The evidence behind the method.

Compare

Continuing unchanged, a targeted fix, and a wider change compete for budget and delivery capacity.

Count

Recurring effort and disruption; delivery, testing, transition, training, and ongoing support.

Decide

Separate observations from estimates, test low–high assumptions, and record an owner and review date. Released hours are capacity; the recommendation can be to defer or stop.

Consistent research classifications do not establish cost-estimate accuracy; the linked figures are constructed examples.

Code

Static analysis checks configured rules; it cannot find every defect or guarantee security.

Delivery

Change records, handoffs, dependencies, and interviews explain waiting and rework that code findings alone cannot.

Action

Reuse relevant tests, name untested connections, and compare impact, effort, and uncertainty before funding. Passing tests support only the conditions tested; a severity score is not a business case.

Records

Dated requests, interface records, releases, incidents, effort logs, and interviews can support a review.

Scope

Interview accounts need corroboration; diagrams may differ from actual behavior, and incomplete logs can distort costs.

Action

Separate measured effort from assumptions, show gaps and ranges, and request targeted source access or tests only where they could change the decision. Agree information handling first.

Before commitment

Challenge acquisition or handover assumptions using support costs, change history, dependencies, and delivery plans.

Readiness

Check documentation, access, and named responsibilities; documents alone do not prove the receiving team can operate.

Decision

Separate facts, estimates, and unanswered questions. Missing evidence can change cost or timing; it is not evidence of absence. Sequence post-handover priorities with owners and review dates.

Scope

Define the decision, affected work, deadline, and acceptance criteria before collecting records.

Evidence

Link applicable requirements to supporting tests, changes, and decisions; a document title alone does not establish coverage.

Ownership

Name the reviewer and due date, prioritize gaps, and track completion. Responsible specialists determine applicability and approval; this review does not certify compliance.

Depending on the program, DO-178C, AS9100, MIL-STD-882, ISO 26262, or IEC 62304 may apply.

Trace

Connect the proposed change, affected dependencies, requirements, versioned tests, and supporting records.

Check

An unchanged component may still need review; earlier evidence may not cover the new change.

Record

Keep the rationale, authorized reviewer decision, acceptable gaps, open actions, and owners together. A complete record is not approval or compliance certification; specialists determine the applicable requirements.