senior management requests that the internal audit function be involved in the system development lifecycle...

Internal audit can add significant value early in the system development lifecycle by advising management on appropriate control objectives. Early involvement allows control requirements relating to authorization, segregation of duties, data integrity, security, availability, audit trails, and regulatory compliance to be considered before system design is finalized. Internal audit should not define system architecture or components because those are management and technical development responsibilities. Detailed code review and preimplementation testing generally occur later in the SDLC and do not provide the same opportunity to influence control design proactively. By suggesting control objectives rather than designing or implementing specific controls, internal audit can provide advisory input while preserving management’s responsibility for the system. Therefore, option C represents the most appropriate early SDLC role.