Skip to main content

Of What? To Who? When?

Fiona Charles ran a workshop on business risk analysis for my team at Linguamatics last week. Across the day we covered risk-based testing, how it can help with prioritisation, and how it is often overlooked as a factor in test design.

We also looked at how the presentation of risks and their potential impact to someone who matters can be a way to engage stakeholders in the testing effort. Hopefully, this would in turn encourage contribution to activities such as test idea generation, triage, and attempts to mitigate risk elsewhere during design and development.
Stakeholders often expect a level of testing we can't deliver. (Fiona Charles)
The approach to risk assessment that Fiona outlined has some similarity to a pre-mortem. Essentially: assume the system has been implemented then look for ways in which it could go wrong. It's important to understand who the relevant stakeholders are — they are more than just your users — and to solicit diverse perspectives in your analysis to represent them.
Orient your questions to business impact and seek concrete answers. (Fiona Charles)
A mind map of checklists provided triggers for evaluating each risk, who was at risk, the potential impact, under what conditions, for how long, how often, and other factors. We wondered as a group about attempting to calculate the probability of a particular risk but Fiona warned us about getting too formal.
Use qualitative evaluation over numeric. (Fiona Charles)
The conversation around this reminded me that there's a human tendency to forget about black swans in risk assessment, to miss those events that are extreme in both scarcity and size of effect. Related, we talked about the difficulty of constraining this kind of analysis, or directing it into productive avenues such as surfacing the "unknown unknowns". There was overlap here with the useful distinction between risk and uncertainty.

It was interesting to me that the group I was in initially tried to drive risk identification with the mind map. While it certainly had value as a mnemonic, something like Kipling's Serving Men, we found that it made for a very messy map.

Better, we eventually thought, to generate the risks and then place them as the central node of their own map, each map showing which factors were relevant to them. We didn't get chance to try it, but some kind of small multiples view of risk might be interesting in the aggregate.

In this made-up example above, nine risks (the shaded blue central nodes) are being assessed for each of six factors (the clear nodes, in particular top-left represents stakeholders and bottom-right represents impacts). Arranging the analysis this way suggests a potential correlation of yellow and pink stakeholders to red and green outcomes which might be useful to dig into, or perhaps to form equivalence classes in testing.

For around half of the day we tried to apply the method to a hypothetical project set inside our own company with some of our business stakeholders playing themselves. I wrote the scenario to be realistic but, with hindsight, I think there was too much scope to find stakeholder disagreement about scope and we tended to pursue that rather than the wider risk landscape.

This is unsurprising given that it's our day job to find those risks, the risks are easily uncovered and have immediate impact, and there was time pressure. While not the key point of the workshop, it was still valuable be reminded that we should step back and think more carefully about other kinds of risk to other kinds of stakeholders.

I've written before about how I hold myself to high standards on the training I organise for the team. In particular, as a participant, I want to be open to learning at the start, I want to engage and contribute while I'm there, and I want to take something directly into my own practice afterwards. I think I achieved those things and, on this occasion, my intention is to more frequently enumerate who a risk is to, what the potential effects are, and under what circumstances.


  1. To a tester, "What could possibly go wrong?" isn't just a rhetorical question.

    Having said that, I've just been reading (and frankly, struggling with) Daniel Kahneman's 'Thinking, Fast and Slow'. One of the things I **have** taken away from the book is properly evaluating the impact on risk analysis of unusual events. Kahneman suggests that we are likely to over-emphasise the importance of unusual events, seeing them as more frequent than they actually are because they have happened to us.

    So (broadly speaking), I feel that risk analysis needs a wide range of inputs so that individual viewpoints - which may be biased - can be seen in more appropriate proportions.


Post a Comment

Popular posts from this blog

Notes on Testing Notes

Ben Dowen pinged me and others on Twitter last week , asking for "a nice concise resource to link to for a blog post - about taking good Testing notes." I didn't have one so I thought I'd write a few words on how I'm doing it at the moment for my work at Ada Health, alongside Ben. You may have read previously that I use a script to upload Markdown-based text files to Confluence . Here's the template that I start from: # Date + Title # Mission # Summary WIP! # Notes Then I fill out what I plan to do. The Mission can be as high or low level as I want it to be. Sometimes, if deeper context might be valuable I'll add a Background subsection to it. I don't fill in the Summary section until the end. It's a high-level overview of what I did, what I found, risks identified, value provided, and so on. Between the Mission and Summary I hope that a reader can see what I initially intended and what actually

Why Do They Test Software?

My friend Rachel Kibler asked me the other day "do you have a blog post about why we test software?" and I was surprised to find that, despite having touched on the topic many times, I haven't. So then I thought I'd write one. And then I thought it might be fun to crowdsource so I asked in the Association for Software Testing member's Slack, on LinkedIn , and on Twitter for reasons, one sentence each. And it was fun!  Here are the varied answers, a couple lightly edited, with thanks to everyone who contributed. Edit: I did a bit of analysis of the responses in Reasons to be Cheerful, Part 2 . --00-- Software is complicated, and the people that use it are even worse. — Andy Hird Because there is what software does, what people say it does, and what other people want it to do, and those are often not the same. — Andy Hird Because someone asked/told us to — Lee Hawkins To learn, and identify risks — Louise Perold sometimes: reducing the risk of harming people —

Enjoy Testing

  The testers at work had a lean coffee session this week. One of the questions was  "I like testing best because ..." I said that I find the combination of technical, intellectual, and social challenges endlessly enjoyable, fascinating, and stimulating. That's easy to say, and it sounds good too, but today I wondered whether my work actually reflects it. So I made a list of some of the things I did in the last working week: investigating a production problem and pairing to file an incident report finding problems in the incident reporting process feeding back in various ways to various people about the reporting process facilitating a cross-team retrospective on the Kubernetes issue that affected my team's service participating in several lengthy calibration workshops as my team merges with another trying to walk a line between presenting my perspective on things I find important and over-contributing providing feedback and advice on the process identifying a

Testing is Knowledge Work

  The Association for Software Testing is crowd-sourcing a book, Navigating the World as a Context-Driven Tester , which aims to provide responses to common questions and statements about testing from a context-driven perspective . It's being edited by Lee Hawkins who is posing questions on Twitter ,  LinkedIn ,  Slack , and the AST mailing list and then collating the replies, focusing on practice over theory. I've decided to contribute by answering briefly, and without a lot of editing or crafting, by imagining that I'm speaking to someone in software development who's acting in good faith, cares about their work and mine, but doesn't have much visibility of what testing can be. Perhaps you'd like to join me?   --00-- "We need some productivity metrics from testers" OK. I'd like to help you meet your need if I can but to do that I'll need to ask a few questions. Let's start with these: Who needs the metrics? Is there a particular pr

Risk-Based Testing Averse

  Joep Schuurkes started a thread on Twitter last week. What are the alternatives to risk-based testing? I listed a few activities that I thought we might agree were testing but not explicitly driven by a risk evaluation (with a light edit to take later discussion into account): Directed. Someone asks for something to be explored. Unthinking. Run the same scripted test cases we always do, regardless of the context. Sympathetic. Looking at something to understand it, before thinking about risks explicitly. In the thread , Stu Crook challenged these, suggesting that there must be some concern behind the activities. To Stu, the writing's on the wall for risk-based testing as a term because ... Everything is risk based, the question is, what risks are you going to optimise for? And I see this perspective but it reminds me that, as so often, there is a granularity tax in c

Agile Testing Questioned

Zenzi Ali has been running a book club on the Association for Software Testing Slack and over the last few weeks we've read Agile Testing Condensed by Janet Gregory and Lisa Crispin. Each chapter was taken as a jumping off point for one or two discussion points and I really enjoyed the opportunity to think about the questions Zenzi posed and sometimes pop a question or two back into the conversation as well. This post reproduces the questions and my answers, lightly edited for formatting. --00-- Ten principles of agile testing are given in the book. Do you think there is a foundational principle that the others must be built upon? In your experience, do you find that some of these principles are less or more important than others?  The text says they are for a team wanting to deliver the highest-quality product they can. If we can regard a motivation as a foundational principle, perhaps that could be it: each of the ten pr

The Great Post Office Scandal

  The Great Post Office Scandal by Nick Wallis is a depressing, dispiriting, and disheartening read. For anyone that cares about fairness and ethics in the relationship that business and technology has with individuals and wider society, at least. As a software tester working in the healthcare sector who has signed up to the ACM code of ethics through my membership of the Association for Software Testing I put myself firmly in that camp. Wallis does extraordinarily well to weave a compelling and readable narrative out of a years-long story with a large and constantly-changing cast and depth across subjects ranging from the intensely personal to extremely technical, and through procedure, jurisprudence, politics, and corporate governance. I won't try to summarise that story here (although Wikipedia takes a couple of stabs at it ) but I'll pull out a handful of threads that I think testers might be interested in: The unbelievable naivety which lead to Horizon (the system at th

Testing and Semantics

The other day I got tagged on a Twitter thread started by Wicked Witch of the Test about people with a background in linguistics who’ve ended up in testing. That prompted me to think about the language concepts I've found valuable in my day job, then I started listing them, and then realised how many of them I've mentioned here over the years .   This post is one of an occasional series collecting some of those thoughts.  --00-- In this series so far we've looked at words and syntax. In both cases we've found that natural language is an imprecise medium for communication. We might know the same words and grammar as others ... but they will have their own idea about what they mean ... and even where we agree there is ambguity ... and all of us, the world, and the language are evolving ... all the time. Today we'll add semantics which, in a pleasing twist, is itself ambiguo

Leaps and Boundary Objects

Brian Marick  recently launched a new podcast, Oddly Influenced . I said this about it on Twitter: Boundary Objects, the first episode of @marick's podcast, is thought-provoking and densely-packed with some lovely turns of phrase. I played it twice in a row. Very roughly, boundary objects are things or concepts that help different interest groups to collaborate by being ambiguous enough to be meaningful and motivational to all parties. Wikipedia  elaborates, somewhat formally:  [boundary objects are] both plastic enough to adapt to local needs and constraints of the several parties employing them, yet robust enough to maintain a common identity across sites ... The creation and management of boundary objects is key in developing and maintaining coherence across intersecting social worlds. The podcast talks about boundary objects in general and then applies the idea to software development specifically, casting acceptance test

Personal Development

The other day I got tagged on a Twitter conversation between a couple of my colleagues, Ben Dowen and Dan Ashby , which ended with Ben citing me as an example: But there is a trap, in that a Dev who Tests, or Tester who codes both risk becoming Test Automators ... The counter argument is Testers who code can do as @qahiccupps does, and use and build tools to explore. A jumble of thoughts tumbled out as I read it and here they are, in no particular order. It is flattering to be mentioned but I'm far from the only person doing this. Maaret Pyhäjärvi   and Rob Sabourin are vocal about the value it can bring and go out of their way to tell and teach others how to get it. Ben is right when he says I use coding as a tool, and as a tool factory. It's a means to an end. Coding itself doesn't give me a lot of pleasure. Having created a useful thing gives me an enormous amount of pleasure. I am not a great developer. But then I rarely need to be.   Yes, I have made bug fixes that