followed; whether change control protocols are followed and change records are available;

whether traceability is maintained between the specification note, the software product and the change request;;; functional configuration audit, physical configuration audit