I work in a small team of four devs, one domain expert and one manager. We are looking to move to using scrum to try and formalise our processes.

From what I understand of agile, it seems to be close(ish) to what we are doing anyway. We have a brief document with the overall features our product will have. As we come to code each feature, we sit down and thrash it out verbally, relying on our domain expert for what the customer will want. We then code it, and it gets tested in vague ways by the other devs / domain expert. Improvements get suggested and implemented.

At our last ISO 9001 audit we were (deservedly) reprimanded for lack of any traceability. The auditor wanted some way of seeing we had records of what the product would do, and then testing to prove that it did it.

We are looking to scrum to give us a process for this, along with other benefits, but my reading up so far has not answered my question of where detailed functional requirements are recorded / tested? My understanding of agile / scrum is far from complete, so please correct me if I have misunderstandings.

As an example, let's say we have a user story that says: 
"As a customer, I need to be able to select a system state of A, B or C".
It has an acceptance test that says
"I should be able to select state A, B, or C, and the system will change to that state"

Come the sprint where this gets implemented, we sit around and decide that we will build a widget with A, B and C radio buttons, and a "Apply" button. Then we code it.

When this widget is tested, the following problems are found:
1. Selecting B sometimes doesn't uncheck the previous radio button.
2. Sometimes option C is unavailable on the system, and so should be greyed out.
3. When first opened, the initial selection does not match the current system state.

My question is how and where is this recorded? There is no detailed functional spec saying "There will be a widget with three radio buttons. When the widget is created, the current radio selection should match the system state" blah blah. Given the lack of this document how are we supposed to prove that the system does or does not do what it's supposed to to an auditor?