qa-risk

name	qa-risk
description	[QA Process · ISO 31000 + ISTQB CTFL v4.0] Risk-based test prioritization — builds a risk matrix (likelihood × impact), ranks test areas by priority, and flags critical paths for performance testing.

Helix — QA Risk-Based Prioritization

📚 Knowledge References (loaded automatically): qa-risk-patterns.md — ISO 31000 risk framework, ISTQB risk-based testing, likelihood/impact matrices

Risk-based testing ensures the highest-risk areas get the most test coverage. Fail fast on what matters most.

Step 1: Identify Risk Areas

Scan the codebase and ask:

1. What are the most business-critical features?
2. What changed most in this release?
3. What broke in previous releases?
4. What has the lowest test coverage now?
5. Any third-party integrations or external dependencies?

Step 2: Build Risk Matrix

Score each area: Likelihood (1–4) × Impact (1–4) = Risk Score

| Feature / Area        | Likelihood | Impact | Score | Priority |
|-----------------------|------------|--------|-------|----------|
| Payment processing    | 2          | 4      | 8     | 🔴 High  |
| User authentication   | 2          | 4      | 8     | 🔴 High  |
| Search / filtering    | 3          | 2      | 6     | 🟡 Med   |
| Admin dashboard       | 1          | 3      | 3     | 🟢 Low   |

Priority mapping:

• Score 8–16 → 🔴 High — test every release, include in Tier 3 performance if critical
• Score 4–7 → 🟡 Medium — test on change
• Score 1–3 → 🟢 Low — test on major releases only

Step 3: Map to Test Tiers

For each High-priority area, assign mandatory test coverage:

| Area               | Unit | Integration | E2E | Security | Load Test |
|--------------------|------|-------------|-----|----------|-----------|
| Payment processing | ✅   | ✅          | ✅  | ✅       | ✅ flag   |
| Authentication     | ✅   | ✅          | ✅  | ✅       | —         |

Flag for Tier 3 Performance: Areas with Score ≥ 8 AND high concurrent usage → add to /helix test-perf-load scope.

Step 4: Output

Save to docs/qa/qa-risk-YYYY-MM-DD.md:

• Risk matrix table
• Priority list (High → Medium → Low)
• Tier 3 performance flags
• Recommended test execution order

Done

Present risk matrix + flag list. If any Tier 3 flags exist, remind user: run /helix test-perf-load separately with flagged endpoints. Suggest next step: proceed with test execution tiers or /helix qa-explore

Self-Evaluation Loop

1. Risk matrix ครอบคลุม business-critical features ไหม?
2. Score calculation สม่ำเสมอไหม?
3. Tier 3 flags สมเหตุสมผลไหม?
4. มี area ที่ลืมไปไหม?