Risk-Based Testing for Technical Test Analysts
Risk-Based Testing for Technical Test Analysts
Risk-based testing is the exam domain that asks you to use product and technical risk to decide where test effort goes, how deep to test, and when to stop. The Technical Test Analyst contributes technical risk identification and assessment rather than only project scheduling risk.
Core rules
- Risk is usually assessed as likelihood × impact; risk exposure = probability × impact on a defined scale. Product risk concerns the delivered system (e.g., a payment defect). Project risk concerns delivery (e.g., a late test environment).
- Technical risks include architecture, algorithms, interfaces, data conversion, performance, security, and maintainability.
- Identify risks with workshops, checklists, interviews, historical defect data, and reviews of architecture and code.
- Assess probability and impact, then prioritize. Risk control options: mitigate by testing, contingency, transfer, or accept.
- Risk-based test planning allocates effort, selects techniques (e.g., more white-box and security testing for high technical risk), and defines exit criteria.
- Risk-based monitoring reassesses risk after changes, defects, and test results; risk is not static.
Worked example
A payment API adds a new encryption library and a third-party gateway. Team ratings: incorrect encryption = probability 3, impact 5 → exposure 15; gateway timeout = 3 × 3 = 9; dashboard styling = 1 × 2 = 2. The highest exposure drives security tests, negative encryption tests, interface fault injection, and performance tests around the gateway. Styling gets exploratory checks only. Reasoning: exposure ranks technical risk, so depth and technique follow the score, not equal coverage.
Traps
- Treating the risk matrix as a one-off workshop; reassess after design changes.
- Confusing product risk with project risk.
- Ignoring technical risks that testers cannot see from requirements alone.
- Equating severity with risk; a severe defect that cannot occur is low risk.
- Using a scale without defining what 1, 3, and 5 mean.