When auditing the Software Development Life Cycle (SDLC) which of the following is one of the high-level audit phases?

Requirements is a phase of the SDLC development process itself (what developers and stakeholders do), not a high-level phase of the audit of the SDLC.

Risk assessment is a component or activity that may occur within an audit phase, but it is not itself one of the high-level audit phases in the SDLC audit lifecycle.

Due diligence is a concept related to investigative research or vendor/acquisition reviews, not a formally recognized high-level phase in an SDLC audit framework.

Planning is a recognized high-level phase of an SDLC audit engagement, where the auditor defines the audit scope, objectives, resources, and approach before fieldwork begins. This is consistent with audit frameworks such as ISACA's IT audit methodology, which identifies Planning as the foundational phase that precedes evidence gathering and evaluation. It is distinct from the SDLC's own development phases and represents the auditor's preparatory work.