6.4Who Decides?

Severity: QA Assesses

Severity is a factual observation about the bug's technical impact. The QA engineer who found and reproduced the bug is best positioned to assess it.

When assessing severity, ask:

• Does the bug crash the application or corrupt data? (Critical)
• Does it prevent a user from completing a core workflow? (High)
• Does it degrade functionality but allow workarounds? (Medium)
• Is it cosmetic or affects only edge cases? (Low)

Priority: Product/Engineering Management Decides

Priority is a business decision that considers factors beyond the bug itself:

• How many users are affected?
• Is there a regulatory deadline?
• Is there a major customer affected?
• Is a marketing campaign depending on this feature?
• What is the opportunity cost of fixing this now vs later?

When QA and Management Disagree

Sometimes QA rates a bug as Critical severity, but the product owner sets priority to P2. This happens when:

• The bug is severe but affects very few users
• The team has higher-priority work (launch deadline)
• A workaround exists that mitigates the impact

This is normal. QA's job is to accurately report severity. Management's job is to prioritize the backlog. QA should advocate for the fix but respect the prioritization decision — unless it involves data loss, security, or compliance, in which case escalate.