An IS auditor is reviewing a large in-house software development project that follows a predictive (waterfall) methodology. Management asks the auditor when application controls (such as input validation and reconciliation routines) should be identified and designed to be most cost-effective and to reduce rework. What should the auditor advise as the most appropriate point in the lifecycle?