Demonstrated Traceability
1. Purpose
This Requirements Traceability Matrix (RTM) provides complete bidirectional traceability between:
- User Requirements (URS) → Business and regulatory needs
- Functional Specification (FS) → Technical design and implementation
- Test Cases (IQ/OQ/PQ) → Verification and validation evidence
The RTM ensures every requirement is implemented, tested, and validated, demonstrating compliance with GxP, CSV, and 21 CFR Part 11.
2. Traceability Summary
31
Total Requirements
31
Verified
25
Critical Priority
100%
Test Coverage
3. Traceability Matrix
Showing 31 of 31 requirements
| Req ID | Category | Requirement | FS Section | Test Case(s) | Status | Priority |
|---|---|---|---|---|---|---|
| URS-001 | Submission | Allow authorized Submitters to upload documents | 3.2, 4.1 (upload-init) | PQ-001, PQ-002 | Verified | Critical |
| URS-002 | Submission | Generate unique document ID for each upload | 4.1 (submit), 5.1 | OQ-010, PQ-003 | Verified | Critical |
| URS-003 | Submission | Calculate and store SHA-256 hash for integrity | 4.1 (submit), 7.3 | OQ-011, PQ-015 | Verified | Critical |
| URS-004 | Submission | Record submission timestamp in ISO 8601 (UTC) | 4.1 (submit), 5.1 | OQ-012, PQ-004 | Verified | Critical |
| URS-005 | Submission | Store documents in encrypted storage (S3 SSE) | 2.2, 5.3, 6.1 | IQ-005, OQ-020 | Verified | Critical |
| URS-010 | Approval | Allow Approvers to view pending approval requests | 3.2, 4.1 (approvals-pending) | PQ-005, PQ-006 | Verified | Critical |
| URS-011 | Approval | Display document metadata (ID, filename, submitter, date, hash) | 4.1 (documents-list), 5.1 | OQ-013, PQ-007 | Verified | Critical |
| URS-012 | Approval | Allow Approvers to download and review documents | 4.1 (download) | PQ-008, PQ-009 | Verified | Critical |
| URS-013 | Approval | Provide Approve and Reject actions | 4.1 (approve, reject) | PQ-010, PQ-011 | Verified | Critical |
| URS-014 | Approval | Require MFA-authenticated session for approval | 3.3, 4.2 | OQ-002, PQ-012 | Verified | Critical |
| URS-020 | Security | Authenticate users via Cognito with MFA | 2.2, 3.3 | IQ-002, OQ-001, OQ-002 | Verified | Critical |
| URS-021 | Security | Enforce role-based access control (Submitter, Approver) | 4.2, 6.2 | OQ-003, PQ-013, PQ-014 | Verified | Critical |
| URS-022 | Security | Prevent Submitters from approving own documents | 6.2 | OQ-004, PQ-014 | Verified | Critical |
| URS-023 | Security | Encrypt data in transit (TLS 1.2+) and at rest (AES-256) | 2.2, 6.1 | IQ-003, IQ-005, OQ-020 | Verified | Critical |
| URS-030 | Audit | Create audit records for all document submissions | 7.1, 7.2 | OQ-014, PQ-016 | Verified | Critical |
| URS-031 | Audit | Create audit records for approval/rejection actions | 7.1, 7.2 | OQ-015, PQ-017 | Verified | Critical |
| URS-032 | Audit | Audit records include: user, action, timestamp, outcome, docID | 5.2, 7.1 | OQ-016, PQ-018 | Verified | Critical |
| URS-033 | Audit | Audit records are immutable (no delete/update) | 5.2, 6.3, 7.1 | IQ-006, OQ-017 | Verified | Critical |
| URS-034 | Audit | Provide audit trail retrieval for inspection | 4.1 (document-audit), 7.2 | OQ-018, PQ-019 | Verified | Critical |
| URS-040 | Data Integrity | Attributable: Actions linked to authenticated user | 3.3, 7.1, 7.3 | OQ-019, PQ-020 | Verified | Critical |
| URS-041 | Data Integrity | Legible: Records human-readable in UTF-8 | 5.1, 5.2, 7.3 | OQ-021, PQ-021 | Verified | Critical |
| URS-042 | Data Integrity | Contemporaneous: Timestamps at time of action | 5.1, 5.2, 7.3 | OQ-012, PQ-022 | Verified | Critical |
| URS-043 | Data Integrity | Original: Documents stored in original format | 5.3, 7.3 | OQ-022, PQ-023 | Verified | Critical |
| URS-044 | Data Integrity | Accurate: SHA-256 hashes verify integrity | 4.1, 7.3 | OQ-011, PQ-015, PQ-024 | Verified | Critical |
| URS-050 | Performance | Document upload completes within 30s for 10MB files | Section 9 | PQ-030 | Verified | High |
| URS-051 | Performance | Approval list loads within 3 seconds | Section 9 | PQ-031 | Verified | High |
| URS-052 | Performance | Support 100 concurrent users | Section 9 | PQ-032 | Verified | High |
| URS-060 | Availability | Maintain 99.5% uptime during business hours | Section 9 | PQ-040 | Verified | High |
| URS-061 | Availability | Provide graceful error messages for failures | 4.3 | OQ-030, PQ-041 | Verified | Medium |
| URS-070 | Backup | Daily backups with 30-day retention | Section 8 | IQ-010, OQ-040 | Verified | High |
| URS-071 | Backup | Audit logs retained for minimum 7 years | Section 9 | IQ-011, OQ-041 | Verified | Critical |
4. Test Case Reference
Complete test execution results are documented in IQ/OQ/PQ Results.
4.1 Test Case Categories
Test Type
Prefix
Purpose
Examples
Installation Qualification
IQ-###
Verify AWS resources deployed correctly
IQ-002 (Cognito), IQ-005 (S3 encryption)
Operational Qualification
OQ-###
Test individual Lambda functions and APIs
OQ-010 (submit), OQ-014 (audit logs)
Performance Qualification
PQ-###
End-to-end workflow validation
PQ-001 (upload), PQ-010 (approve)
5. Bidirectional Traceability
5.1 Forward Traceability
URS → FS → Test Cases
Every user requirement traces forward through design to verification:
URS-003
→
Calculate SHA-256 hash
FS 4.1, 7.3
→
Submit Lambda calculates hash
OQ-011, PQ-015
→
Tests verify hash calculation
5.2 Backward Traceability
Test Cases → FS → URS
Every test case traces backward to verify a specific requirement:
PQ-012
→
Test MFA enforcement
FS 3.3, 4.2
→
Cognito MFA + JWT validation
URS-014
→
Require MFA for approvals
6. Gap Analysis
Result: 100% traceability achieved. All 31 requirements have:
- ✅ Functional design documented in FS
- ✅ Test cases executed and verified
- ✅ Evidence captured in IQ/OQ/PQ protocols
No gaps or untested requirements identified.
7. Related Documents
8. Approval
Quality Assurance
William O''Connell
February 1, 2026
Validation Lead
William O''Connell
February 1, 2026