skip to content

Requirements Traceability

Links connecting what was asked for to what was verified, from a requirement through its criteria to cases, runs and defects. Interviewers probe them because release evidence rests on them.

on this pageshow

questions

23

What does reading a requirement-to-case traceability link forward tell you that reading it backward does not?

level: juniorimportance: must knowfreq 60%

answer

  1. Same links, read two ways
  2. One read is asked at release
  3. The other is asked when pruning
  4. Requirement outward versus case inward

basics

~20 s

Forward reading starts at a requirement and asks which test cases verify it, answering whether anything checks it. Backward reading starts at a test case and asks which requirement justifies it, answering whether that case still earns its keep.

solid answer

~50 s

The same links are read in two directions to answer two different questions. **Forward** runs from a requirement, through its acceptance criteria, to the test cases that exercise it and the results those cases last produced. It answers *is this verified, and by what?* That is the release question, and before any code exists it is also the planning question: an empty forward read is a hole in the plan. **Backward** runs from a test case to the requirement that justifies it. It answers *why does this case exist, and what is lost if it goes?* That is the maintenance question, and it is what makes a suite prunable instead of untouchable. Neither is derivable from the other by inspection. The forward read cannot see a case that points at nothing; the backward read cannot see a requirement nobody linked.

code

pseudocode · 18 lines
pseudocode
link(requirement_id, criterion_id, case_id)

forward(requirement_id, build):
    verdicts = []
    for criterion in criteria_of(requirement_id):
        cases = cases_linked_to(criterion)
        results = [ latest_result(c, build) for c in cases ]
        if cases is empty:            verdicts.add(criterion, NO_EVIDENCE)
        else if any(results == FAIL):  verdicts.add(criterion, CONTRADICTED)
        else if all(results == PASS):  verdicts.add(criterion, VERIFIED)
        else:                          verdicts.add(criterion, INCOMPLETE)
    return verdicts            -- feeds the release conversation

backward(case_id):
    criteria = criteria_linked_to(case_id)
    if criteria is empty:
        return "no stated justification -- decide: re-point or retire"
    return [ requirement_of(c) for c in criteria ]   -- what breaks if this case goes

go deeper

for a junior

Be ready to state both directions in one sentence each and say which question each answers. Interviewers ask this to check you understand that links are read, not merely recorded.

for a middle

Explain the path a forward read actually walks — requirement, acceptance criteria, cases, latest results — and why the backward read is the thing that makes a growing suite prunable rather than untouchable.

for a senior

Show when you reach for each: forward before a release conversation or over a new requirement with no cases yet, backward when the suite costs more than the confidence it returns. Say what each read is blind to.

for a principal

Own the argument that a team needs both reads, and be ready to say which direction your organisation is currently blind in, what that blindness has already cost in duplicated work or an unprunable suite, and what you would change first.

## One set of links, two questions A traceability link is a recorded association between something that was asked for — a requirement, or one acceptance criterion inside it — and something that verifies it: a test case, and through that case whatever result the case last produced. The link itself is undirected. The **reading** is not. Starting from the requirement end and starting from the case end answer two different questions, support two different decisions, and are usually wanted by two different people at two different moments. Teams that think of traceability as a document to be produced tend to exercise only one direction — almost always the forward one, because that is the direction somebody asks for in writing. The backward direction is the one that quietly decides how expensive the test suite becomes over the following years. ## The forward read: what evidence exists The forward read starts at a requirement and walks outward: 1. From the requirement to its acceptance criteria — the individually checkable statements of what it means for the requirement to be met. 2. From each criterion to the test cases linked to it. 3. From each case to its most recent result on the build being discussed. 4. Back up to a verdict per criterion, and only then to a verdict for the requirement as a whole. It answers *is this verified, and by what?* That is the release question. When someone asks whether a feature is ready, the forward read is the shape of an honest answer: here is what was asked for, here is what checked it, here is what those checks last said. The same read is useful long before any code exists — a forward read over a freshly written requirement returns nothing, and that emptiness is the **plan** being incomplete rather than the build being broken. Reading forward early is cheap; reading it for the first time on ship day is not. What the forward read cannot see is a test case that points at nothing. That is not a defect in the read. It is simply the other question. ## The backward read: why does this case exist The backward read starts at a test case and walks inward: which criterion, and through it which requirement, justifies this case existing at all? It answers *why is this here, and what is lost if it goes?* That is the maintenance question, and it is what keeps a suite affordable. Every suite grows. Cases accumulate for a defect fixed four years ago, for a feature that was withdrawn, for an external behaviour that has since changed. With no backward read, nobody can tell a case that guards a payment calculation from a case that guards a decision nobody remembers making — so nothing is ever deleted, the pack slows down, and eventually people stop running it or stop believing it. With a backward read, retiring a case becomes a decision with a stated consequence rather than an act of nerve. ## The two reads side by side | | Forward read | Backward read | |---|---|---| | Starts at | a requirement or one of its acceptance criteria | a single test case | | Asks | what evidence exists that this was checked | why this case exists and what is lost without it | | Supports | the release conversation, and the plan before code | keeping, re-pointing or retiring the case | | Wanted by | whoever must answer are we done | whoever owns the suite runtime and its upkeep | | When it is absent | noticed at a fixed, loud moment | noticed rarely, and never loudly | | Typical failure it exposes | something asked for that nothing checks | a case nobody dares delete | ## Neither direction implies the other It is tempting to assume that if the links are recorded once, both reads come for free. They do not, because each read is blind to exactly what the other is about. - A requirement can have a clean forward read while one of the cases behind it also silently verifies behaviour belonging to two other requirements that nobody linked. The forward read of *those* requirements is wrong, and nothing in the first read reveals it. - A case can have a perfect backward justification and still tell you nothing about whether the requirement it points at has other criteria with no case behind them at all. So both directions have to actually be walked. Recording a link is a precondition for either read, not a substitute for performing them. ## What makes either read trustworthy - **When the link was made.** Links drawn after the testing is finished describe what was tested rather than what was asked for. A forward read over retrospective links reports everything verified, because the links were drawn outward from the cases that happened to exist. - **Results, not just existence.** A criterion whose only linked case last failed is not verified. A forward read that stops at the case and never reaches the result is a count of intentions. - **Stable identifiers.** If requirements or cases are renumbered without recording what replaced what, both reads break at the same instant. - **A named build.** Both reads are answers about a specific version. Detached from the build they were taken on, they are history, not evidence.

  • With a release a week away, which direction do you read first and why?
    Forward, from every requirement in the release scope outward to its criteria, cases and latest results. That is exactly the question the sign-off conversation asks: is there evidence for what we promised, and where is there none? The backward read is maintenance work that pays off over quarters, and pruning a suite under date pressure is how a case that was genuinely protecting something gets deleted.
  • A test case links backward to a requirement that was cancelled. Do you delete the case?
    Not automatically. The backward read says the case has lost its stated justification, not that it has lost its value — it may still be the only check on a shared calculation or a data migration that outlived the cancelled feature. Read what it actually asserts, re-point the link to whatever it genuinely verifies now, or retire it deliberately with the reason recorded. Silent deletion is how old regressions come back.
  • Can either read be trusted when the links were all created at the end of the project?
    No. Links written retrospectively are drawn outward from the cases that happen to exist, so the forward read reports every requirement verified by construction. The backward read degrades identically: every case has a justification, because somebody chose one for it after the fact. Both reads are only as honest as the moment the link was made, which is why the timing matters more than the tidiness of the record.

A library catalogue read one way tells you whether a given subject is stocked at all; read the other way it tells you why a particular book is still on the shelf. Same cards, two entirely different decisions.

saying these in an interview costs you the question

  • Thinks traceability runs in one direction only, requirement to case
  • Treats the backward read as paperwork with no engineering payoff
  • Assumes one direction can be derived from the other automatically
  • Stops the forward read at the case and never reaches its result
  • Deletes any case with no linked requirement without reading what it asserts
open as a page

In a traceability record linking requirements to test cases and defects, which gap and orphan findings appear, and what does each call for?

level: juniorimportance: must knowfreq 52%

basics

~20 s

Four findings recur: a requirement with no linked test case, a test case linked to no requirement, a defect linked to no test case, and a linked case that has never been executed. Each calls for a different action.

open as a page

What columns does a requirements traceability record need, and what does each answer?

level: juniorimportance: must knowfreq 46%

basics

~20 s

One row per requirement unit, carrying its identifier and text, the cases that verify it, the latest execution verdict, the build it ran against, and any linked defects. Every column answers one question about that statement's verification.

open as a page

What is the difference between code-execution coverage and requirement coverage?

level: juniorimportance: must knowfreq 62%

basics

~20 s

Code-execution coverage measures how much of the written code ran during testing; requirement coverage measures how many agreed requirements have a check confirming them. The denominators differ, so one can be high while the other is low.

open as a page

When a requirement changes, how far do you walk its traceability links to build the impact set?

level: middleimportance: must knowfreq 58%

basics

~20 s

Walk outward hop by hop — the requirement's acceptance criteria, the test cases linked to them, then the defects raised in that area before — and stop at the hop that stops adding anything you would re-verify.

open as a page

What can a maintained traceability record prove that links left as a by-product of ordinary work cannot?

level: middleimportance: must knowfreq 52%

basics

~20 s

A maintained traceability record proves, as of a stated moment, that every requirement had a named verification against a named version. By-product links only show what someone happened to reference, and fall silent wherever nobody referenced anything.

open as a page

Which traceability findings are honest noise rather than plan defects, and how do you scope the analysis so the list stays actionable?

level: middleimportance: should knowfreq 34%

basics

~20 s

Cases written for build health or conventions, statements verified by review, and requirements not yet in scope are noise rather than defects. Scope it to the current release and record each exception with a reason and a review date.

open as a page

What must a verification evidence record carry for a reviewer outside the team to rely on it?

level: middleimportance: should knowfreq 44%

basics

~20 s

Four things at minimum: what was verified, the exact version it ran against, who or what performed it and when, and the outcome with the stored output it was read from — kept readable for as long as required.

open as a page

Requirements are all confirmed but much of the code never runs — what does a requirement-confirmed figure miss?

level: middleimportance: should knowfreq 45%

basics

~20 s

It misses everything not on the agreed list. Failure paths, defensive branches, compatibility code and residue from removed features are in no requirement, so no value of that figure reports them. Only the code-side denominator contains them.

open as a page

Why is an acceptance criterion whose only linked test case is permanently skipped worse than one with no linked case at all?

level: seniorimportance: should knowfreq 40%

basics

~20 s

The link still exists, so the record reads the criterion as verified while nothing runs against it. An unlinked criterion is visible and gets an owner; a permanently skipped case hides the same hole behind a joined-up chain.

open as a page

Work shipped under light traceability now needs an evidence trail — what can you honestly rebuild after the fact?

level: seniorimportance: should knowfreq 30%

basics

~20 s

Anything still stored can be recovered: which change addressed which requirement, which suite ran against which build, and what it produced. What cannot be rebuilt is what nobody recorded — intent, judgement, and contemporaneity itself.

open as a page

Should a traceability record be generated from links in the work, or maintained as its own document?

level: seniorimportance: should knowfreq 42%

basics

~20 s

Generate it wherever the links already live on the work itself: a generated view can only show what the work records, and costs nothing to reproduce. An authored document shows more, but is only as true as its last edit.

open as a page

A release with near-total code-execution coverage fails acceptance because an agreed behaviour was never built — why did that figure not warn anyone?

level: seniorimportance: should knowfreq 52%

basics

~20 s

Because that figure divides by the code that exists. Behaviour nobody implemented contributes no code, so it cannot appear as unexecuted code — cutting work can even raise it. Only the requirement-side denominator holds the missing behaviour.

open as a page

When only part of a product carries an external evidence obligation, do you apply one traceability standard everywhere or two?

level: principalimportance: should knowfreq 33%

basics

~20 s

Decide from where the obligated behaviour actually reaches, not from the module diagram. One standard everywhere is simple but taxes work that never needed it and decays into form-filling; two are cheaper until the boundary erodes unnoticed.

open as a page

A requirement is split in two after test cases already link to it — how do you keep both traceability reads intact?

level: seniorimportance: nice to knowfreq 24%

basics

~20 s

Re-point each affected link deliberately: decide per case which of the two new requirements it now verifies, sometimes both, sometimes neither cleanly. Keep the retired identifier resolvable so older results and defect records still lead somewhere.

open as a page

When you hand on a change-impact set, what does the confidence you attach to it come from?

level: seniorimportance: nice to knowfreq 26%

basics

~20 s

Confidence comes from observable properties of the walk: how recently the links in that area were maintained, how much of the set came from links rather than your own reading, and whether earlier sets caught what actually broke.

open as a page