Certified in Risk and Information Systems Control (CRISC) — Question 301

Controls should be defined during the design phase of system development because:

Answer options

• A. technical specifications are defined during this phase.
• B. structured programming techniques require that controls be designed before coding begins.
• C. its more cost-effective to determine controls in the early design phase.
• D. structured analysis techniques exclude identification of controls.

Correct answer: C

Explanation

The correct answer is C because identifying controls early in the design phase can prevent more costly changes later in development. Options A and B, while relevant to the design phase, do not directly address the cost-effectiveness aspect, and option D incorrectly states that structured analysis techniques exclude control identification.