Schedule and risk – too many test ideas, not enough time

When people talk about testing as risk management, it is amazing how shallow the advice can be. From what we can tell, the advice is mostly “there is a risk that software will have bugs, so we test.” When we agreed to write this book, it was with a commitment to not simply list things any reasonable person could easily figure out without this book. Instead, we wanted to push back on the ideas that seem obvious yet never seem to work – we wanted to reveal counter-intuitive truths.

Let’s talk about risk management.

One way to approach risk management is to make a census of risks – that is, all the things that could happen. For each risk, you assign an impact, perhaps the dollar cost if the risk is realized, and a probability, from 0% to 100%. Multiply the two and you get a risk score. Sort by risk score and you get a sorted list of risks to track down.

Risk mitigation involves...