Risk-based testing without the dead spreadsheet

"Where's your risk-based test plan?"

It's the spreadsheet. The one with fourteen tabs, colour-coded, last opened at the project kickoff and untouched since.

Over my years as a consultant I have watched risk-based testing curdle into exactly this: a document so thorough nobody reads it, updated once, then abandoned the moment the sprint got real. We confused doing the paperwork with doing the thinking.

James Bach has said for decades, in his heuristic approach to risk-based testing, that risk is a way of deciding where to point your attention. It is not an artefact to maintain. The moment the register becomes the deliverable, you've lost the plot. You're now testing the spreadsheet.

A risk register nobody updates is the fire evacuation map laminated to the office wall: reassuring, official, and irrelevant the second there is smoke.

Here is how to do it without the spreadsheet swallowing the work:

• Ask two questions out loud, with the team: what could go wrong here, and how badly would it hurt? That conversation is the artefact. Write down the answers, not a taxonomy.
• Rank by exposure, not by how nervous something makes you. The scary-looking feature is not always the risky one. The boring little payments change usually is.
• Re-rank constantly. Last sprint's top risk is this sprint's regression test.
• Keep it on a single page. If it does not fit on a postcard, it is fear with a header row, not a strategy.
• Let testers follow the smell. The sharpest risk insight rarely comes from the matrix. It comes from someone who has been poking at the thing all afternoon.

Risk-based testing is a conversation you keep having.

See how your own suite measures up: a QA Review scores your test coverage, tooling and process in one to two weeks.