Lesson 5 of 5
Residual risk and sign-off
10 min
Listen to this lesson
No test campaign removes all risk. What is left when testing stops is the residual risk, and it is the honest basis for a sign-off decision. A sign-off that says "all tests passed" hides it; a sign-off that says "these risks are fully mitigated, these are partly mitigated with these workarounds, and these were accepted by these owners" makes it visible and owned.
Keeping the register alive during execution
The risk register you published after the workshop changes every day of test execution. Update it at least weekly, and daily in the final week. For each risk, track:
| Field | What it holds | Contoso example (R-07, billing revenue account) |
|---|---|---|
| Risk ID and statement | The "may ... resulting in ..." sentence | Billing for 1710 / 10 / 00 may determine the wrong revenue account, resulting in misstated revenue |
| Score | Impact × likelihood, with the date last re-scored | High (3 × 3), re-scored after the late change |
| Linked tests | Test case IDs and how many have run and passed | 14 planned, 14 run, 13 passed |
| Open defects | Defect IDs with severity and status | One medium defect: credit memo posts to the domestic account |
| Mitigation status | Mitigated, partly mitigated, not mitigated | Partly mitigated |
| Workaround / contingency | What the business will do if the risk occurs | Finance reviews credit memo postings daily for the first month |
| Owner and acceptance | Who accepts the remaining risk, and when | Dan, accepted in writing on the sign-off date |
A risk register row. The register is the bridge between test results and the sign-off decision.
Re-score when facts change. A defect cluster in an area raises likelihood. A late transport raises it again. A clean, thorough run of high-depth tests lowers the residual likelihood. Each change should have a date and a reason.
- WorkshopScored high (3 × 3)Billing revenue account risk agreed with Dan
- Before cycle 1Re-scored after late changeLikelihood confirmed high; tests moved to week 1
- Execution14 run, 13 passedCredit memos for export customers post to the domestic account
- Sign-offPartly mitigatedDan accepts in writing with a daily review workaround
- Release R3Fix deliveredAcceptance expires; risk retested and closed
Presenting residual risk
At sign-off, present risks, not just test counts. A useful summary groups the high and medium risks into three bands: mitigated (covered by passed tests at the planned depth, no open defects), partly mitigated (tests passed with open defects that have workarounds, or coverage below plan), and not mitigated (tests not run or failing without a workaround). Low risks can be summarized in one line.
- Were all linked tests run at the planned depth?Yes → check defects · No → partly or not mitigated; state what was not run and why
- Are there open defects against this risk?No → mitigated · Yes → check workaround
- Does every open defect have an agreed workaround and owner?Yes → partly mitigated; owner accepts the residual risk · No → not mitigated; a go-live condition or blocker
Risk acceptance
Accepting a risk is a business decision, made by the owner of the consequence, not by the test lead. The test lead's job is to make the residual risk clear and the decision traceable. Record each acceptance with the risk ID, the owner's name, the date, the conditions (such as a workaround or extra monitoring after go-live) and any expiry, for example "accepted until the fix in release R3". In a regulated or audited environment, this record is often what auditors ask for first.
What would you do?
It is the day before Contoso's R2 sign-off. All high risks are mitigated except R-07 (billing revenue account): one medium defect remains, credit memos post to the domestic revenue account for export customers. The fix will not be ready until R3. Dan asks Priya what she recommends. What is the best response?
Closing the loop after go-live
Residual risk does not disappear at go-live. Hand the partly mitigated and accepted risks to the hypercare or support team with the agreed monitoring: for R-07, a daily check of export credit memo postings in company code 1710. When incidents arrive after go-live, compare them with the register. An incident in an area scored low is a signal that the inputs or the scales need adjusting; an incident in an accepted risk shows whether the workaround held. Both feed the next release's assessment and make it sharper.
- Hand overAccepted risks and monitoring go to hypercare
- MonitorDaily check of export credit memo postings in company code 1710
- Compare incidentsMatch each incident to the register
- AdjustLow-scored area hit? Fix inputs or scales. Accepted risk hit? Check the workaround
- Next releaseSharper assessment for R3
- Residual risk is what remains after testing; it is the honest basis for sign-off.
- Update the register through execution: scores, linked tests, defects, mitigation status, workarounds, owners.
- Present high and medium risks as mitigated, partly mitigated or not mitigated.
- Risk acceptance is a business owner's decision; record who, when, conditions and expiry.
Check your understanding · not graded
Lesson check
1. What is residual risk?
2. Who should accept a residual product risk?
3. A risk's tests all passed, but one open defect has an agreed workaround. Which status fits?
4. Why is reporting only an overall pass rate risky?