Managing Requirements Volatility in Enterprise Software Projects

Abstract

Purpose: Requirements volatility is unavoidable in enterprise software programs, yet many organizations still measure it as a
raw count of change requests and govern it through uniform approval gates. This review asks how volatility should be
measured over time, how the reach of a change should be estimated through traceability, and how baselining and change
control should be calibrated so that legitimate change is absorbed without uncontrolled cost, schedule, and defect
consequences. Method: An integrative review of requirements engineering, traceability, regression testing, and empirical
software engineering literature published up to 2025 was conducted under a documented search, eligibility, and appraisal
protocol, with synthesis organized by mechanism, context, and outcome. Findings: The evidence points to the timing,
magnitude, and coupling of changes, rather than their frequency, as the drivers of harm. Trace-based impact analysis is only as
useful as the recall of its links, and change control boards add decision latency that can exceed the cost they avert when every
request receives equal scrutiny. Contribution: The article proposes the TRACE-V framework of timing-weighted rate, reach,
amplitude, control latency, and exposure-tiered baselining, plus formal metric definitions, six falsifiable propositions with
stated tests, and a longitudinal validation design. Implications: Programs should report volatility as a weighted, causeclassified
time series, audit trace recall before trusting impact estimates, and route each change to a review tier by exposure.