Which of the following statements is in accordance with COBIT?

In COBIT-related control concepts, pervasive controls are broad, general controls that affect the overall IT environment, while detailed controls are specific controls applied to particular processes, applications, or activities. Therefore, Statement 1 is correct. Application controls are generally detailed controls, not a subset of pervasive controls, so Statement 2 is incorrect. Software implementation is normally a project or change management activity with detailed control procedures, not a pervasive control by itself, so Statement 3 is incorrect. Disaster recovery planning includes specific controls and procedures for continuity and recovery, so it can be treated as a detailed control in this context. Internal auditors use COBIT to evaluate IT governance, risk, and control design. Therefore, Option A is correct.