An independent review of access controls would most likely detect segregation of duties conflicts. An auditor should consider application access. For example, if the programmer moves an application to production, the programmer should not have the ability to post transactions to the general ledger. Independent postimplementation testing would not be as effective because the system could be accepted by the end user without detecting the undocumented functionality. An independent review of user requirements would not be as effective because the system could meet user requirements and still include undocumented functionalities. An independent review of user acceptance would not be as effective because the system could be accepted by the end users, and the undocumented functionalities could remain undetected.