Which of the following is the BEST control to minimize the risk associated with scope creep in software development?

Scope creep occurs when new features or requirements are added informally without proper evaluation and approval, causing project delays and budget overruns. An established change management process mandates formal requests, impact analysis, and stakeholder approval for any changes to the project scope, thus effectively controlling and minimizing unauthorized additions and ensuring the project stays on track.

Retention of test data and results is important for quality assurance and defect tracking, but it does not directly prevent or control unauthorized additions to project scope.

Business management's review of functional requirements is a crucial initial step for defining scope but does not, by itself, prevent subsequent scope changes if there isn't a formal process for managing those changes.

Segregation of duties between development, test, and production environments is a security and operational control for system integrity, not a control against project scope creep.