There are very, very few languages (or few applications of every language) where we can honestly say "software is the spec".

Please tell me, what is the specification of this code so that we can verify and validate it:

  (defun f (x y) (* x y))

Is the specification: `f` shall return the product of two numbers?

Perhaps. Perhaps it was supposed to be addition. Perhaps it was only supposed to apply to integers. If the above spec is correct, is the code correct? Maybe. It doesn't react well when given non-numeric values. Is that a problem? I don't know, the code doesn't explain who is responsible for validating input and who is responsible for handling errors.

A specification is a hybrid prose/formal document that would give us all that information (if it had any value). The code above is not a specification, it is an implementation. No different than a gear or a cog or a lever in mechanical engineering. It is a thing which does some work. We can examine it and see what it does. But we cannot, by observation or execution, determine why without greater context. That context is the specification.

The software is an artifact, one among many, which (hopefully) satisfies a specification.