The idea of achieving 100% test coverage has long been positioned as a benchmark for quality in software testing.
In theory, more tests should mean fewer defects, greater confidence, and safer releases. But in highly regulated environments such as banking and healthcare, where systems are complex, interconnected and constantly evolving, that assumption is increasingly being challenged.
For QA teams working under tight release cycles, expanding regression suites and growing system dependencies, the pursuit of complete coverage can quickly become both impractical and misleading.
The reality on the ground is that even the most extensive test suites cannot account for every possible scenario, particularly in systems handling real money, sensitive patient data and mission-critical workflows.
Oladapo Aiyenitaju, a senior QA automation engineer and ISTQB-certified tester with vast global experience across banking and healthcare systems, argues that this gap between theory and practice becomes clear very early on.
“The pressure of ‘am I doing enough’ and ‘have I tested enough’ is compounded by the looming release date, which cannot be moved, and a regression test suite that continues to grow, the feeling of doubt every QA engineer gets at least once, and finally, the big thought of ‘ in this new release what if I miss something important?’”
Early in his career, Estonia-based Aiyenitaju believed that increasing test volume would solve this problem.
“I thought the big answer to these thoughts was simply ‘Add More Tests.’ And eventually, we should strive for full coverage. After all, there are no untested paths,” he said.
That thinking shifted once he began working in high-risk environments. “However, when I began working on banking and healthcare systems, that philosophy did not last long.”
Aiyenitaju shared that “in banking and healthcare systems where real money moves and real patient data are used, I learned something very quickly: 100% test coverage does not equal real confidence. In plain language, it did not work.”
Modern financial and healthcare platforms introduce layers of complexity that make complete validation impossible, as he pointed to the scale and structure of these systems as a key factor.
“Covering the entire application with test cases and automation may look reassuring on paper; however, modern systems are so complex that coverage metrics do not give the complete picture,” Aiyenitaju explained.
Functionality
Aiyenitaju highlighted the breadth of functionality involved. “Banking platform flows include: Many transaction paths. Multiple external payment providers. Very strict security and compliance requirements.”
He stressed that “healthcare systems also include sensitive patient data. Role-based access to the system. Complex workflows that span multiple teams and systems.”
Even with extensive automation in place, critical issues can still slip through. “Even though you can have thousands of automated tests pass, you can still miss the most critical failure scenario,” Aiyenitaju remarked.
“I’ve seen systems with ‘excellent’ coverage fail due to a lack of thoroughness in testing a high-risk path, or to subtle omissions of a low-risk path.”
He added: “At that point, it was apparent to me that coverage numbers do not measure risk. A test suite with 100 passes does not guarantee the application’s 100% effectiveness.”
“Systems with ‘excellent’ coverage fail due to a lack of thoroughness in testing a high-risk path.”
– Oladapo Aiyenitaju
Aiyenitaju said the focus shifts away from quantity towards impact. “As QA engineers gain experience, the job, aims, and scope become clearer. It’s no longer about running as many tests as you can, but about identifying where failure would have the most significant impact.”
“In highly regulated environments, every decision is weighted with consequence,” he stressed.
He added: “A bug in a banking flow can negatively affect the company and customer trust and compliance. A defect in healthcare software can cause delays in care or expose patient data.”
This is where Risk-Based Testing (RBT) becomes essential, as Aiyenitajua called it “a practical survival skill.”
“Risk-Based Testing is much more focused on making practical choices under pressure than in theory.”
“When timelines are short, release dates knocking on the door, which in most cases they almost always are, paying more attention to key areas of the application that matter most is wisdom.”
Prioritising what matters most
Aiyenitaju outlined several areas that demand focused attention. “If the main structure of the application fails, the system will definitely fail. No matter how beautiful or polished the front office is.”
“The system’s primary paths deserve the most thorough testing. This could be done manually or using automated testing.”
Security and access control are equally critical. “Access control is not optional in regulated industries.”
He pointed out that “small mistakes here are not just bugs; they can become security incidents that affect credibility and security, and can also affect the company’s continuity, either positively or negatively.”
“These areas need to be carefully validated, especially when changes occur.”
Data integrity is another often overlooked risk. “Some of the most significant bugs I have experienced were not visible at the surface level,” Aiyenitaju said.
“The UI looked good, the workflow worked out; however, the underlying data told a completely different story.”
He continued: “Data integrity is critical in banking and healthcare systems. Ensuring that data is created successfully, can be modified, and stored accurately without duplication or corruption.”
Integration points also introduce significant exposure. “What I have learnt over time is to treat integration points as first-class citizens in testing, since if an integration fails, the entire system will usually fail as well.”
Finally, recent changes remain one of the biggest sources of defects. “If I am limited by time, I always ask: What changed recently? Changes in features, refactorings, and configuration changes are generally where problems arise.”
Aiyenitaju stressed that “focusing your testing efforts on these areas will generally yield better results than spreading your efforts over the entire system.”
Better outcomes, and less anxiety
Moving away from the pursuit of full coverage has tangible benefits, both for system quality and for QA teams themselves.
Aiyenitaju said that “after I stopped trying to achieve 100 percent coverage and shifted toward a focus on risk, things began to shift, the application became more stable, and i could detect were major issues could arise based when we have a new feature added to the application, or a code refactoring etc.”
“With this, I got more stable results with my test application, and testing became more thoughtful. Releasing the product felt more manageable, my constant background worry disappeared.”
He noted that “risk-based testing creates alignment between QA and business reality.”
“Risk-based testing allows teams to make informed trade-off decisions rather than pretend everything can be tested equally.”
For QA teams in banking, healthcare and other high-risk industries, the takeaway is clear. “Quality is not about testing everything; quality is about testing what is most important, especially when the consequences of failure are severe,” Aiyenitaju said.
“When QA decisions are driven by risk rather than coverage metrics, teams can deliver with increased confidence even under intense pressure,” he concluded.
QA FINANCIAL EVENTS
Why not become a QA Financial subscriber?
It’s entirely FREE
* Receive our weekly newsletter every Wednesday * Get priority invitations to our Forum events *
REGULATION & COMPLIANCE
Looking for more news on regulations and compliance requirements driving developments in software quality engineering at financial firms? Visit our dedicated Regulation & Compliance page here.
READ MORE
- Inside banking’s shift to smarter QA to tackle complexity and risk
- SmartBear CPTO on AI in banking QA: ‘Impressive metrics but no critical scenarios’
- Banks push beyond traditional QA as resilience testing gains ground
- Banking QA professionals warn AI still doesn’t know ‘where the bodies are buried’
- RECAP: The QA Financial Healthcare & Insurance Forum Philadelphia 2026
WATCH NOW
QA FINANCIAL PODCASTS
CLICK HERE TO LISTEN TO OUR EXCLUSIVE CONVERSATIONS
