7.2The Risk Equation

Risk = Probability of failure x Impact of failure.

Every feature area in your application carries a different level of risk. A payment processing module that handles real money and has been recently modified carries far more risk than a static FAQ page that has not changed in six months.

Risk Assessment Matrix

Feature Area	Likelihood of Defects	Business Impact	Risk Level	Test Depth
Payment processing	Medium	Critical	High	Full regression, edge cases, security
User profile editing	Low	Low	Low	Happy path, one negative case
New third-party integration	High	High	Critical	Exhaustive: positive, negative, timeout, auth failure
Static FAQ page	Very low	Very low	Minimal	Smoke test only
Search functionality	Medium	Medium	Medium	Core scenarios, performance spot check
Admin user management	Low	High	High	CRUD operations, permission boundaries, audit logging

Factors That Increase Likelihood

• Recently modified code: New or changed code has more bugs than stable code
• Complex business logic: Multi-condition rules have more edge cases
• Third-party dependencies: External APIs, payment gateways, auth providers
• First-time implementation: The team has never built this type of feature before
• Technical debt: Areas with known code quality issues
• Concurrency: Features that handle parallel requests or shared state

Factors That Increase Impact

• Revenue-generating flows: Checkout, subscription, payment
• User data: Registration, profile management, data export
• Security boundaries: Authentication, authorization, data access controls
• Compliance features: GDPR deletion, audit logging, data retention
• Public-facing features: Anything visible to non-authenticated users
• Downstream dependencies: Features consumed by other services or partners