An IS auditor is comparing the waterfall and agile development methodologies for a high-assurance billing rewrite. Which statement BEST describes how application controls are typically embedded under each approach?
- AWaterfall defers control specification to user acceptance testing, while agile specifies controls during a dedicated hardening sprint at the end of the release.
- BWaterfall and agile both defer control identification to the post-implementation review so that real production volumes can be observed.
- CWaterfall captures controls within construction code reviews, while agile captures them in the project initiation document signed off by the steering committee.
- DWaterfall embeds controls during the requirements and design phases, while agile relies on each iteration to refine controls as the product backlog evolves. Correct
Why A is wrong: This is tempting because both methodologies do test controls late, but waterfall actually specifies controls during the requirements and design phases up front, and agile distributes control work across iterations rather than waiting for a hardening sprint.
Why B is wrong: Candidates may select this because post-implementation review does evaluate control effectiveness, but neither methodology defers initial control identification to that point; controls must be designed in before deployment in any disciplined SDLC.
Why C is wrong: This reverses the typical pattern; waterfall captures control requirements before construction, and agile does not rely on a single up-front initiation document because requirements emerge across sprints.
Why D is correct: Waterfall produces a complete requirements and design baseline before construction, so control requirements are captured up front; agile defines acceptance criteria including controls per user story and refines them iteration by iteration as the backlog evolves.