Almost invariably, the answer is: “Requirements come from business”.
Do they, though?
When you interview business stakeholders, are they ready to dictate to you what their requirements are? Most likely, they will tell you about their problems. The ugly screens. The tedious process steps. The most hated pain points. All the things they don’t like about the current state.
These are not requirements yet. This is information about what is not right today. What they wish to change. What needs to improve.
There is a big leap from understanding the current state to articulating requirements for a solution to the problem or the business challenge. This is why we need business analysis. We need to analyze the information we collect from multiple sources, understand what the real problem is, and then convert this understanding into the requirements for a future solution. We need to sort the information, separate the relevant, discard superfluous and misleading, resolve contradictions, compare different versions of the truth, and look at the challenge from different perspectives. This is what analysis is about.
Requirements do not come from business – they come from business analysis.