An IS auditor is reviewing the initiation phase of a proposed customer relationship management (CRM) system replacement. The project charter has been drafted and a preliminary budget approved, but the auditor notes that the organization proceeded directly to vendor selection. Which of the following, if MISSING, would represent the MOST significant control weakness in the project initiation process?