Deciding where to spend effort.
WHY IT IS NECESSARY
Time is finite, and testing everything equally wastes it.
WHAT RISK COMBINES
Likelihood of failure Impact if it fails
WHAT RAISES LIKELIHOOD
Recent change Complexity New technology Areas with defect history Code with weak tests Work done under pressure
WHAT RAISES IMPACT
Money, safety or legal consequence Number of users affected Data loss Difficulty of recovery Visibility
WHAT TO TEST MOST
High likelihood and high impact.
WHAT TO TEST LEAST
Low likelihood and low impact.
WHAT TO ALWAYS TEST REGARDLESS OF LIKELIHOOD
Anything with severe impact.
WHY
Rare catastrophic failures are still catastrophic.
WHAT TO DOCUMENT
The risk assessment, and what it decided.
WHY
It justifies what was not tested, which is asked about after an incident.
WHAT TO REVISIT
The assessment, as the system changes.
WHAT TO COMMUNICATE
What has not been tested, and why.
WHAT TO NEVER IMPLY
That testing was complete.
