In which of the following SDLC phases would the IS auditor expect to find that controls have been incorporated into system specifications?