Risk should drive quality investment
Quality resources are finite. Risk-based quality management directs more attention to changes where failure would matter most.
Simple model: Risk ≈ impact × likelihood, adjusted for detectability and uncertainty where useful.
Common risk factors
- Business criticality
- Customer impact
- Financial impact
- Security/privacy
- Data impact
- Complexity
- Integration count
- Change size
- Historical defects
- Operational fragility
Use risk to shape testing
| Risk level | Possible response |
|---|---|
| High | Formal strategy, deep regression, NFRs, strong evidence, leadership review |
| Medium | Risk-based functional/integration coverage, targeted automation |
| Low | Lightweight validation and team-level approval |
Track residual risk
After testing and controls, some uncertainty remains. Release decisions should make that residual risk explicit.
Escalate risk, not opinions
QA leaders are more effective when they frame concerns as observable impact, evidence gaps, and decision consequences rather than personal disagreement.