Risk Based Testing in Complex Enterprise Systems

Abstract

Purpose: Enterprise programmes that replace or integrate core business systems rarely have the test capacity to examine everything with equal depth, so they rely on risk-based testing. This review asks how product risk analysis should drive test strategy, effort allocation and release decisions when judgements are subjective and risks arise at the interfaces between systems. Method: A conceptual integrative review of software engineering, testing standards, reliability and safety literature published between 1994 and 2024, appraised with instruments matched to evidence type and synthesised through mechanism, context and outcome coding. Findings: The evidence supports risk-based testing as a programme-level decision process rather than a scoring ritual. Ordinal likelihood and impact matrices compress and sometimes reverse the ordering of exposures; uncalibrated expert judgement is the dominant source of error; test depth, not only test order, should follow exposure; and risk coverage is a stronger exit criterion than code coverage only when residual risk is reported with its uncertainty. Integration risk in systems of systems is systematically under-owned. Contribution: The CALIPER framework (Catalogue, Assess, Level-set, Invest, Prove, Expose, Release and relearn), an exposure-based allocation model with a worked programme scenario, and six falsifiable propositions with stated tests. Implications: Programmes should calibrate assessors against outcomes, allocate effort by exposure and detection difficulty, and give release authorities an explicit residual-risk statement tied to risk appetite.