I had a 138-page checklist during a software engineering gig. It was too ensure that my software was secure. While it was being approved (it passed, of course,

I had a 138-page checklist during a software engineering gig. It was too ensure that my software was secure. While it was being approved (it passed, of course, the checklist being out of date and easy to meet), the legacy software (only fragments of which had source left) fulfilled the function. The legacy software was known to crash on constructed input that wasn't hard to guess. The checklist had come after the software so any software that was better than legacy software couldn't displace it if it wasn't better in every way. So if you fixed one bug and attempted to deploy you couldn't because your new version had to pass the checklist. Fascinating stuff.