Lay down some rules and make sure you document compliance with them.
- Tests must be performed by someone other than the person who coded the solution.
- User Acceptance Tests need to be performed by the customer (or a delagate).
- Developers do not have access to the production environment.
- An Operations person/group is responsible for deploying to the production environment.
- When a sprint ends, all accepted code is versioned. The stories completed for that sprint are documented as being part of that version.
Generally, we have sprints deal with everything through user acceptance testing, and then authorize a deployment to Prod (or not) at the sprint review. The Operations team should then be able to deploy the approved version.
You'll need several environments in order to handle this. I prefer 5:
- SIT (System and Integration Testing)
- UAT (User Acceptance Testing)
- Prod Fix (for fixing urgent Production issues)
User Stories are the general requirements. If you have more detailed requirements, have a matrix indicating in which User Story the detailed requirement is addressed.