The difference
Severity describes the impact of a defect on the system, business process, user, data, security, or operations.
Priority describes how urgently the organization intends to address it.
Severity is mainly about impact. Priority is mainly about action urgency.
Example severity model
| Severity | Example interpretation |
|---|---|
| Critical | System unavailable, major security exposure, irreversible data loss, or critical process blocked without workaround. |
| High | Major function fails or severe degradation with limited workaround. |
| Medium | Function affected but business can continue with acceptable workaround. |
| Low | Minor usability, visual, wording, or low-impact issue. |
Why priority can differ
High severity, lower priority
A serious defect exists in a feature that will not be enabled until a later release.
Low severity, high priority
A visible spelling error is on the public home page immediately before a major campaign launch.
Who decides?
QA should assess and articulate impact, but priority is often a cross-functional decision involving product, engineering, business, release leadership, and sometimes operations or security.
Factors for triage
- Business impact
- User reach
- Data impact
- Security/privacy impact
- Workaround
- Reproducibility
- Release timing
- Fix risk