Based on the information provided, the IS auditor should look for B: Project change management controls to ensure the risk associated with scope creep has been mitigated during software development. Project change management controls ensure that any changes made to the project are properly documented, communicated, and approved by the appropriate personnel. This helps to ensure that changes to the project are tracked and managed and that the project remains within its originally defined scope. Additionally, project change management controls help to ensure that any changes made are in line with the organization's goals and objectives.

The systems inventory containing personal data is a crucial element for auditing an organization's data privacy practices. The systems inventory is a list of all the systems, applications, databases, and devices that collect, store, process, or transmit personal data within the organization12. The systems inventory helps the auditor to identify the scope, location, ownership, and classification of personal data, as well as the risks and controls associated with them12. The systems inventory also helps the auditor to verify compliance with data privacy laws, regulations, and internal policies that apply to different types of personal data