A risk model is a framework for comparing and prioritising risks, such as weighing their likelihood and impact against a chosen type of risk, like revenue, usability or a release date.
Why it matters: A risk model helps teams decide where to focus testing. But every model is a heuristic: useful but fallible. It carries its own risk, and the type of risk it targets changes what gets tested.
In practice: Teams build a model from whatever data they have, such as usage figures, revenue streams and past problems, then use it to prioritise testing. They balance the effort of refining the model against the testing it's meant to guide, and update it as they learn.
Examples:
- Prioritising testing on iOS and Android in proportion to each platform's users.
- Revising a risk model mid-release after testing reveals a high-impact area nobody had weighted.
Common pitfalls:
- Spending more time perfecting the model than testing.
- Forgetting the model is an abstraction and trusting it too far.
What's the difference between a risk model and a risk matrix? A risk matrix is one simple kind of risk model, plotting likelihood against impact. A risk model can be any framework a team uses to compare risks.
