Risk-based testing is finding out the risk involved in the application based on application usage, the complexity of the application, criticality.

Risk can have a positive or negative impact on the success of the project and its occurrence is very uncertain. It can be the repetitive event from past or it can be the event which is likely to happen in future. These events can have an effect on many things like functionality, technicality, and cost.

As risks can be positive and negative, positive risks help the business process whereas negative risks are not good for the success of the projects and should be eliminated immediately.

Risk-based testing helps to prevent the issues which are likely to affect the application in future, so it allows the team to address the risks before the application is affected.

Risk-Based Testing Process:

1. Identifying the Risk: Testing team needs to identify functional modules which are applicable to the application. It can be done through workshops, checklists, learnings from previous projects, RCA, interviewing etc.
2. Impact to functional modules: The next step is to analyze the risk and filter them depending on the significance. This includes both qualitative and quantitative risk analysis.
3. Risk response planning: On the basis of the analysis, it can be decided that if the response is needed or not. It’s the owner’s responsibility for checking options to reduce the impact of risks.
4. Risk Monitoring: Risk monitoring and control process is used for the identification of risks, track identified risks, update risks, and monitor risk triggers. This can be done by retrospective meeting, risk audit, performance measurement

Risk and its impact:

What is impact and impact on business, this needs to be understood by everyone in the team. There are multiple factors considered while calculating risks. So basically,

Risk = Impact * Probability of failure

Impact needs to be categorized because if any functionality fails, it helps to understand the impact on business. Appropriate categorization needs to be done of the requirement by the business team. For example: If the test scripts which are categorized as high fails, the impact will be more and if the test script categorized as low fails, the impact will be less, that is why categorization is very important. So defining impact has the following benefits:

1. High-risk areas can be identified in the application.
2. Controlled risk-taking approach.
3. Reduce the scope of retesting the test scripts.
4. The severity of the defects can be identified.
5. Regression test scripts are easy to prepare

If a defect related to change was found, the following is an estimate of the overall scale of impact:

1. Critical impact – 5: When all the major and critical functionality fails. This results in loss of revenue/data.
2. High Impact – 4: in this, the customers are not affected but the issue is in the backend system
3. Medium impact – 3: To resolve this time and research is needed, again customers are not affected by this, but the change has affected the other code. Here the progress is interrupted with a large extension to project cost.
4. Moderate Impact – 2: Customers are not affected and the changes made are short-term and manageable.
5. Marginal Impact – 1: This can be spelling mistakes or minor UI issue.

Also, the probability of failure has different categories:

1. Critical -5: The likelihood of failure is too high and impact to the peripheral system is possible.
2. High-4: The likelihood of failure is high and impact on the peripheral system is also high.
3. Medium-3: The likelihood of failure is medium and impact to the peripheral system is also medium.
4. Moderate-2: The likelihood of failure is moderate and impact to the peripheral system is also moderate.
5. Marginal-1: The likelihood of failure is low and impact on the peripheral system is also low.

Risk-Based Testing Approach:

1. Understanding and analyzing requirements.
2. Reviewing documents.
3. Accessing the risk by calculating the impact of each requirement on the project.
4. Identifying high-risk areas using risk assessment matrix.
5. List of identified risks.
6. Requirement prioritization.
7. Critical risks can be considered for implementation
8. Define test according to the rating.
9. Design test scrips in a way that high-risk items retested first.
10. For low-risk test items, different test design techniques can be used like equivalence partitioning.
11. Reviewing test plan and test scenarios created by the testing team.
12. Peer review for defect identification.
13. Execution of test cases according to the priority of risk.
14. Evaluating exit criteria
15. Defect analysis and defect prevention to eliminate the defects.
16. Regression and retest to validate defect fixes.
17. Risk control and monitoring.
18. Risk reassessment and customer feedback.

Advantages of Risk-Based Testing:

1. The higher priority areas are tested first which leads to improved quality of the end product. So with the risk-based testing tests can be prioritized against deadlines.
2. Testing becomes more organized.
3. Improved customer satisfaction.
4. Risk areas can be discovered early so that preventive measures can be taken when required.
5. This is a cost reduction method.

Disadvantages of Risk-Based Testing:

1. If some risks are assessed too low or if there are any unrecognized risks, this can cause a problem if it becomes reality.

Risk-Based Testing Process:

1. Identifying Risk: Consulting Business and Technical teams and preparing list of risks
2. Analyzing Risk: Discussing risks and assigning them a probability.
3. Risk Response: Documenting dependencies and assigning test effectiveness score
4. Test Scoping: This is reviewing the scope of risks to be addressed by testing
5. Test Process Definition: Drafting the test process.

Summary:

1. Test scripts are executed according to risk priority order.
2. Organized testing efforts and level of priority of each risk item are rated.
3. This testing is most efficient way of projects based on risks.
4. Helps to identify the positive or negative impact
5. Helps preventive the issues which are likely to happen in future.