Defect management
Defect management is the process of finding, recording, tracking and resolving software defects. A defect moves through five stages, from open to closed, and gets a severity, from critical to trivial, and a priority that sets the order in which defects are fixed.
The defect life cycle
- OpenReported and documented
- In progressA developer is on it
- FixedCode change committed
- VerifiedA tester confirms the fix
- ClosedResolved and deployed
What is defect management?
Defect management is the systematic process of identifying, documenting, tracking and resolving software defects from discovery through closure.
It makes sure every issue is categorized by severity and priority, assigned to the right person, and tracked through a defined life cycle until it is resolved and verified. Without it, bugs get reported twice, fixed once, and verified never.
Defect lifecycle and severity
| Stage | What it means |
|---|---|
| Open | The defect has been identified and documented, and is waiting for a developer or team to investigate. |
| In progress | A developer is finding the root cause and implementing a fix. This can involve code changes, testing and debugging. |
| Fixed | The change is implemented and committed. The defect is ready for QA but not yet retested. |
| Verified | QA has confirmed the fix works and has not introduced new problems. The defect is approved for closure. |
| Closed | Resolved, verified and deployed to production. No further action unless the issue comes back. |
Severity levels
| Severity | What it means |
|---|---|
| Critical | System crash, data loss or a security vulnerability. Blocks core functionality and needs immediate attention. |
| Major | A significant feature malfunction with no workaround. Hurts key user workflows but does not stop the system being used. |
| Minor | Affects non-critical functionality. A workaround exists, and the user experience is not significantly affected. |
| Trivial | Cosmetic issues, small UI glitches or suggestions. Does not affect functionality or user tasks. |
Severity is how bad the defect is; priority is how soon it gets fixed. More on the difference in bug priority vs severity levels.
Defect management process
Defect identification
Testers find defects while testing and document each one with steps to reproduce, expected and actual behaviour, and environment details.
Classification and prioritization
Each defect gets a severity (critical, major, minor, trivial) and a priority based on business impact and urgency.
Assignment and resolution
Developers investigate the root cause, implement a fix and set the status to fixed.
Verification
QA retests the defect to confirm it is gone and that the fix did not break anything else (regression testing).
Closure and reporting
Verified defects are closed. Defect density, resolution time and escape rate are tracked for continuous improvement.
Key defect metrics
Defect density
Defects relative to the size of the software, usually per thousand lines of code (KLOC) or per function point.
Defect density = total defects / size (KLOC or FP)
Defect age
How long defects stay open from identification to closure. A rising age points at a bottleneck in fixing or prioritizing.
Defect age = current date - open date
Defect escape rate
The share of defects found in production rather than in testing. Lower is better.
Escape rate = (production defects / total defects) x 100
Resolution time
Average time to fix and verify a defect. Helps forecast release readiness.
Average resolution time = sum of (close date - open date) / total defects
Not tracking any of these yet?
Escape rate is the one to start with. Talk to us
Standards and best practices
ISTQB Foundation
This framework follows ISTQB (International Software Testing Qualifications Board) guidelines for defect life cycle management, severity classification and metrics tracking.
How BetterQA does defect management
We triage, document and track defects in BugBoard or in your own tracker, retest every fix, and report the metrics above so you can see whether quality is improving release by release.
Engineers who test for a living
50+ QA engineers, working since 2018. People plan and run the defect management and report what the results mean for your release.
Bugs you can act on
Every defect we find is written up in BugBoard, our own test management tool, or in your tracker, with steps to reproduce, the expected and actual result, and the environment.
A certified process
ISO 9001 for quality management and ISO 27001:2022 for information security. See our certifications.
How an engagement works
- €20-45 per hour
- First month is a trial
- First two weeks complimentary if you are not happy
- 30 days notice after that
Defect management: common questions
What is defect management?
The process of finding, recording, tracking and resolving software defects, with each defect given a severity and a priority and followed through a defined life cycle until it is closed.
What are the stages of the defect life cycle?
Open, in progress, fixed, verified and closed. A defect is only closed after a tester has verified the fix.
What is the difference between severity and priority?
Severity describes how much damage a defect does, from critical to trivial. Priority describes how soon it should be fixed, based on business impact and urgency.
Which metrics show whether defect management works?
Defect density, defect age, defect escape rate and resolution time. Escape rate tells you most about whether testing catches bugs before your users do.
What tool do you use to track defects?
BugBoard, our own test management tool, or the tracker your team already uses. Every report has steps to reproduce, the expected and actual result, and the environment.
Need defect management support?
Tell us where bugs get lost today. We will set up triage, tracking and reporting that your developers can work from.