Organizational Test Policy Template (ISO/IEC/IEEE 29119-3)

Organizational Test Policy: [Organisation or business unit]

Organisation-wide test policy: a short, stable document, approved by senior management, that says why the organisation tests, what it expects testing to achieve, and the principles every project follows. It sits above the organisational test practices (test strategy) and the project test plans. The structure follows the test policy information item of ISO/IEC/IEEE 29119-3:2021 (clause 6.2). Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

1. Purpose and scope

This policy sets the objectives and principles of testing for [organisation]. It applies to [all software the organisation builds, buys and configures for customers or for its own operations], including work done by suppliers on its behalf.

Example: Out of scope: hardware certification testing, which follows the separate product compliance procedure.

2. Objectives of testing

3. Test process

• Testing follows the organisation's test process, documented in [organisational test practices, TS-ORG-001], based on the processes of ISO/IEC/IEEE 29119-2:2021 and tailored per project.
• Every project of [size or risk threshold] has a test plan approved before test execution starts and a test completion report before release.
• Testing is risk-based: the depth of testing follows product risk, and the residual risk is stated and accepted by the product owner.
• Example: Teams using continuous delivery meet these rules through pipeline gates and an automatically generated completion summary, approved per release train.

4. Test organisation structure

5. Tester training and competence

• Every tester and developer completes [induction training on the test process and defect reporting] within [one month] of joining.
• Test leads hold or obtain [a recognised testing qualification or equivalent experience] within [12 months].
• Specialist skills (accessibility, security, performance) are kept by [named roles], with [n] days of training per year.

6. Tester ethics

• Report results truthfully, including results that delay a release.
• Nobody may be pressured to change a verdict or a defect severity without evidence; disputes go to [the head of quality].
• Use production personal data in testing only with approval under [data protection policy], and prefer synthetic or masked data.
• Protect confidential information found during testing, and report security vulnerabilities only through [the vulnerability process].

7. Standards

8. Other relevant policies

• [Quality policy] and [quality management system manual]
• [Information security policy] and [vulnerability disclosure policy]
• [Data protection policy] for test data
• [Change management policy] (ops/change-enablement-policy) for release approval
• [AI use policy] for AI-assisted test design and AI components under test

9. Measuring the value of testing

10. Test asset archiving and reuse

• Test plans, completion reports and conformance reports are kept for [the life of the product plus two years] in [repository].
• Automated tests live with the code and follow the code's retention.
• Reusable assets (test data generators, environment definitions, checklists) are published in [shared library] with an owner.
• Test data containing personal data is deleted at the end of the test cycle unless a documented exception applies.

11. Test process improvement

• Each project records lessons in its completion report; the head of quality reviews them [quarterly] and updates the test practices.
• Every escaped S1 defect gets a root cause analysis that asks why testing did not find it (dev/postmortem).
• An assessment of the test process against [model or internal baseline] runs every [two years].

12. Compliance and exceptions

13. References

• Organisational test practices: Test Strategy (quality/test-strategy)
• Project level: Test Plan (quality/test-plan-29119), Test Completion Report (quality/test-completion-report)
• Quality planning: Software Quality Assurance Plan (quality/sqa-plan)
• ISO/IEC/IEEE 29119-3:2021, Software and systems engineering: Software testing: Part 3: Test documentation. Official text: ISO, IEC and IEEE, purchase or licensed access: https://www.iso.org/standard/79429.html
• ISO/IEC/IEEE 29119-2:2021, Part 2: Test processes. Official text: IEEE, purchase or licensed access: https://standards.ieee.org/ieee/29119-2/7498/

Standard and licence note

Structure aligned with ISO/IEC/IEEE 29119-3:2021, Software and systems engineering: Software testing: Part 3: Test documentation, test policy information item (clause 6.2: objectives of testing, test process, test organisation structure, tester training, tester ethics, standards, other relevant policies, measuring the value of testing, test asset archiving and reuse, test process improvement). The standard is copyrighted and is cited by name, edition and clause number only; no text or example from it is reproduced, and all wording here is original. Check the current edition before claiming conformance. Official text: ISO, IEC and IEEE, purchase or licensed access, at the links in section 13. Template licence: MIT.