A Process for Risk-Based Test Strategy Development and Its Industrial Evaluation

Abstract

Risk-based testing has a high potential to improve the software test process as it helps to optimize the allocation of resources and provides decision support for the management. But for many organizations the integration of risk-based testing into an existing test process is a challenging task. An essential first step when introducing risk-based testing in an organization is to establish a risk-based test strategy which considers risks as the guiding factor to support all testing activities in the entire software lifecycle. In this paper we address this issue by defining a process for risk-based test strategy development and refinement. The process has been created as part of a research transfer project on risk-based testing that provided the opportunity to get direct feedback from industry and to evaluate the ease of use, usefulness and representativeness of each process step together with five software development companies. The findings are that the process is perceived as useful and moderately easy to use, i.e., some steps involve noticeable effort. For example, the effort for impact estimation is considered high, whereas steps that can be based on existing information are perceived as easy, e.g., deriving probability estimates from established defect classifications. The practical application of the process in real-world settings supports the representativeness of the outcome.