"With one line of code you can break down how it happened," Kaul said. He described an "'if' statement with two clauses: If you do this, then do that. If something doesn't happen, do this."
Volkswagen has said it will set aside $7.27 billion in anticipation of legal costs to deal with scandal.
But who was responsible for the software being installed in 11 million vehicles?
Winterkorn said in a statement he was "shocked by the events of the past few days" and stepped down "in the interests of the company, even though I am not aware of any wrongdoing on my part."
Kaul said finding out who knew what and when at Volkswagen could be a simple task: Just follow the development and testing audit trail.
However, not all companies follow detailed auditing processes. The primary reason, Kaul said, is the speed at which software is being released to the marketplace. It necessitates an "agile approach," resulting in millions of lines of code being worked on and checked into production every minute.
"And, right now, everyone is saying, we did not do it," Kaul said in an interview with Computerworld.
But even if software development steps aren't being audited, testing of that software is. And, if the software didn't work as it was supposed to, someone either didn't test it, or they didn't reveal the test results.
"In this case, they're saying the exhaust system was using the software. Someone developed the software for that. You can see who wrote the code for that software. You can actually see who asked the developer to write that code," Kaul said in a blog.
"Then if you go upstream you can see who that person's boss was...and see if testing happened...and, if testing didn't happen," Kaul said. "So you can go from the bottom up to nail everyone."
Sign up for CIO Asia eNewsletters.