Leveraging Graph-RAG and Prompt Engineering to Enhance LLM-Based Automated Requirement Traceability and Compliance Checks

TL;DR

The study tackles the challenge of ensuring SRS alignment with higher-level regulatory requirements in regulated industries by enhancing information retrieval and reasoning for LLM-based compliance checks. It introduces a Graph-RAG framework combined with Chain of Thought and Tree of Thought prompting to improve retrieval accuracy and reasoning depth, demonstrated on two regulated datasets (brokerage and NASA X-38 contexts). The results show that Graph-RAG with ToT (GRAG-GPT-4o) achieves the strongest balance of precision and recall, outperforming baseline RAG approaches, though at higher computational cost and with data-quality dependencies. The work underscores the importance of graph-based knowledge representations and structured prompting for robust, explainable compliance validation, while acknowledging practical limits and the need for human-in-the-loop validation for real-world deployment.

Abstract

Ensuring that Software Requirements Specifications (SRS) align with higher-level organizational or national requirements is vital, particularly in regulated environments such as finance and aerospace. In these domains, maintaining consistency, adhering to regulatory frameworks, minimizing errors, and meeting critical expectations are essential for the reliable functioning of systems. The widespread adoption of large language models (LLMs) highlights their immense potential, yet there remains considerable scope for improvement in retrieving relevant information and enhancing reasoning capabilities. This study demonstrates that integrating a robust Graph-RAG framework with advanced prompt engineering techniques, such as Chain of Thought and Tree of Thought, can significantly enhance performance. Compared to baseline RAG methods and simple prompting strategies, this approach delivers more accurate and context-aware results. While this method demonstrates significant improvements in performance, it comes with challenges. It is both costly and more complex to implement across diverse contexts, requiring careful adaptation to specific scenarios. Additionally, its effectiveness heavily relies on having complete and accurate input data, which may not always be readily available, posing further limitations to its scalability and practicality.

Figures (16)

• Figure 1: The simplified workflow for checking requirement compliance.
• Figure 2: The automated framework diagram.
• Figure 3: Entity Extraction Prompt Overview.
• Figure 4: Holistic view of communities in the constructed graph.
• Figure 5: Community summarization prompt overview.