An IS auditor should be consulted during the requirements definition phase to recommend security controls.
This ensures that security considerations are integrated from the beginning of the software development life cycle, leading to more secure software design and implementation.
References
* ISACA CISA Review Manual 27th Edition, Page 240-241 (SDLC Phases)

Comprehensive and Detailed Step-by-Step Explanation:
Awalk-through of job functionsprovides direct evidence thatseparation of duties (SoD)is implemented effectively. It involves observing employees as they perform tasks to confirm that no single person has excessive privileges.
* Walk-through of Job Functions (Correct Answer - D)
* Confirms that duties are appropriately divided in real-world operations.
* Helps verify whether security policies and controls are enforced.
* Example:An auditor observes that the same person cannot create and approve financial transactions.
* Review of Personnel Files (Incorrect - A)
* Personnel files contain job details but do not confirm how duties are performed.
* Analysis of Documented Job Descriptions (Incorrect - B)
* Job descriptions may be outdated or inaccurate.
* Review of Organizational Chart (Incorrect - C)
* Shows reporting relationships but does not confirm SoD implementation.
References:
* ISACA CISA Review Manual
* COBIT 2019: Risk Management and Governance
* ISO 27001: Segregation of Duties Control