The short answer
What matters most
Plan software testing around the consequences of failure in important user journeys. Define environments, test data, role permissions, specialist coverage, and release criteria. The final report should explain passed, failed, blocked, and untested work so an accountable owner can make the release decision with the remaining risks visible.
- Test the complete outcome, including records and background actions.
- Automate repeatable checks while retaining exploratory testing.
- Make untested areas and release-blocking defects explicit.
Compare before you commit
Decision at a glance
| Coverage | Question it answers | Evidence to retain |
|---|---|---|
| Functional and regression | Does the expected workflow still work? | Repeatable steps, expected outcomes, and results |
| Role and access checks | Can someone read or change restricted data? | Authorized and unauthorized access attempts |
| Performance | Does the system meet an agreed workload? | Workload, environment, measurements, and limitations |
| Accessibility and usability | Can intended users complete important tasks? | Defined scope, methods, findings, and follow-up |
| Release readiness | What is known and what remains uncertain? | Defects, blocked tests, acceptance owner, and recovery plan |
What must be clear before testing starts?
Agree what is changing, who could be affected, and who can approve release. Then arrange a usable environment, representative data, and test accounts for each role. If those prerequisites are missing, an early QA discussion can identify the blockers before a release date is treated as fixed.
Discuss your QA scopeMap the risks to real user journeys
List the workflows that must work for the release to be useful. For each, describe who uses it, what data changes, which systems it depends on, and what happens if it fails. Prioritize by the consequence of failure and the likelihood of change, rather than trying to give every screen identical coverage.
Include the less visible steps: permissions, exports, notifications, background jobs, and recovery after an interrupted request. A checkout or approval flow can appear successful in the interface while leaving the underlying records inconsistent. Testing should follow the complete outcome.
Agree on environments and test data
Define which environment represents the release, which integrations are available, and where simulated services are necessary. Document differences from production so a passing result is not interpreted more broadly than it should be. Assign owners for unavailable systems or blocked accounts.
Use approved test data that includes ordinary and exceptional cases without exposing unnecessary personal information. Prepare accounts for the relevant roles. If a test depends on a particular record or sequence, make it repeatable so developers and testers can reproduce a reported problem.
Balance manual and automated checks
Automate stable, repeatable checks that provide useful feedback often enough to justify maintenance. Critical regression paths and predictable API behavior are common candidates. Use exploratory testing for unfamiliar workflows, usability problems, and scenarios that require human judgment.
Do not treat the number of automated tests as the goal. A fragile suite can create noise while leaving important risks uncovered. Decide who maintains test code when the product changes, how failures are investigated, and which checks run before a release. A small trusted set is a practical starting point.
Make specialist coverage explicit
Functional testing does not automatically include a penetration test, accessibility audit, or extensive load exercise. Decide which specialist assessments are needed, their scope, the environment, and the acceptance criteria. Include external dependencies and any permissions required to test them.
For performance work, describe the workload and the conditions being measured. For role-based access, test attempts to cross permission boundaries as well as successful authorized actions. Report the specific coverage achieved and the limits of the exercise instead of applying broad labels that suggest everything was checked.
Prepare a release decision with evidence
A useful report shows what was tested, what passed, what failed, what was blocked, and what remains untested. Describe the business effect of unresolved defects and any temporary workarounds. The person approving release should be able to understand the remaining risk without interpreting raw test logs.
Agree who can accept that risk and who owns follow-up fixes. Include post-release checks, monitoring responsibilities, and rollback arrangements where applicable. Salt’s warehouse rack audit project included feature and load testing within a wider development engagement; the coverage for your project should be defined around your own system and release goals.
Illustrative example · not a client result
Testing a service-request portal
A new release lets customers submit a request with an attachment and receive an acknowledgement.
- Check that the record and attachment are saved before showing success.
- Test interrupted requests, repeated clicks, failed notifications, and restricted accounts.
- Verify that support can find the request even if the acknowledgement fails.
The decision
A visually successful form is not enough. Acceptance should include durable storage, correct access, and a recoverable support workflow.
Planning with a US team
For distributed US delivery teams, set a release approval window and an escalation contact before the release day. Ensure the people who can investigate, approve rollback, and communicate with users are available during that window.
Use this in your next discussion
Your planning checklist
Work through these points with your stakeholders or shortlisted partner. Record the owner of any unanswered question.
- Prioritize journeys by business impact and changes in this release.
- Define environments, accounts, test data, and known differences from production.
- Agree on manual, automated, and specialist testing responsibilities.
- Identify which defects block release and who accepts remaining risk.
- Record post-release checks, monitoring, and rollback ownership.
Common questions
Can automated tests replace manual testing?
No. Automation is useful for repeatable checks, while exploration and usability assessment require different methods. Choose a mix based on the product’s risks and maintain the automated suite as the application changes.
Does QA include a security audit?
Only when that work is explicitly included. Functional QA, access checks, penetration testing, and independent assessments have different scopes. Ask what was tested, by which method, and what remains outside coverage.
Who decides whether the software is ready to release?
An agreed accountable owner makes the decision using test evidence, unresolved defects, and business consequences. Testers report findings; they should not be expected to silently accept business risk on behalf of the organization.
What should I share with Salt to start this discussion?
A short description is enough: the release scope, platform, and target date; critical journeys, user roles, and known defects; available test environment, test data, and existing automation. You can leave confidential documents out of the initial enquiry. We will clarify the requirements and agree whether a project, team, or assessment is the appropriate next step.
Explore Salt’s work
Relevant project experience
The RAMS warehouse inspection project included feature and load testing within a wider web and mobile delivery engagement. This is relevant experience to discuss when your release spans operational workflows; your own test coverage still needs an explicit scope.
Further reading
A reference for defining web security testing scope. Security testing should be specified separately from routine functional checks.
Resources for planning and managing accessibility work. Use them when defining responsibilities and assessment scope.
Your next step
Have a release you need confidence in?
Salt provides software testing and QA alongside development or as an agreed testing workstream. Share the release goal, critical journeys, and known risks. We can discuss the coverage and access needed to evaluate them.
A useful starting point
- The release scope, platform, and target date
- Critical journeys, user roles, and known defects
- Available test environment, test data, and existing automation
A few sentences are enough. You do not need a finished specification or confidential documents to start.
Discuss your QA scopeRead client reviews