Risk management in software testing
We identify, analyze and respond to the risks that threaten your testing: environments that are not ready, people who are not available, requirements nobody can test.
Each risk gets an owner and a response, so it is dealt with early rather than discovered late.
Four ways to respond to a risk
- MitigateReduce the likelihood or impact
- ContingencyPlan for when it happens
- TransferHand it to a specialist
- AcceptDecide to live with it
What is risk management?
An essential part of proper planning is dealing with project risks. When project risks are identified, they are communicated to and acted upon by our project manager.
Not every risk is within the power of the testing team to reduce, but many can and should be mitigated by the test manager through early, practical measures.
Product risk and project risk
A product risk is a way the software itself could fail its users, such as a payment that is charged twice. A project risk is a way the work could fail, such as a test environment that arrives two weeks late. Risk analysis in software testing covers both: product risks decide what to test hardest, project risks decide what could stop testing at all.
Test manager responsibilities
Environment readiness
Make sure the test environment and tools are configured and available before testing begins.
Staff qualification
Confirm the test team is available and has the skills the project needs.
Standards and techniques
Set clear standards, rules and techniques so the testing effort is consistent.
Risk response options
| Option | Description | When to use |
|---|---|---|
| Mitigate | Put preventive measures in place to reduce the likelihood or the impact of the risk. | High-probability risks with significant impact |
| Contingency | Prepare a plan that limits the damage if the risk happens. Define the trigger and the owner. | Risks that cannot be fully prevented |
| Transfer | Shift the risk to a party better equipped to handle it, such as a vendor or specialist. | Specialized risks outside the team's expertise |
| Accept | Acknowledge the risk and choose not to act, accepting the consequences if it occurs. | Low-impact risks, or when the cost of acting is higher than the benefit |
Mitigation approaches
These are the measures the test manager uses to bring a risk down before it lands:
- Prepare testware earlier in the development cycle
- Pre-test environments before formal testing begins
- Pre-test early versions of the product
- Apply more demanding entry criteria to testing
- Enforce requirements for testability
- Take part in reviews of early project work products
- Take part in change management
- Monitor project progress and quality continuously
Source: ISTQB CTFL Syllabus v3.1.1. Risks feed straight into the test plan, and product risks decide the order of regression testing.
How BetterQA does risk management
We can start with a risk workshop with your team, keep a risk register as the project moves, and put the most testing where a failure would cost the most.
Engineers who test for a living
50+ QA engineers, working since 2018. People plan and run the risk management and report what the results mean for your release.
Bugs you can act on
Every defect we find is written up in BugBoard, our own test management tool, or in your tracker, with steps to reproduce, the expected and actual result, and the environment.
A certified process
ISO 9001 for quality management and ISO 27001:2022 for information security. See our certifications.
How an engagement works
- €20-45 per hour
- First month is a trial
- First two weeks complimentary if you are not happy
- 30 days' notice after that
Risk management: common questions
What is risk management in software testing?
Identifying what could go wrong with the product or the testing work, judging how likely and how damaging each risk is, and deciding how to respond to it.
What is the difference between product risk and project risk?
A product risk is a way the software could fail its users. A project risk is a way the work could fail, such as late environments or missing people.
What are the four risk response options?
Mitigate, contingency, transfer and accept. Which one fits depends on how likely the risk is, how much damage it would do, and what acting on it would cost.
How does risk-based testing use risk analysis?
Features with the highest product risk get tested first and most thoroughly, so limited test time goes where a failure would hurt most.
What does it cost?
Our rate is €20-45 per hour. For ongoing work the first month is a trial, the first two weeks are complimentary if you are not happy, and after that it is 30 days' notice.
Need risk assessment?
Tell us what you are releasing and what worries you about it. We will name the risks, rank them with your team and give each one an owner and a response.