Risk-based testing

What is risk-based testing?

Risk-based testing prioritizes test activities by the risk of individual features or requirements. Instead of testing every feature equally, effort concentrates on the highest-risk areas – and saves where little can go wrong. The result: the same quality with less effort, or far more confidence for the same budget.

Risk = impact × likelihood

A feature’s risk comes from two factors:

• Impact: how bad would a defect be here? (lost revenue, safety or compliance issue, reputational damage)
• Likelihood: how defect-prone is the area? (complexity, new technology, frequent change, inexperienced team)

Both are rated, e.g. on a 1–3 scale, and multiplied. This produces a risk matrix that gives every feature a priority.

In 5 steps

1. Collect risk items: list features, requirements or components.
2. Assess: estimate impact and likelihood per item – ideally together with business and development.
3. Prioritize: derive test intensity from the product (intensive / normal / spot-check / none).
4. Test & steer: high risks first; track residual risk continuously.
5. Review: update the assessment when requirements or findings change.

Example

In an online shop, payment processing has high impact (money, law, trust) and medium likelihood – high risk, so test intensively. The footer link to the legal notice has low impact and low likelihood – a quick visual check is enough. Without risk assessment both would get equal attention; with it, effort flows to where it counts.

Common mistakes

• Assessing risk in the test team alone: without business input, the view on impact is missing.
• Assess once and forget: risks change – the matrix is a living document.
• Looking only at likelihood: a rare but catastrophic failure stays high priority.

Risk-based testing is a core task in test management – how it fits an overall approach is shown in our test management consulting.

Read more