Exam CISA topic 1 question 1808 discussion

When reviewing an organization’s System Development Life Cycle (SDLC), an IS auditor must ensure that system development processes follow established quality standards (e.g., ISO 9001, CMMI, ITIL, COBIT)

An IS auditor reviewing an organization’s SDLC must validate that development processes adhere to established quality standards. This involves verifying compliance with documented procedures at each phase of the lifecycle, such as design specifications, testing protocols, and post-implementation controls12. For example, auditors assess whether design documents align with institutional standards, whether testing follows approved methodologies, and whether changes are properly authorized13. While utilization of standards (B) is important, the audit’s critical function is validation (C) to ensure actual adherence rather than mere existence of standards. Quality attributes (D) and ownership details (A) are context-dependent considerations rather than universal requirements for every SDLC review.

I am torn between B and C. If someone can explain why one is correct with evidence that would be helpful.