If a program manager gives an unsatisfactory answer to one of the following questions concerning a critical practice, then a more detailed set of questions should be asked for that critical software practice. These more detailed questions are given following this first list of questions.

1. Formal Risk Management
   What are the current top ten software risks on this program? For each of these risks, what is the chance the risk will transition into a problem and what is the impact if it does?
    
2. Empirical Cost and Schedule Estimation
   What is the current estimated size of the application software (excluding system software) that will be delivered into operation? How was it derived?
    
3. Metrics-Based Project Management
   Do you have in place a metrics program to give early indication of evolving problems? If so, what is the current requirements volatility?
    
4. Earned Value Tracking
   Do you report at least monthly earned value metrics as described in Appendix VI of DoD Regulation 5000.2-R? If so, are these metrics computed from an activity network of tasks for the entire effort to the next delivery?
    
5. Defect Tracking Against Quality Targets
   Do you track and periodically report the number of defects found by each inspection and execution test from program inception and the number of defects currently closed and open?
    
6. People-Aware Program Management
   What has been the average monthly staff turnover during the past three months for each of the suppliers/developers involved in the development of software for this system?
    
7. Configuration Management
   Identify each of the types of items that are under change control in the supplier/developer's developmental baseline (e.g., source code and documents are two different types of items). The developmental baseline consists of supplier/developer-controlled configuration items that have not yet been delivered to the customer.
    
8. End-to-End Requirements Tracing
   Do you formally trace system-level requirements down through derived requirements and design to code? If so, what is the smallest level of code components to which this tracing is done?
    
9. System Architecture-Based Software Design
   What methodology or automated tool are you using to develop the system architecture? What methodology(ies) or automated tool(s) will you use to develop software architecture?
    
10. Data and Database Interoperability
    How many external electronic interfaces are there to this system for which all of the data elements to cross the interface have not been defined and put under configuration management including for each data element: name; minimum accuracy; data type, units of measure; range of values? What percent of the data elements identified to cross an external interface are in compliance with data interoperability standards?
     
11. Formal Definition and Control of Interfaces
    How many external electronic interfaces are there to this system? How many of these external interfaces have an Interface Requirements Specification under formal configuration management? How many of these external interfaces have an Interface Design Specification under formal configuration management?
     
12. Visible and Inspectable Design
    Identify each type of view that will be or is developed to describe software top-level design using a formal modeling notation (e.g., static software structure, states).
     
13. Cost-Justified and Quality-Justified Reuse
    What percentage of the total size of your application will be reuse commercial off-the-shelf (COTS)? What percentage of the total size of your application will be government off-the-shelf (GOTS)? What percentage of the total size of your application will be reuse legacy source code from a different application?
     
14. Formal Inspections
    Where are you in the development cycle for the next software version to be released? How many items have undergone a formal structured peer review up to this point in the development of this next version to be released?
     
15. Managing Tests as Assets
    Describe what you will do during development to lower the cost of regression testing during maintenance.
     
16. Frequent Compile and Smoke Testing
    On average, how many days between individual builds for an integration test?

Whenever the answer to one of the above questions on a critical practice is unsatisfactory, the more detailed set of questions on that practice from the following list should be asked.