risk-based-testing

When to Use

• Planning sprint/release test strategy
• Deciding what to automate first
• Allocating limited testing time
• Justifying test coverage decisions

Risk Calculation

```

Risk Score = Probability (1-5) × Impact (1-5)

```

| Score | Priority | Effort | Action |

|-------|----------|--------|--------|

| 20-25 | Critical | 60% | Comprehensive testing, multiple techniques |

| 12-19 | High | 25% | Thorough testing, automation priority |

| 6-11 | Medium | 10% | Standard testing, basic automation |

| 1-5 | Low | 5% | Smoke test, exploratory only |

Probability Factors

| Factor | Low (1) | Medium (3) | High (5) |

|--------|---------|------------|----------|

| Complexity | Simple CRUD | Business logic | Algorithms, integrations |

| Change Rate | Stable 6+ months | Monthly changes | Weekly/daily changes |

| Developer Experience | Senior, domain expert | Mid-level | Junior, new to codebase |

| Technical Debt | Clean code | Some debt | Legacy, no tests |

Impact Factors

| Factor | Low (1) | Medium (3) | High (5) |

|--------|---------|------------|----------|

| Users Affected | Admin only | Department | All users |

| Revenue | None | Indirect | Direct (checkout) |

| Safety | Convenience | Data loss | Physical harm |

| Reputation | Internal | Industry | Public scandal |

---

Step 1: List Features/Components

```

Feature | Probability | Impact | Risk | Priority

--------|-------------|--------|------|----------

Checkout | 4 | 5 | 20 | Critical

User Auth | 3 | 5 | 15 | High

Admin Panel | 2 | 2 | 4 | Low

Search | 3 | 3 | 9 | Medium

```

Step 2: Apply Test Depth

```typescript

await Task("Risk-Based Test Generation", {

critical: {

features: ['checkout', 'payment'],

depth: 'comprehensive',

techniques: ['unit', 'integration', 'e2e', 'performance', 'security']

},

high: {

features: ['auth', 'user-profile'],

depth: 'thorough',

techniques: ['unit', 'integration', 'e2e']

},

medium: {

features: ['search', 'notifications'],

depth: 'standard',

techniques: ['unit', 'integration']

},

low: {

features: ['admin-panel', 'settings'],

depth: 'smoke',

techniques: ['smoke-tests']

}

}, "qe-test-generator");

```

Step 3: Reassess Dynamically

```typescript

// Production incident increases risk

await Task("Update Risk Score", {

feature: 'search',

event: 'production-incident',

previousRisk: 9,

newProbability: 5, // Increased due to incident

newRisk: 15 // Now HIGH priority

}, "qe-regression-risk-analyzer");

```

---

```typescript

// Agent predicts risk using historical data

const riskAnalysis = await Task("ML Risk Analysis", {

codeChanges: changedFiles,

historicalBugs: bugDatabase,

prediction: {

model: 'gradient-boosting',

factors: ['complexity', 'change-frequency', 'author-experience', 'file-age']

}

}, "qe-regression-risk-analyzer");

// Output: 95% accuracy risk prediction per file

```

---

Memory Namespace

```

aqe/risk-based/

├── risk-scores/* - Current risk assessments

├── historical-bugs/* - Bug patterns by area

├── production-data/* - Incident data for risk

└── coverage-map/* - Test depth by risk level

```

Fleet Coordination

```typescript

const riskFleet = await FleetManager.coordinate({

strategy: 'risk-based-testing',

agents: [

'qe-regression-risk-analyzer', // Risk scoring

'qe-test-generator', // Risk-appropriate tests

'qe-production-intelligence', // Production feedback

'qe-quality-gate' // Risk-based gates

],

topology: 'sequential'

});

```

---

```yaml

# Risk-based test selection in pipeline

• name: Risk Analysis

run: aqe risk-analyze --changes ${{ github.event.pull_request.files }}

• name: Run Critical Tests

if: risk.critical > 0

run: npm run test:critical

• name: Run High Tests

if: risk.high > 0

run: npm run test:high

• name: Skip Low Risk

if: risk.low_only

run: npm run test:smoke

```

---

• [agentic-quality-engineering](../agentic-quality-engineering/) - Risk-aware agents
• [context-driven-testing](../context-driven-testing/) - Context affects risk
• [regression-testing](../regression-testing/) - Risk-based regression selection
• [shift-right-testing](../shift-right-testing/) - Production informs risk

---

Risk = Probability × Impact. Test where bugs hurt most. Critical gets 60%, low gets 5%. Risk is dynamic - reassess with new info. Production incidents raise risk scores.

With Agents: Agents calculate risk using ML on historical data, select risk-appropriate tests, and adjust scores from production feedback. Use agents to maintain dynamic risk profiles at scale.