The world of software development is highly competitive, and to succeed in this field companies need to create the highest quality products at the lowest price possible. An effective QA process is essential for every business, because it means that a company releases a high quality product onto the market.
However, modern applications are so complex that QA professionals rarely have enough time, and budget, to test every single function and feature of a product.
So, QA testers then have to decide where to allocate their efforts, because they cannot possibly cover everything. So, how do they do it?
Risk-based testing allows QA testers to determine and prioritize testing goals.
Not familiar with this approach? Stay with us. In this article, we will explain what risk based testing is, what the risk management process in software testing looks like, and what are the benefits of using such a strategy.
What is Risk Based Testing?
Before we dive deep into risk based testing, let's talk about risk in general.
Risk refers to the possibility of something negative happening, and then how that negative event could impact the success of a project.
It is usually broken up into two factors:
1. The likelihood of something happening.
2. How severe the damage could be.
In software development, risk can serve as a reliable parameter for prioritizing testing activities. When you have unlimited testing scenarios and limited resources, it is necessary to put a team's effort into testing features and functions that will be used more frequently by the end-user, and to test scenarios that will have a significant impact on the outcome of the project.
In other words, a QA team needs to answer two questions when they’re looking at testing:
- How often is this feature used?
- How significant would the impact be if this feature failed?
Let's look at this simple example. Imagine a QA team is working on an application for a bank. Testers have to ensure that these two features work correctly:
- Transferring funds. Users use this feature frequently, and they are likely to stop using the application if this feature does not work as expected. So, a failure or malfunction here could cause severe damage to the business.
- Finding an ATM. It is not the primary function of a banking application and users use it less often. If an app user needed to locate an ATM but the map showed the ATM on the opposite side of the street from its actual location, users might be slightly confused, but such a minor error would not significantly impact the business.
As you can see, the QA team would need to put more effort into testing the ‘transferring funds’ feature of an application. The impact of not testing this feature thoroughly could damage the business as a whole, and the business could lose many customers.
Of course, this is a highly simplified example and actual applications are much more complex. But hopefully, it gives you a general idea of what risk based testing is about.
An approach like risk based testing allows testers to optimize their resources, and it helps them to maximize the benefits of their testing activities. Testers prioritize tasks based on the likelihood of a feature failing and its impact on the end-users.
Now let's have a closer look at how the risk management process in software testing looks.
Risk Management Process
The risk management process can vary depending on a company and the complexity of a product in development, but it usually includes these steps:
- Identifying risks. The first step is to create a list of everything that might potentially fail. QA teams do this by reviewing requirements, jotting down ideas, interviewing domain experts, and analyzing previous projects. Their goal is to identify the potential risks of a project.
- Risk assessment. Once the list of risks has been created, the team is ready for the next step - analyzing and prioritizing risks. QA teams evaluate each item on the list based on two factors: probability (the likelihood it will happen) and impact (the damage it will cause if failure occurs). At this stage, QA professionals often use a risk matrix (we will cover this in the next section).
- Risk response planning. Once risks have been identified and assessed, it is time to plan out how to handle them. Using the input from risk analysis experts and test managers, teams can create a testing strategy and schedule. More thorough testing activities are outlined for higher-level risks, while less detailed testing methods are designed for lower-level risks. Results of these risk assessments also determine who can work on what (for example, if you need an experienced tester to work on a particular feature).
- Risk monitoring. It is essential to update the risk management plan regularly, so it reflects the most current situation. Risk monitoring is used to identify new risks, re-evaluate risks listed earlier and to adjust the response plan as needed.
Now that you have a better understanding of the risk management process in software testing, let's move on to the next concept, the risk matrix.
Risk Matrix
To analyze identified risks QA teams often use a probability/impact matrix. This provides them with a quick view of all the risks and task priorities.
Remember, risk consists of two factors: the likelihood of something happening and the damage it would cause.
So, on the matrix you have ‘probability’ at one side and ‘impact’ on the other side. This way, all risks can be divided into different groups:
- Highly likely and significant potential impact. A QA team must test it thoroughly.
- Unlikely and significant potential impact. A QA team should test it.
- Highly likely and minor potential impact. A QA team could test it.
- Unlikely and minor potential impact. A QA team can test it if there is time.
Of course, depending on the nature of a project, such a matrix can be much more detailed and can include more levels of probability and impact.
For example, frequent, probable, occasional, remote, improbable for ‘likelihood’, and catastrophic, critical, marginal, negligible for ‘impact’. But the core principle is the same.
This risk matrix helps to visualize the risks for the QA team involved in the product’s development.
Benefits of Risk Based Testing
As you can see, risk-based testing allows companies to optimize their testing activities when they have limited resources available.
It enables QA teams to prioritize tasks more accurately, they can focus on the customer experience, they can find the most critical errors earlier, and they can see precise information on test coverage at all stages of the software development lifecycle.
This approach leads to cost reduction, products enter the market quicker and higher quality applications are available to use.
Conclusion
Risk based testing allows QA testers to determine and prioritize their testing goals. If used correctly, the risk matrix can help testers to see what is critical and must be tested. On the whole, risk based testing allows teams of people to get the most out of their testing activities when they do not have the necessary resources.