IS auditors are involved at this stage to determine whether
adequate security requirements have been defined to address,
at a minimum, the confidentiality, integrity and availability
requirements of the system. This includes whether adequate
audit trails are defined as part ofthe system since these affect the
auditor's ability to identify issues for proper follow-up.