The primary area of audit focus should be the design phase where an assurance and advice on the adequacy of proposed controls can be provided. A strong presence in the testing phase is also recommended to ensure that the proposed controls are robust and workable.