In which of the following SDLC phases would the IS auditor expect to find that controls have been incorporated into system specifications?

A. Development
B. Implementation
C. Design
D. Feasibility