QA TEMPLATE / SAMPLE

01 Quality Risk Assessment

Risk assessment | Impact, unknowns and test depth

Synthetic Order Book teaching scenario, not a real exchange test. Based on this site's stale-sequence Fail Demo. Prices, quantities and times are supplemental teaching assumptions. Runs, defects and evidence names are synthetic; there was no real product execution, attached evidence or customer approval.

What this document answers

01 Risk Assessment identifies failure impact and required test depth before selecting cases. Coverage values 0, 1, 1+, 2, 2+, 3 represent test depth, not a code-coverage percentage.

Blank template

[Required] applies to every case. [Conditional] is required when applicable; explain when it is not. Copy the text into your case documents and replace the brackets. This static page has no editing or saving function.

[Required] Assessment ID / version, subject, QA owner, reviewer / time: [ ]
[Required] Repository / release / branch / candidate full SHA, risk tier: [ ]
[Required] Risk register: Risk ID | Product Area | risk statement | failure mode / trigger | user / asset | Impact | Likelihood / uncertainty | Detectability | Recoverability | existing control and evidence | Target coverage | test response | Owner | Residual risk | acceptance owner | review date
[Required] Unknowns / assumptions: ID | type | statement | decision impact | owner | due date | disposition
[Conditional] Triggers: complex / sensitive data, cross-service / permission dependencies, security / privacy, accessibility / compatibility, migration / production change; applicability yes / no / unknown, required supplement, owner / link
[Required] Review: critical areas have target coverage, untreated risks have dispositions, independent review needed, approved / changes-required / blocked, notes
[Required] Trace: Requirement / version ↔ Risk ↔ Scenario / version ↔ Case / version ↔ Run / Defect; gap / owner / resume conditions
Do not turn Unknown into Low. Keep Severity, case Priority and risk ranking separate. Do not maintain a second Pass / Fail record here.

Filled example: stale market data overwrites current state

RISK-OB-SEQ / DEMO-RISK-ASSESSMENT v1.3

Source: DEMO-REQUEST-MDQ; subject DEMO-BOOK / build-demo-1, real version and risk tier Unknown; QA owner DEMO-QA, no human reviewer or review time.

Assessment dimension	Synthetic example
Failure / impact	After reaching 104, accepting old event 103 regresses the Order Book and may affect downstream market-data decisions. High impact is a teaching recommendation; no real probability or loss evidence exists.
Likelihood / detectability / recovery	Likelihood Unknown. Retained events and before / after snapshots make the synthetic failure detectable; real monitoring capability is Unknown. A reconnect snapshot is a candidate recovery path, with no verified real recovery guarantee.
Controls / target	Required controls reject stale events and fully restore state after reconnect. Only synthetic examples exist. Proposed teaching target coverage=2 requires review; actual depth is not claimed.
Test response	TC-MDQ-017 checks stale-event rejection; 016 protects normal updates; 018 checks reconnect. All three reference DEMO-DC-MDQ v1.0.
Residual risk / acceptance	Equal sequences, gaps, reordering and real load are excluded. DEMO-QA tracks the gaps; acceptance owner and review date are pending. There is no approved risk acceptance.
Unknowns / triggers	DEMO-Q-SEQ affects the oracle, data and regression scope. The product / integration owner has not answered; no due date is set. The teaching fixture has no sensitive data or production change. All five trigger categories are Unknown for a real engagement and must be checked before selecting supplements.
Review / handoff	The real scope remains blocked. Critical-area targets and untreated-risk dispositions need review; independent-review requirements are pending. Revisit the oracle for changed interpretations and the risk assessment for new failure modes; follow the recovery rules and append required Runs.

Traceability and classification

DEMO-REQ-STALE ↔ RISK-OB-SEQ ↔ DEMO-SC-BOOK ↔ TC-MDQ-017 v1.2 ↔ DEMO-RUN-FAIL-001 ↔ DEF-MDQ-004. See the detailed matrix in Test Spec.

This assessment records risk and depth recommendations. Case P0 sets execution order; defect S1 recommends a severity for an observed impact. These are not mechanically interchangeable. Risk acceptance cannot replace critical-path evidence.