Test and QA Plan

How the build is validated before go-live: three sequential test phases, edge cases, and production verification.

4 pagesPDF · Quality

FS-DOC-06Quality

Test and QA Plan

Risk Register Management

[YourCompany.com] · Management Department · Prepared by FullSpec · [Today's Date]

This document defines the full testing programme for the Risk Register Management automation, covering all three agents: Risk Intake and Scoring, Review Chase and Escalation, and Risk Reporting. Testing is structured into three sequential phases. No phase begins until the previous phase fully passes. The FullSpec team runs Phases 1 and 2 entirely in sandbox environments using test credentials. The process owner joins Phase 3, which is the only phase conducted against production systems. Every test case carries a unique ID that maps directly to the build scope in the Developer Handover Pack.

01Testing approach

The programme runs three phases in strict sequence. No phase begins until every test case in the previous phase achieves a passing result. Failures must be resolved and the affected test cases re-run before the phase is closed. Phase 1 isolates each agent independently. Phase 2 tests the handoffs between agents and exercises edge cases. Phase 3 runs a full end-to-end sequence in the production environment with real credentials and real data, after which the process owner reviews and formally approves the build.

Phase 1 — Unit Testing

Each agent tested independently in sandbox

Scope

Individual agent logic: Risk Intake and Scoring Agent, Review Chase and Escalation Agent, Risk Reporting Agent — each tested in isolation with synthetic payloads.

Environment

Sandbox only. No production Google Sheets register, Slack workspaces, Notion workspace, or Gmail accounts are touched.

Credential rule

All credentials must be sandbox or test-account variants. Production API keys and OAuth tokens must not be loaded into the test environment at this phase.

Pass condition

All test cases T01 through T14 return the expected output with no unhandled errors. Any failure blocks progression to Phase 2.

Who runs it

FullSpec team only. The process owner is not required for Phase 1.

Phase 2 — Integration and Edge Case Testing

Agent handoffs and failure modes tested in sandbox

Scope

End-to-end agent handoffs across all three agents, plus a dedicated edge-case suite covering duplicates, missing data, unavailable tools, and human timeout scenarios.

Environment

Sandbox only. Sandbox versions of Google Sheets, Slack, Notion, Gmail, and Google Forms are used throughout.

Credential rule

Sandbox credentials only. The integration test suite must not reference live Slack channels, live Gmail addresses, or the production Notion workspace.

Pass condition

All integration test cases T15 through T22 and all edge cases E01 through E08 pass. Any failure blocks Phase 3.

Who runs it

FullSpec team only. The process owner is not required for Phase 2.

Phase 3 — End-to-End Production Test

Full production run with process owner review and sign-off

Scope

One complete production run traced from Google Forms submission through scoring, Slack notification, escalation, register update, Notion report generation, and Gmail distribution. Error-log verification and owner approval included.

Environment

Production systems: live Google Forms, live Google Sheets register, live Slack workspace, live Notion workspace, live Gmail. Test records must be voided after the run.

Credential rule

Production credentials are loaded for Phase 3 only. All test submissions must use the designated internal test address and be clearly labelled as test records for later removal.

Pass condition

All production test cases T23 through T27 pass, including the final process owner review-and-approval case (T27). FullSpec logs the approval in the project confirmation record.

Who runs it

FullSpec team conducts the run. The process owner joins for T27 to review outputs and confirm approval. No separate sign-off block is required.

Test and QA PlanPage 1 of 4

FS-DOC-06Quality

02Phase 1 — unit test cases

Sandbox credentials only. Before running any Phase 1 test case, confirm that all configured API connections point to test-account variants of Google Sheets, Google Forms, Slack, Notion, and Gmail. Production credentials must not be present in the build environment at this stage. If a sandbox token expires mid-session, replace it before resuming — do not substitute a production credential as a workaround.

Agent 1: Risk Intake and Scoring Agent

Scenario

Input

Expected output

Pass criteria

T01

Happy path: new risk submitted via Google Forms

Valid form payload: risk description, category, submitter name, date

New row written to sandbox Google Sheets register with timestamp, category, submitter, and proposed likelihood and impact scores

Row appears in register within 30 seconds; all five fields populated; no duplicate rows created

T02

Scoring logic: low-severity risk

Form submission describing a minor administrative oversight

Agent assigns likelihood score 1 or 2 and impact score 1 or 2; risk rating resolves to Low

Score values fall within the Low band per the agreed risk matrix; no escalation flag set

T03

Scoring logic: high-severity risk

Form submission describing a data breach affecting customer records

Agent assigns likelihood score 4 or 5 and impact score 4 or 5; risk rating resolves to High or Critical

Score values fall within High or Critical band; critical flag set to true in register row

T04

Critical flag triggers human-hold

Risk rated Critical by scoring agent

Workflow halts at human review step; no Slack notification sent to owner until manager approves

T05

Owner assignment routing

Form payload includes category 'Operational'; routing table maps Operational to test owner ID

Owner field matches routing table entry for that category; no blank owner field

T06

Failure: Google Forms payload missing required field (risk description blank)

Form submission with description field empty

Workflow catches validation error; row written with status 'Incomplete'; no score assigned; submitter notified via Gmail

No score written; status column reads 'Incomplete'; error logged; Gmail notification sent to submitter sandbox address

T07

Failure: Google Sheets write error (simulated permission denied)

Valid form payload; sandbox Sheets token revoked before write step

Workflow catches write failure; error logged; no partial row written; retry attempted once after 60 seconds

Error entry appears in workflow log with timestamp; no partial row in register; single retry observed in logs

Agent 2: Review Chase and Escalation Agent

Scenario

Input

Expected output

Pass criteria

T08

Happy path: review date reached, owner notified via Slack

Slack message sent to owner with risk details, proposed score, and link to register row

Slack message delivered to sandbox channel within 2 minutes of scheduled trigger; message contains risk title and register link

T09

Escalation: owner non-response after 48-hour window

Gmail escalation email sent to risk manager sandbox address; department head CC'd

Gmail message delivered; subject line references risk ID and title; risk manager and department head addresses both present in recipients

T10

Escalation: critical risk flagged regardless of response window

Immediate Gmail escalation to risk manager without waiting for 48-hour window

Gmail sent within 2 minutes of critical flag detection; 48-hour timer not required to elapse

T11

Owner responds and confirms score within window

Owner submits score update via register link within 48 hours

Likelihood, impact, and rating columns updated; reviewer field populated; escalation Gmail not sent

T12

Failure: Slack delivery fails (bot not in channel)

Owner Slack ID valid but bot is not a member of the target channel

Slack send fails gracefully; error logged; fallback Gmail notification sent to owner sandbox email

Slack error captured in workflow log; fallback Gmail sent within 5 minutes; no silent failure

T13

Failure: owner Slack ID and email both missing from register

Workflow halts chase step; error logged; risk manager notified via Gmail that owner details are missing

Chase step skipped; error log entry created; Gmail sent to risk manager sandbox address referencing the specific risk ID

Agent 3: Risk Reporting Agent

Scenario

Input

Expected output

Pass criteria

T14

Happy path: monthly scheduled trigger fires

Scheduled trigger fires on last business day of sandbox test month; register contains 10 seeded rows across Low, Medium, High, and Critical bands

Notion page created with risk summary narrative, heat map data, and top risks listed; Gmail sent to distribution list sandbox addresses; Slack excerpt posted to designated sandbox channel

Notion page created and publicly accessible within 5 minutes of trigger; Gmail sent to all addresses in sandbox distribution list; Slack message posted with report link; register snapshot written to archive tab

T15

Failure: Notion API unavailable during report generation (simulated)

Scheduled trigger fires; Notion sandbox token revoked before write step

Workflow catches Notion write failure; error logged; no partial page created; risk manager notified via Gmail that report generation failed

Error in workflow log with Notion API error code; no partial Notion page exists; Gmail alert delivered to risk manager sandbox address

Test and QA PlanPage 2 of 4

FS-DOC-06Quality

03Phase 2 — integration and edge case tests

Phase 2 verifies that the three agents hand off correctly to each other across the full automated flow, then exercises a dedicated suite of edge cases that could not be isolated to a single agent in Phase 1. All tests in this phase remain in the sandbox environment.

Integration tests: agent handoffs

Scenario

Input

Expected output

Pass criteria

T16

Handoff: Intake Agent to Escalation Agent (non-critical, owner present)

New form submission scores as High; owner Slack ID in register

Intake Agent writes row and sets score; Escalation Agent picks up the review date; Slack nudge sent to owner on review date

No manual intervention; Slack message references the correct risk ID written by Intake Agent

T17

Handoff: Intake Agent to human hold, then release to Escalation Agent

New form submission scores as Critical; manager approves after simulated 10-minute delay

Intake Agent holds row at 'Pending Manager Review'; after approval, row status updates and Escalation Agent begins monitoring the review date

Escalation Agent does not fire Slack nudge until manager approval is recorded; after approval, monitoring begins within 2 minutes

T18

Handoff: Escalation Agent confirms score, Reporting Agent picks up updated row

Owner confirms score update 5 days before scheduled monthly report

Register row updated by Escalation Agent; Reporting Agent reads confirmed score in monthly pull; report reflects updated values

Report Notion page shows confirmed score, not the initial proposed score; reviewer name appears in report data

T19

Handoff: Reporting Agent archives register after report generation

Monthly trigger fires with 10 seeded rows

After Notion page is created and emails sent, Reporting Agent writes a dated snapshot of the register to the archive tab

Archive tab contains a dated copy of all rows as they existed at report generation time; original register rows are unchanged

T20

Handoff: Escalation Gmail triggers for overdue item; Reporting Agent reflects overdue count in monthly report

One register row overdue by more than 48 hours at month end

Escalation Gmail sent by Escalation Agent; Reporting Agent includes overdue count in leadership summary narrative

Notion report narrative references at least one overdue item; overdue count matches register state at time of report generation

T21

Full linear flow: form submission to Slack confirmation, no critical flag

End-to-end sandbox run: form submitted, scored Medium, owner Slack nudge sent, owner confirms, register updated

All five steps complete without manual intervention; register row status transitions from 'Submitted' to 'Scored' to 'Awaiting Confirmation' to 'Confirmed'

Each status transition logged with timestamp; total elapsed time from form submission to 'Confirmed' status under 5 minutes excluding deliberate timer delays

T22

Full linear flow: form submission through monthly report distribution

Three sandbox risk rows seeded; monthly trigger fired manually; all rows in Confirmed status

Notion report created; Gmail and Slack distribution completed; archive snapshot written

Report includes all three rows; distribution list receives Gmail; Slack channel receives excerpt; archive tab updated

Edge case tests

Scenario

Input

Expected output

Pass criteria

E01

Duplicate form submission: same risk submitted twice within 5 minutes

Two identical Google Forms payloads (same description, same submitter, same timestamp window)

Second submission detected as a likely duplicate; second row written with status 'Duplicate — Pending Review'; risk manager notified via Gmail

Only one row with status 'Scored' or 'Awaiting Confirmation'; second row flagged; Gmail alert includes both row IDs for manual adjudication

E02

Missing data: risk category field left blank on form submission

Form payload with category field empty; all other fields valid

Row written to register with status 'Incomplete'; category field blank; submitter notified via Gmail to resubmit with category selected; scoring step skipped

No score assigned to incomplete row; Gmail sent to submitter sandbox address; error entry in workflow log

E03

Missing data: owner routing table has no entry for submitted category

Form payload with category 'Unclassified'; routing table contains no mapping for this value

Row written; owner field left blank; risk manager notified via Gmail to assign owner manually; Escalation Agent pauses nudges for this row until owner is populated

Owner field blank in register; Gmail sent to risk manager; Escalation Agent does not fire for this row until owner field is populated

E04

Unavailable tool: Slack API returns 429 rate limit error

Escalation Agent attempts to send 15 simultaneous Slack nudges (stress test)

Agent respects rate limit; queues remaining messages with a 1-second delay between sends; all messages delivered within 30 seconds; no messages dropped

All 15 Slack messages delivered; workflow log shows rate-limit handling; no error surfaced to risk manager for a rate-limit event

E05

Unavailable tool: Gmail SMTP authentication failure

Escalation email triggered; Gmail OAuth token expired mid-run

Workflow catches auth failure; error logged with token expiry detail; FullSpec alert raised; email queued for retry after token refresh; risk manager notified via Slack as fallback

Email not silently dropped; error log entry with auth failure code; Slack fallback message delivered to risk manager sandbox channel

E06

Unavailable tool: Google Sheets API returns 503 Service Unavailable

Reporting Agent attempts register pull; Sheets returns 503

Workflow retries pull up to three times with exponential backoff (30s, 60s, 120s); if all retries fail, risk manager notified via Gmail; report generation deferred

Three retry attempts logged with timestamps; on triple failure, Gmail alert sent; no partial Notion page created; deferral logged

E07

Human timeout: manager does not approve Critical hold within 24 hours

Secondary escalation Gmail sent to risk manager and an escalation contact (e.g. operations director sandbox address); row remains held; Slack reminder posted in manager sandbox channel

Secondary Gmail delivered; Slack reminder posted; row status remains 'Pending Manager Review'; no automated promotion to Critical without approval

E08

Human timeout: owner does not confirm score and no escalation contact is available (escalation Gmail bounces)

Escalation Gmail bounces with 550 error; owner unresponsive; no department head email in register

Bounce detected; workflow logs bounce error; risk manager notified via Slack with bounce detail; row flagged 'Escalation Failed — Manual Action Required'

Bounce error in workflow log; Slack message sent to risk manager sandbox channel; row status updated to 'Escalation Failed — Manual Action Required'; no further automated sends attempted for this row

Test and QA PlanPage 3 of 4

FS-DOC-06Quality

04Phase 3 — end-to-end production test

Important before running Phase 3: all form submissions must use the designated internal test email address (e.g. qa-test@[YourCompany.com]) and must include 'QA TEST' in the risk title field so they are identifiable. After the production run is confirmed as passed, every test record must be voided: delete the test row from the live register, delete the test Notion page, and remove any test Slack messages and Gmail threads. Confirm deletion before marking Phase 3 complete. Do not proceed if Phase 1 or Phase 2 contains any open failures.

Scenario

Input

Expected output

Pass criteria

T23

Production run: full intake to confirmed score (non-critical)

Live Google Forms submission with category 'Operational', risk description, and submitter name; owner email and Slack ID present in live register routing table

Row written to live register within 30 seconds; likelihood and impact scores proposed by Risk Intake and Scoring Agent; owner receives live Slack nudge; owner confirms score; register updated with confirmed score, reviewer name, and timestamp

Live Slack message delivered to correct owner; live register row updated within 2 minutes of owner confirmation; all field values match submitted data; no error in production workflow log

T24

Production run: critical risk hold and manager approval

Live form submission designed to score Critical (e.g. 'Severe data exposure risk affecting all customer records — QA TEST'); risk manager is available to approve during the test window

Row written with status 'Pending Manager Review'; no owner Slack nudge sent; risk manager receives Gmail notification of pending critical review; manager approves via the production register; Escalation Agent then begins monitoring the review date

Owner Slack nudge not sent before approval; Gmail received by live risk manager address; after approval, register status transitions correctly; Escalation Agent monitoring confirmed active in workflow logs

T25

Production run: overdue escalation in live environment

Register row from T23 is manually backdated in review date field to simulate overdue status (review date set to 2 days ago); Escalation Agent scheduled run triggered manually

Gmail escalation sent to live risk manager address with risk ID, title, and overdue duration; department head CC address receives copy; register row status updated to 'Escalated'

Live Gmail received by risk manager within 5 minutes of triggered run; department head CC confirmed in email headers; row status in live register reads 'Escalated'; no duplicate escalation emails sent

T26

Production run: monthly report generation and distribution

Monthly reporting trigger fired manually in production environment; live register contains at least the test rows from T23 and T24 (plus any live rows); distribution list contains at least the risk manager's live email address

Notion page created in production workspace with risk summary narrative and top risks; Gmail sent to all addresses on live distribution list with Notion link; Slack excerpt posted to designated live channel; register snapshot archived to archive tab in live Sheets

Live Notion page accessible via link in Gmail; Gmail received by all distribution list addresses; Slack message visible in designated channel; archive tab in live Google Sheets contains dated snapshot matching register state at time of trigger

T27

Production run: error-log and process owner review and approval

Production workflow logs reviewed by FullSpec team after T23 through T26; process owner (Risk Manager) invited to review all live outputs: register rows, Notion report, Slack messages, Gmail threads, and archive snapshot

No unhandled errors in production workflow log for any step across T23 through T26; process owner confirms that register entries, scores, Slack messages, Gmail content, Notion report structure, and archive snapshot all match agreed specifications; process owner records approval in the FullSpec project confirmation; all test records voided from production systems

Process owner approval recorded in FullSpec project confirmation. All test records confirmed deleted from live register, Notion, Slack, and Gmail. No open errors in production workflow log. Phase 3 closed.

Once T27 is marked as passed and the process owner approval is recorded in the FullSpec confirmation record, the Test and QA Plan is closed. The FullSpec team will notify you at support@gofullspec.com with the confirmation summary before the go-live date is confirmed.

Test and QA PlanPage 4 of 4

Test and QA Plan

Test and QA Plan

01Testing approach

02Phase 1 — unit test cases

03Phase 2 — integration and edge case tests

04Phase 3 — end-to-end production test

More documents for this process