Traceability matrix

Show, in both directions, where every rule goes and where every test comes from, and what else changes when one item changes.

Build it as you go. It is complete when the tests are written, and it is updated with every change request. Feeds: change requests and sign-off.

• Write one row per requirement, with its rules, sources, roles, process steps, stories and tests.
• Add the non-functional requirements in the same way.
• Let the Coverage sheet count the links for every rule, requirement, story, test and risk.
• Explain every gap in a note, with what would close it.
• After each change request, update the rows its impact table names.

1. Which requirements have no test? Answered in Coverage sheet: every Must shows a count. Status "Explained" marks the six items with no test, each with its reason in Gap notes: REQ-05 (Should), REQ-16 (Could) and REQ-35 (Won't), and NFR-01, NFR-09 and NFR-10.
2. Which rules have no requirement, and why? Answered in Coverage sheet: only BR-01, a right the process as a whole enforces, as its Used by column in 09 says.
3. If one rule changes, what else changes? Answered in Filter the Matrix on BR-53, a rule CR-01 touched on both the FOIA and the EIR side. It shows REQ-31, with its sources SRC-01, SRC-03 and SRC-07, its step TB-15 and its test TC-18.
4. Is it up to date after the last change request? Answered in Updated for column: CR-01 on REQ-25, REQ-26, REQ-31 and REQ-36. CR-02 marks REQ-01, which its impact table names, and REQ-03, whose test TC-10 the table also names. Neither changes while CR-02 is deferred (DEC-16).

• One-way trace only. You can spot it when you can find the tests for a rule but not the rules behind a test.
• A matrix left behind after a change: a changed rule's rows show no change request.
• Tracing to documents instead of items: a cell says "see the rules register" instead of naming the rules.
• Treating full coverage as proof of quality: every count is above zero, but a test does not really prove what it claims to cover.

• The Matrix and Coverage sheets are generated from links written once, in the requirements, the stories, the non-functional requirements, the tests and the change requests. So they cannot disagree with those files. Rejected: a matrix typed by hand, which drifts after the first change.
• The Updated for column names every change request that touches the row. A request touches it when its impact table names the requirement itself, or any item the requirement traces to, is refined by or is tested by. CR-02 is deferred (DEC-16), so the rows it marks, REQ-01 and REQ-03, have not changed: they show what CR-02 would touch if it were approved. Rejected: approved changes only, which would hide what a deferred change would touch.
• Gaps are shown, not covered with weak links. Six items have no test case, three requirements and three non-functional ones, and each has a reason in Gap notes. None of them is a Must. Rejected: citing a test that does not prove the requirement, just to lift every count above zero.
• Sources come through the rules: a requirement's Source column lists the sources of the rules it traces to, as the rules register gives them. Rejected: a source column typed by hand, which would need a check of its own.