基於風險的測試方法（RBT）

基於風險的測試是根據影響的大小和失敗的可能性，對被測應用程式的特性、模組和功能進行優先順序排序。它涉及基於複雜性、業務關鍵性、使用頻率、可見區域、缺陷易發區域等來評估風險。

風險是對專案的可測量的成功標準有積極或消極影響的不確定事件的發生。可能是過去發生的事件，也可能是現在的事件，或者是將來可能發生的事情。

這些不確定事件會對專案的成本、業務、技術和質量目標產生影響。

風險可以是積極的，也可以是消極的。

積極的風險被稱為機會和幫助商業可持續性。比如投資一個新專案，改變業務流程，開發新產品。

負面風險被稱作威脅和建議，為了專案成功，必須實現最小化或消除這些威脅和建議。

RBT可以適用於以下場景：

• 專案有時間、資源、預算限制等。
• 基於風險分析的專案可以用來檢測SQL注入攻擊的漏洞。
• 雲端計算環境中的安全測試。
• 具有高風險因素的新專案，如缺乏使用技術的經驗、缺乏業務領域知識。
• 增量模型和迭代模型等。

基於風險的測試（RBT）方法

1. Analyze the requirements.
2. Documents (SRS, FRS, Usecases) are reviewed. This activity is done to find and eliminate errors & ambiguities.
3. Requirements sign-off's is one of the risk-reduction technique for avoiding the introduction of late changes into the projects. Any changes to requirements after the document are baselined would involve a change control process and subsequent approvals.
4. Assess the risks by calculating the likelihood and impact each requirement could have on the project taking the defined criteria's like cost, schedule, resources, scope, technical performance safety, reliability, complexity, etc. into consideration.
5. Identify the probability of failure and high-risk areas. This can be done using risk assessment matrix.
6. Use a risk register to list the set of identified risks. Update, monitor and track the risks periodically at regular intervals.
7. Risk profiling needs to be done at this stage to understand the risk capacity and risk tolerance levels.
8. Prioritize the requirements based on the rating.
9. Risk-based test process is defined
10. Highly critical and medium risks can be considered for mitigation planning, implementation, progress monitoring. Low risks can be considered on a watch list.
11. Risk data quality assessment is done to analyze the quality of the data.
12. Plan and define test according to the rating
13. Apply appropriate testing approach and test design techniques to design the test cases in a way that the highest risks items are tested first. High-risk items can be tested by the resource with good domain knowledge experience.
14. Different test design techniques can be used for e.g. using the decision table technique on high-risk test items and using 'only' equivalence partitioning for low-risk test items.
15. Test cases are also designed to cover multiple functionalities and end to end business scenarios.
16. Prepare test data and test conditions and test bed.
17. Review the Test plans, Test Strategy, Test cases, Test reports or any other document created by the testing team.
18. Peer review is an important step in defect identification and risk reduction.
19. Perform dry runs and quality checks on the results
20. Test cases are executed according to the priority of the risk item.
21. Maintain traceability between risk items, tests that cover them, results of those tests, and defects found during testing. All testing strategies executed properly will reduce quality risks.
22. Risk-based testing can be used at every level of testing, e.g. component, integration, system, and acceptance testing
23. At the system level, we need to focus on what is most important in the application. This can be determined by looking at the visibility of functions, at frequency of use and at the possible cost of failure.
24. Evaluation of exit criteria. All high-risk areas fully tested, with only minor residual risks left outstanding.
25. Risk-based Test Results reporting and metrics analysis.
26. Reassess existing risk events and new risk events based on Key Risk Indicators.
27. Risk register updation.
28. Contingency plans- This works as a fallback plan/emergency plans for the high exposure risks.
29. Defect analysis and defect prevention to eliminate the defects.
30. Retesting and Regression testing to validate the defect fixes based on pre-calculated risk analysis and

    high-risk areas should be most intensively covered.

31. Risk-based automation testing(if feasible)
32. Residual Risk calculation
33. Risk Monitoring and Control
34. Exit Criteria or completion criteria can be used for different risk levels. All key risks have been addressed with appropriate actions or contingency plans. Risk exposure is at or below the level agreed to as acceptable for the project.
35. Risk profiling reassessment and customer feedback.