Which of the following is the IS auditor’s PRIMARY focus when conducting the pre-implementation review?