Lesson 3 of 6
Traceability matrices
12 min
An auditor's first question is rarely "show me a test." It is "show me how you know this requirement, or this control, was tested, by whom, with what result, and who approved it." Answering that in minutes rather than days depends on traceability: an unbroken chain of links from requirement to risk to test to evidence to approval.
The chain
- Requirement or controlUser requirement or control objective, uniquely identified and approved
- Risk assessmentRisk rating and the chosen assurance approach
- SpecificationConfiguration or functional design that realizes it
- TestApproved test case or unscripted test charter, linked to the requirement
- EvidenceExecuted result: who, when, system, data, expected vs actual
- Deviation or defectAny failure, its resolution and retest
- ApprovalReview and sign-off of the result and the release
What a traceability matrix looks like
| Req / control ID | Description | Risk | Test ID | Result and evidence | Deviation | Approved by |
|---|---|---|---|---|---|---|
| P2P-C07 | Invoices outside price tolerance are blocked for payment (company code 1710) | High | TC-P2P-071, 072, 073 | Passed; run 2026-05-14 by tester A; invoice and block status recorded | None | Dan, 2026-05-16 |
| O2C-C03 | Orders exceeding credit limit are blocked for Great Lakes Fleet Services | Medium | TC-O2C-031, 032 | Passed after retest; first run failed | DEF-1182 fixed, retested | Maria and Dan, 2026-05-20 |
| ITGC-AC-02 | Only authorized roles can release blocked invoices | High | TC-SEC-014 | Passed; role test with authorized and unauthorized users | None | Security lead, 2026-05-18 |
A traceability matrix excerpt for Contoso's SOX-relevant controls.
Negative tests belong in the matrix
Controls exist to stop things. A matrix that only shows positive tests (the invoice within tolerance posts) proves the process works but not that the control works. For each key control, the matrix should show tests that try to defeat it: an invoice outside tolerance, an unauthorized user trying to release a blocked invoice, an expired batch being picked for delivery. Auditors and inspectors look specifically for these, because a control that has never been seen to block anything has not been shown to be effective.
Building it in practice
You can keep a traceability matrix in a spreadsheet, but it decays as soon as anything changes. A test management tool that links requirements, test cases, test runs and defects keeps it current. SAP Cloud ALM, for example, links business processes, requirements, user stories and defects to manual and automated test cases, and its traceability analytics can show which requirements are covered and executed. For regulated use, confirm what your tool does and does not provide (for example audit trails on changes to test results, or electronic signatures meeting your regulations) and close any gaps with controlled procedures.
- Give every requirement and control a stable ID that never gets reused.
- Link tests to requirements at design time, not after execution.
- Record the risk rating on the requirement so the matrix shows why each test exists.
- Link defects and deviations to the test run that found them and to the retest that closed them.
- Record approvals against the result, with name, date and meaning of the approval.
- Freeze and archive the matrix at release, alongside the evidence it points to.
- Does every in-scope requirement or control have at least one linked test?Yes → next · No → test it or document why it is out of scope
- Does every test have executed evidence for this release?Yes → next · No → execute or justify
- Is every failure linked to a resolved deviation and passing retest?Yes → next · No → resolve or accept formally
- Is every result approved by the right role?Yes → matrix complete · No → obtain approval before release
What would you do?
Two weeks before an audit, Contoso finds that 40 SOX control tests were executed and passed, but their links to control IDs were lost when the spreadsheet was reorganized. What should Priya do?
- Traceability links requirement, risk, specification, test, evidence, deviation and approval.
- Use stable IDs and link tests at design time; record risk on the requirement.
- A test tool that maintains links (such as SAP Cloud ALM) beats a static spreadsheet; close tool gaps with procedures.
- Trace forward and backward before sign-off; auditors check both directions.
Check your understanding · not graded
Lesson check
1. What is the purpose of a traceability matrix in regulated testing?
2. When should tests be linked to requirements?
3. What does tracing "backward" mean?
4. A failed test was later retested and passed. What must the matrix show?