What is risk-based testing?
Risk-based testing prioritizes test activities by the risk of individual features or requirements. Instead of testing every feature equally, effort concentrates on the highest-risk areas – and saves where little can go wrong. The result: the same quality with less effort, or far more confidence for the same budget.
Risk = impact × likelihood
A feature’s risk comes from two factors:
- Impact: how bad would a defect be here? (lost revenue, safety or compliance issue, reputational damage)
- Likelihood: how defect-prone is the area? (complexity, new technology, frequent change, inexperienced team)
Both are rated, e.g. on a 1–3 scale, and multiplied. This produces a risk matrix that gives every feature a priority.
In 5 steps
- Collect risk items: list features, requirements or components.
- Assess: estimate impact and likelihood per item – ideally together with business and development.
- Prioritize: derive test intensity from the product (intensive / normal / spot-check / none).
- Test & steer: high risks first; track residual risk continuously.
- Review: update the assessment when requirements or findings change.
Example
In an online shop, payment processing has high impact (money, law, trust) and medium likelihood – high risk, so test intensively. The footer link to the legal notice has low impact and low likelihood – a quick visual check is enough. Without risk assessment both would get equal attention; with it, effort flows to where it counts.
Common mistakes
- Assessing risk in the test team alone: without business input, the view on impact is missing.
- Assess once and forget: risks change – the matrix is a living document.
- Looking only at likelihood: a rare but catastrophic failure stays high priority.
Risk-based testing is a core task in test management – how it fits an overall approach is shown in our test management consulting.