You need tracability from requirements down to lines of code. It's a very painstaking process.

Painstaking and often done with terrible tools and badly written requirements.