Risk Based Testing?

The Relationship between risk based testing (Risk Identification, Risk Assessment, Risk Mitigation), software testing and risk management.

A few years ago, I was reading a paper th at mentioned Risk Based Testing and it said:

Risk Based Testing is:
Risk Identification
Risk Assessment
Risk Mitigation

t his started a series of thoughts for me. First – I recognised those words, they are the simplified, generic stages of Risk Management th at you might read in any material dealing with risk management. Secondly, I have been in testing for over 20 years, I have worked in teams th at called themselves Risk Based many times but, although we spoke of risk o ften, we did not use these words to describe our activities. So … is it right to say th at t his is the Risk Based testing process? I had to have a pretty good think.

Risk Identification = Test Analysis

whe n we identify a test, we are identifying a risk. whe n we create a test to ensure th at the Log On function works, we do so specifically because there is a risk th at it will not work.

In Risk Assessment we put values on the likelihood and impact (at least) of the risks in order to put the list of risks identified into a meaningful order so th at we can manage the most serious ones first. In testing we examine which tests will cause more damage to the business (impact) and wh ere in the system defects are more likely to appear (likelihood) and order our tests to address the most significant ones first. We call t his Test Prioritisation.

Risk Assessment = Test Prioritisation

In Risk Mitigation we take actions to reduce the impact, or likelihood, or both, of the risks to bring the level of risk down to an acceptable level. In testing we act to reduce the probability of undetected defects going live down to an acceptable level (we can never guarantee th at software is defect free). We call t his action Test Execution. Test Execution reduces risk – Risk Management teaches us th at risks are unknowns; testing provides information and therefore reduces the unknowns.

Risk Mitigation = Test Execution.

So – the words all map to testing. Are they therefore correct – th at Risk Based Testing is Risk Management? Yes … and No.

The activities identified are not activities th at we only perform in Risk Based Testing, they are activities th at we perform in all forms of testing, therefore:

All testing is Risk Management.

We decided to put t his hypothesis to the test. I booked onto a risk management training course and qualification: M_o_R by Axelos. t his is a risk management method and qualification aimed at anyone involved in organisation / corporate risk management (and indeed any other form of risk management) and the other participants in the course were company directors, charity directors and civil servants.

My theory was th at, because testing is risk management and the activities of testing map to risk management activities, I would find th at t his mapping continued all the way through an in-depth risk management process. Because I am well versed in test management and testing principles, I should therefore find the course quite straight forward.

To cut the long story short the theory was proven correct – I found the course enjoyable and straight forward and I passed the foundation and practitioner exams with the highest scores in the class. The activities th at course took us through are the things th at we have slowly, over the 40 or so years since Myers wrote The Art of Software Testing, introduced to the testing process. Including scope definition, stakeholder management and the stages mentioned above. The most important difference is th at Risk Management have been working on t his process specifically. Their process is more in-depth throughout – the testing process has started from the mitigation activity of test execution and grown from there. It seems to me th at there are things for testers to learn from risk managers.

Next time I will start to examine what lessons we might learn from it.

Link to original PR: https://expleoacademy.com/int/risk-based-testing/

All training courses at Expleo Academy

https://expleoacademy.com/int/courses/146-bcs-intermediate-certificate-in-software-testing/
https://expleoacademy.com/int/courses/178-change-management-fundamentals/
https://expleoacademy.com/int/courses/194-isqi-certified-agile-business-analysis-caba-revision-session-and-exam-1500/
https://expleoacademy.com/int/courses/195-flow-ambassador-excelling-at-business-agility-masterclass/
https://expleoacademy.com/int/courses/20-estimating-for-testers/
https://expleoacademy.com/int/courses/206-dasa-certified-devops-fundamentals/
https://expleoacademy.com/int/courses/234-sql-fundamentals/
https://expleoacademy.com/int/courses/237-istqb-certified-tester-advanced-level-security-tester/
https://expleoacademy.com/int/courses/24-istqb-certified-tester-advanced-level-technical-test-analyst/
https://expleoacademy.com/int/courses/242-istqb-certified-tester-advanced-level-test-manager/
https://expleoacademy.com/int/courses/243-project-management-professional-pmp-preparation-course/
https://expleoacademy.com/int/courses/244-agile-certified-practitioner-pmi-acp-preparation-course/
https://expleoacademy.com/int/courses/250-using-selenium-in-csharp-with-workshop/
https://expleoacademy.com/int/courses/266-apmg-certified-change-management-in-an-agile-environment-foundation-and-practitioner/
https://expleoacademy.com/int/courses/267-risk-management-professional-pmi-rmp-certification-preparation-course/
https://expleoacademy.com/int/courses/268-project-management-fundamentals/
https://expleoacademy.com/int/courses/269-program-management-professional-pgmp-preparation-course/
https://expleoacademy.com/int/courses/27-istqb-certified-tester-foundation-level-extension-agile-tester/
https://expleoacademy.com/int/courses/272-bcs-certificate-in-modelling-business-processes/
https://expleoacademy.com/int/courses/274-isaqb-certified-professional-for-software-architecture-foundation-level-cpsa-f/
https://expleoacademy.com/int/courses/276-bcs-foundation-certificate-in-business-analysis/
https://expleoacademy.com/int/courses/277-icagile-certified-product-ownership/
https://expleoacademy.com/int/courses/278-writing-user-stories-workshop/
https://expleoacademy.com/int/courses/279-bcs-certificate-in-requirements-engineering/
https://expleoacademy.com/int/courses/280-bcs-international-diploma-in-business-analysis-exam-preparation-workshop/
https://expleoacademy.com/int/courses/281-bcs-certificate-in-business-analysis-practice/
https://expleoacademy.com/int/courses/284-agile-requirements-engineering/
https://expleoacademy.com/int/courses/285-certified-disciplined-agile-scrum-master-dasm/
https://expleoacademy.com/int/courses/287-icagile-certified-agile-fundamentals/
https://expleoacademy.com/int/courses/288-istqb-certified-tester-advanced-level-test-analyst/
https://expleoacademy.com/int/courses/289-certified-disciplined-agile-senior-scrum-master-dassm/
https://expleoacademy.com/int/courses/29-requirements-verification/
https://expleoacademy.com/int/courses/291-isqi-certified-agile-business-analysis-caba/
https://expleoacademy.com/int/courses/302-certified-associate-in-project-management-capm-preparation-course/
https://expleoacademy.com/int/courses/303-linux-essentials/
https://expleoacademy.com/int/courses/304-java-fundamentals/
https://expleoacademy.com/int/courses/311-performance-testing-fundamentals/
https://expleoacademy.com/int/courses/312-agile-process-tools-a-look-into-scrum-kanban-and-safe/
https://expleoacademy.com/int/courses/313-scrum-master-bootcamp/
https://expleoacademy.com/int/courses/314-product-ownership-bootcamp/
https://expleoacademy.com/int/courses/332-a4q-certified-selenium-tester-foundation/
https://expleoacademy.com/int/courses/334-psychology-of-communication-intelligence/
https://expleoacademy.com/int/courses/34-test-automation-fundamentals/
https://expleoacademy.com/int/courses/36-using-cucumber-with-selenium/
https://expleoacademy.com/int/courses/37-using-selenium-with-workshop/
https://expleoacademy.com/int/courses/38-asqf-certified-professional-for-project-management/
https://expleoacademy.com/int/courses/6-istqb-certified-tester-foundation-level/
https://expleoacademy.com/int/courses/93-agile-bootcamp/

About Expleo Academy

The Expleo Academy enables you to acquire and develop the right skills by delivering a suite of accredited training courses. With a global presence and reach, we deliver hundreds of training events to thousands of participants each year. We bring the knowledge and real experience of working with global companies and the flexibility of delivering public workshops, custom in-house solutions and blended learning approaches incorporating digital learning capabilities.

The Expleo Academy offers training courses in Management Consultancy, Business Agility, Continuous Quality, Software Engineering or even Private Events with detailed Learning pathways in Business Analysis, Change Management, Project / Program Management, Software Quality Analysis, Software Quality Management and Software Engineering.

Contact the Expleo Academy

Expleo Technology Ireland Ltd
30 North Wall Quay,
Dublin D01 R8H7

Tel +353 87 2355902
Web: https://expleoacademy.com/int/