Most of the software organizations often strive hard while deciding the release dates of their software product. This is because no organization wants to take risks where the fault is revealed in the developed product on the client -side. This will lead to expensive bug -fixes, and the image of the developer company is tarnished. On the other hand, testing beyond a particular time would lead to a loss of revenue for the organization. The effective approach for handling the risky components will enable softwar e testers to identify more important test cases that can reveal faults associated with those components. After identification of those test cases, software testers work to fix fault sooner by managing the testing schedule by running such test cases earlier . Faults associated with hazardous components can also be detected sooner. In risk - based testing, the probability of a fault becoming a reality is assessed, and the damage that this fault can cause when leading to failure is considered. This study has presented an overall layout of risk -based testing. We have summarized the research findings of numerous researchers in this field. This will help the newcomers in this filed to provide a comprehensive source of information altogether. The future direction of t his study will focus on proposing a novel technique for risk -based testing, considering different parameters together. Keywords: Software, Software Testing, Risk -Based testing, and Systematic Study Cite this Article: Omdev Dahiya, Kamna Solanki, Amita Dha nkhar , Risk-Based Testing: Identifying, Assessing, Mitigating & Managing Risks Efficiently in Software Testing , International Journal of Advanced Research in Engineering and Technology (IJARET), 11 (3), 2020, pp 192-203. http://www.iaeme.com/IJARET/issues. asp?JType=IJARET&VType=11&IType=3 1. INTRODUCTION Dependence on software is gradually increasing day by day, as the software has a role in almost every device associated with human beings. Therefore, those devices require that software must be of good qual ity. Failure of software while performing its intended actions costs organizations both in terms of time and money. The reputation of an organization is at Risk-Based Testing: Identifying, Assessing, Mitigating & Managing Risks Efficiently in Software Testing http://www.iaeme.com/ IJARET/index. asp 193 editor@iaeme.com stake, ensuring the delivery of good quality software products, especially when the lives of people or environmental safety is concerned. The testing of software plays a significant role in achieving these objectives. “ Testing is defined as the process of operating a system or component under specified conditions, observing or recording the results, and making an evaluation of some aspect of the system or component” [1 -2]. Testing is an integral part of any software development. After development, it is to be checked whether the requirements of the user are satisfied or not and also the correctness of the software using testing [ 3-4]. Software Testing is a time -consuming and costly phase in the development process of software. It approximately munches 50% of the cost of the development of the software system [ 5-6]. “Testing is a means of making sure that t he product meets the needs of the customer. Software Testing is the process of exercising the software product in predefined ways to check if the behavior is the same as expected behavior” [ 7-8]. Proving that a product has no defects is not the purpose of testing. Its purpose is to find faults in the software product. To provide quality products to the customers is the main objective of testing [ 9-10]. Figure 1 Overview of the Software Testing Process [ 11] Using testing, developers wish to deliver a produ ct that possesses quality and is a reliable one. Software quality disciplines aim to measure if the software is well designed and how well the software conforms to its requirements [ 12]. Software testing has evolved, and it is a broad field. The purpose o f software testing is not only limited to uncovering faults after the coding phase has been completed. It is also used to test software for other qualities as well, like portability, reliability, maintainability, efficiency, and compatibility, etc. In the life cycle of the development of software, the major part is constituted by software testing. The effectiveness of testing always remains lower than its expectations despite the number of efforts laid down by the testing team to increase its quality [13]. Many financial losses and social problems were encountered due to inadequate testing of the software. Performing exhaustive testing can be a solution to this problem. However, due to limited time and resources, the possibility of performing exhaustive test ing is ruled out. Uncovering maximum faults is the ultimate goal of the testing process. For achieving this Omdev Dahiya, Kamna Solanki, Amita Dhankhar http://www.iaeme.com/ IJARET/index. asp 194 editor@iaeme.com purpose, a choice has to be made between the testing techniques available as only a few of them could be used for that, and not all can be used to t est our system [ 14]. Figure 2 Test Management Process [ 15] For making the testing process an effective one, it is desirable to select efficient techniques for testing the software, owing to limited resources available. However, making this choice is next to impossible tasks because we do not have adequate information about the cost of testing techniques, efficiency, and relative effectiveness [1 6]. This information is complicated to be procured due to various factors like, the programming language use d, kind of software which is under test, various operations which the software is intended to perform, in which environment the software is executed. The types of faults it may have, etc. Various studies have concluded that diverse techniques for testing the software should be used. Researchers support their claim by saying that diverse techniques work on different aspects, and different types of faults were targeted. However, resources were used excessively while using diverse techniques to perform testin g, which results in little efficiency, as more time, resources, and test cases will be required [1 7]. Resources were also wasted in using many techniques as most of them target the same type of faults, and it leads to duplication of efforts. Therefore, sof tware testing techniques should be compared and evaluated for their efficiency and effectiveness [1 8]. “Positive tests or Clean tests” are those who work on validating the work performed by software products. The disadvantage for them is that the validatio n of software work is performed for those limited and specific number of test cases. Whether software will work well in all situations cannot be decided by a handful or a finite number of test cases. On the contrary, the software does not work can just be shown by the failure of a single test case [19]. To demonstrate that software is not working as desired can be shown by the usage of “Negative tests or Dirty tests.” To survive a significant level of dirty tests, software should have sufficient exception h andling capabilities [ 20]. Risk-Based Testing: Identifying, Assessing, Mitigating & Managing Risks Efficiently in Software Testing http://www.iaeme.com/ IJARET/index. asp 195 editor@iaeme.com Figure 3 Overview of Test Management Process [ 21] In the development process of software, many risks are there, which may act as an obstacle in the delivery of a reliable product to its intended user. “Risk can be defined as the possibility of an adverse or unwanted result or occurrence. If stakeholders, users, or customer opinion about the project’s quality or successful completion of the project can potentially be reduced due to a problem or issue, the risk is said to exist” [22]. In Software Testing, risk analysis is the process of identifying the risks in applications or software that you built and prioritizing them to test. After that, the process of assigning the level of risk is done. The categorization of the risks takes place; hence, the impact of the risk is calculated [ 23]. 2. RISK -BASED TESTING It is a type of testing which is performed based on risk probability. Assessment of risk is involved in this testing technique, which involves many factors such as Defec t prone areas, frequency of usage, business criticality, complexity, etc. Various factors are involved in it, such as prioritizing the testing of features, modules, and functions of the Application Under Test based on the impact and likelihood of failures [24]. Risks can be termed as “positive risks” or “negative risks.” “Positive risks” help in business sustainability and are referred to as opportunities. For example, the development of a new product, bringing change in the process of business, investment in a new project. “Negative Risks” are referred to as threats, and they must be eliminated or minimized so that the project may be successful. Risk-based testing aims to minimize quality risks to an acceptable level. It is impossible to achieve zero qual ity risk. Omdev Dahiya, Kamna Solanki, Amita Dhankhar http://www.iaeme.com/ IJARET/index. asp 196 editor@iaeme.com While performing risk -based testing, the quality risks or product risks are detected, and they are thus reviewed when risk analysis of product quality is done with the stakeholders. “After risk analysis, the test team carries out test design, te st implementation, and test execution activities intending to minimize the risks.” Figure 4 Picture depicting Risk -Based Testing [2 5] 3. RISK MANAGEMENT PROC ESS This section discusses the Risk management process in detail. The need for this is to provide meaningful insight into the different aspects of risk management activities involved in risk - based testing. Figure 5 Risk Management Process [2 6] Risk-Based Testing: Identifying, Assessing, Mitigating & Managing Risks Efficiently in Software Testing http://www.iaeme.com/ IJARET/index. asp 197 editor@iaeme.com 4. STEPS IN RISK -BASED TESTING This section will provide the details of the steps which are followed in the risk -based testing process.  Risk Identification.  Assessing the risks  Risks Mitigation  Risk Management 4.1. Risk Identification To minimize and understand risk first, it has to be identified. Because of risk identification, risk can be discovered and included later for taking necessary measures to handle it. This is achieved through the continuous and communicated efforts of the team members [2 7]. It is very beneficial as it provid es a window to raise the concern of the risk even before it is the occurrence and it shells the business goals or operations from getting damaged or delayed. Identification of all possible risks is the primary objective. The process of identifying the risk s should be initiated as soon as possible in the project development cycle, even before approving the goals and planning phase. This will prevent the entire team from being termed unfit if the risk becomes a reality and damages the project. This step of th e process does not involve proposing a solution or eliminating the risk. Risk is uncovered and documented for analysis further. To identify the risks, the stakeholders may follow any methods given below:  Experts Interview.  Checklist creating and its usage.  They are conducting independent reviews.  Arrangement of project meetings.  Risks workshops may be conducted.  Meeting with the stakeholders.  Previous experiences may be revisited. The risk detection process will uncover maximum risks, including the product quality risks, if a majority of stakeholders are included and involved in this process. The role of stakeholders in risk -based testing is crucial. The risk identification process has various other benefits as well, such as identification of the issues whic h may not be termed as risks but can affect the quality of the products. For example, issues correlated to requirements specifications of the documents, overall quality concerns of the product, etc. [2 8]. For overall testing, it is beneficial to manage pro ject risks somewhat than limiting it to risk-based testing. 4.2. Assessing the R isks Assessing risks involves various steps. Some of them are documented below:  Identifying the potential hazards is done in which factors were identified, which have the potential to cause damage.  Analyzation of the risks and their evaluation is performed according to the risks which are associated with those particular hazards. Omdev Dahiya, Kamna Solanki, Amita Dhankhar http://www.iaeme.com/ IJARET/index. asp 198 editor@iaeme.com  To control the risk, appropriate ways were identified so that hazards may be eliminated. If the elimination of the hazard cannot be performed, then the risk may be controlled and dealt with correctly. Assessment of risk involves a rigorous look at the workp lace so that the processes, situations, or identification of the things are performed, which have the potential to harm, especially to human beings. After the identification of risk, it is analyzed and evaluated how severe the risk is and how much probabil ity is there for its occurrence [2 9]. After determining this, the measures are decided, which have to be incorporated to control the damage from happening and eliminate it effectively. The assessment of risk starts after its identification is completed. A ssessment of risk involves analyzing and evaluating the risks which have been identified. Many activities are involved in the risk assessment, such as:  Classification of each risk.  Determining the risk occurrence probability.  Risk Impact.  Identification a nd assessment of risk properties. Different parameters are used to classify risks such as reliability, performance, functionality, and many more. For quality characteristics standardization, “ISO 25000” standards have been adopted by the companies, and “ISO 9126” standards were being phased out by them. For risk classification, many classification models were used by the companies. The checklist, which has been used for identifying the risks, the same has been used for classifying the risks. 4.3. Risk M itigation The process of mitigating the risk involves the development of options and necessary actions that are required to be undertaken to increase opportunities so that treats that have the potential to harm project objectives may be eliminated [ 30]. Ri sk mitigation actions are executed in this phase. The process of risk mitigation involves various activities such as tracking the risks which have been identified, monitoring the progress, identification of new risks, and the project is evaluated thoroughl y for its effectiveness. The first step is identification in which quality risks were analyzed, and they are then evaluated for product quality. Analyzation of quality risks will lead to the development of test plans. As per the test plan, to mitigate the risks, to the design of tests, implementing the tests, and execution of tests is performed. The effort allocated to development, implementation, followed by test execution is directly proportional to the risk level. This implies that for higher -level risk s, thorough techniques like pairwise testing are designed. While for lower -level risks, not so specific techniques like exploratory testing for a limited time, are designed. Risk level decides the development and priority of execution of a test. Various de cisions also get affected by the risk level, such as:  Whether reviewing of test documents and project artifacts is done?  Have testers acted independently or not?  Testers have what kind of experience?  How much retesting is required to be done? Risk-Based Testing: Identifying, Assessing, Mitigating & Managing Risks Efficiently in Software Testing http://www.iaeme.com/ IJARET/index. asp 199 editor@iaeme.com  How much is r egression testing required to be done? During the project development phase, there might be a probability that some information emerges, and it alters the quality risks. This affects the testing team on the level of their working or on the impact the risk could have. The test team must be aware of such kind of change in information at any stage. The key milestone of the project should also focus on adjustments where they may have to deal with the new risk being detected, and on the re - evaluation levels of the risks. Even after the design specification phase is completed, it is advisable to reassess the risks when detection of risks and their evaluation is done based on the specification of requirements in the requirement phase. When testers discover that the number of faults in any part of the product is much higher than the predicted number of faults during testing, then testers are sure that the probability of occurrence of a fault in that particular part is very high as expect ed in advance. Then the testers must revise the probability of occurrence of risk in that particular part of the software. Accordingly, that part is required to be tested extensively. Even before test cases start execution, risks associated with the prod uct quality can be minimized. 4.4. Risk Management The process of risk management involves measuring and assessing the risk so that strategies can be developed for managing the risks [ 31]. Any organization needs to implement a risk management strategy. “G ood risk management does not have to be resource -intensive or difficult for organizations to undertake or insurance brokers to provide to their clients.” Risk management can be advantageous when there is a good understanding of the organization, and its st ructure has been conceptualized [ 32]. “Risk can mean that some danger or loss may be involved in carrying out an activity, and therefore, care has to be taken to avoid that loss. This is where risk management is important, in that it can be used to protect against loss or danger arising from a risky activity”. For proper management and controlling the risks related to a product, there are various factors which should be taken care of, such as:  What are the possible sources where probability if the loss is h igh?  If the loss occurs, then what would be its probable impact?  What actions are required to be undertaken in the case where loss takes place? Whether the loss is permitted to happen or action should be taken to reduce it? The product is required to be p rotected in the best possible way along with devising the measures so that future loss could be avoided. Loss prevention strategies should be devised, which will help in the long run, as the price of recovering from an already damaged system when the risk has taken place is very high. The expenditure incurred in strategies for preventing loss is very low as compared to dealing with the damaged product. A project undergoes various phases during its development cycle. Following figure 6 and 7 depicts the stag es in project management. Omdev Dahiya, Kamna Solanki, Amita Dhankhar http://www.iaeme.com/ IJARET/index. asp 200 editor@iaeme.com Figure 6 Stages of Project Management [ 33] Figure 7 Project Management Challenges [ 34] 5. CONCLUSION In Software Engineering, Risk -based testing is the most efficient way to guide the project based on risks. We cannot test everything, so risk -based testing ensures that only those things are tested, which matters. The level of each risk item is rated well if the testing efforts are effectively organized. If a single test has high risk than risk item, then it is assigned as th e test with the highest risk factor. Appropriate test activities are associated with each risk. The risk Risk-Based Testing: Identifying, Assessing, Mitigating & Managing Risks Efficiently in Software Testing http://www.iaeme.com/ IJARET/index. asp 201 editor@iaeme.com priority order is followed while executing the tests. To reduce the impact of residual risks, a track is maintained of the identified risks, and it is done by monitoring the risks. To evaluate risk levels for application features and to map them over to specific test cases, technical and business specialists work altogether. These risks include technical risks along with business risks, such as code comp lexity and the frequency by which change has been made in the code before it was tested . Subsequently, test cases are placed in order according to the risks, with the highest -risk tests are performed first. Low -risk tests might be overlooked depending upon time and allocated budget. This is the fundamental viewpoint of risk -based testing. Risk -based testing proposes a different approach based on prioritizing test cases in line with business and user impact rather than trying to catch every fault, irrespecti ve of its significance to the overall functionality and user experience. The motive of this study is to mitigate risks in software projects. Risk -Based testing follows an approach where the entire focus of the tester is not just limited to discovering the faults, irrespective of severity, and priority , but they are required to act smartly.They are supposed to understand clearly the “Need s of the Customer and Wants of the User.” The testers are required to perform the extensive study of the product and find that which is the most widely used feature in the production, and revenue can be generated for which of the most critical path. They must also understand how to safeguard and protect customers from business threats and production issues. Hence, this study is of the conclusion that the Risk -based testing approach has taught the testers that are just testing extensively or testing everything does not mean that there are no defects in the product or testing is complete. Testing effectively in a stipulated budg et, allotted time, and ensuring that critical and significant business impacts are nullified, and that is quite important for the tester.