Test Implementation
Test implementation is the test activity that gets everything ready to run the tests. In the ISTQB Foundation syllabus v4.0 it follows test design: testware such as test data is created or acquired, test cases are organised into test procedures and test suites, test scripts are written, an execution schedule is set, and the test environment is built and verified.
Analysis decides what to test and design decides how; implementation answers a practical question: can execution start tomorrow morning? For a new promo-code feature, that means ordered procedures, promo codes and accounts loaded, the right build on staging with the payment sandbox connected, and an agreed order for the suites.
Why it matters
Execution time is usually the scarcest time in a release. Every hour lost to a missing test account, the wrong build on staging or a suite waiting for another is an hour not spent finding defects. And an environment that is not what you think it is gives false results: tests that fail for reasons unrelated to the product, or passes that production would not repeat.
For the tester, implementation is where design becomes repeatable: a procedure with a stated set-up and wrap-up can be run by a colleague, re-run after a fix and automated later.
What implementation produces
Test design ends with test cases, test data requirements and the environment the tests need. Implementation turns them into concrete testware. The ISTQB syllabus lists these work products:
- Test procedures: test cases in execution order, with the actions that set up their preconditions and wrap up afterwards.
- Test scripts: manual step-by-step instructions or automated code that carry out the tests.
- Test suites: procedures or scripts executed together in one test run.
- Test data: the actual accounts, records, files and values that meet the data requirements.
- The test execution schedule: which suites run in which order, when and where.
- Test environment elements: the environment the tests run in, plus stubs and drivers that stand in for missing components (as in the lesson on component testing), simulators that behave like a real device or system, and service virtualisation, which imitates whole dependent services.
- 1Test cases from designWith test data requirements and environment needsInput
- 2Test procedures and scriptsCases in execution order, with set-up and wrap-upPrepared at the same time
- 3Test data createdSeeded, recorded, restorable
- 4Environment builtBuild, configuration, stubs, test accounts
- 5Test suitesProcedures grouped for one test run
- 6Test execution scheduleOrdered by priority, dependencies and available resources
- 7Readiness checkSmoke suite and readiness checklist, with evidenceGate
Branch: An item fails: fix it or move the suites it affects, then check againFail
Then:Test execution starts with the first suite in the schedule
Simplified: implementation overlaps with test design, and the readiness check is repeated for every new build.
Procedures, suites and the execution schedule
A test case says what to check; a test procedure says in what order to run several cases and what to do around them. Cases that share preconditions belong together: one procedure sets up a logged-in customer with a full cart once, runs its cases and cleans up, so the next procedure starts from a known state.
Procedures are grouped into suites for a purpose (smoke, feature, regression), and the schedule orders the suites. ISTQB names three common prioritisation strategies: risk-based (tests for the most important risks first), coverage-based (tests that achieve the most coverage first) and requirements-based (tests for the requirements that stakeholders rank highest first). Two limits apply: a test that others depend on runs first even if its priority is lower, and the order must fit when the people, tools and environments are available.
Below, one procedure shares one set-up across three cases. The schedule shows all three rules: the smoke suite runs first because every other suite depends on a testable build, the promo suite comes next because it carries the highest risk, and the checkout suite waits for the afternoon window in which the payment sandbox is booked.
TP-PROMO-01 Apply and remove a promo code
Set-up: account cust-basic-01, cart baseline CART-3 (3 items, 240.00 SAR)
promo codes loaded: SAVE10 (active, 10%), OLD5 (expired)
Run: TC-03 apply SAVE10 -> discount 24.00, subtotal 216.00
TC-05 remove SAVE10 -> subtotal back to 240.00
TC-07 apply OLD5 -> "This code has expired", subtotal unchanged
Wrap-up: empty the cart, reset the usage count of SAVE10
Execution schedule, staging, day 1
09:00 Smoke suite (8 checks) must pass before any other suite
09:30 Promo suite TP-PROMO-01..03 highest risk: changes what customers pay
13:00 Checkout regression suite payment sandbox booked 13:00-17:00Creating test data and readying the environment
Design said what data the tests need; implementation creates or acquires it: seed scripts or files for accounts, products and orders in the right states, and a recorded baseline you can restore between runs, so a different result comes from the software, not from leftover data. Prefer synthetic or masked data: real customer records copied into a test environment are still personal data.
The environment is then built and verified, which means checked, not assumed: the expected build is deployed, configuration that affects behaviour is set as planned, third-party services are reachable or replaced by a stub, and every test account can log in. A smoke test, a short suite covering the main functionality, then shows the system works well enough for planned testing to begin.
Try it: Test Data Factory Try it: SQL Dataset Generator Try it: Fake User Generator Try it: Mock API Response Generator
Worked example: a readiness checklist
Before the promo-code suites start, the tester works through a readiness checklist and records each result with evidence, so "I think we are ready" becomes checks anyone can repeat. Many teams use such a checklist as the entry criteria for execution, the preconditions that must hold before it starts. The ISTQB syllabus lists available environments and test data, and passed smoke tests, among typical entry criteria.
A failed item does not mean "start and hope". On the first run, the payment sandbox timed out: the promo suite, which never reaches payment, started on time, the checkout regression suite waited, and the problem went to the sandbox owner.
- Build: version 4.2.0 is on staging and matches the release notes.
- Configuration: the
promo_codesflag is on, prices are in SAR, and the time zone matches production, because code expiry depends on it. - Test data: cart baselines and the codes SAVE10 and OLD5 are loaded; the restore script has run once.
- Accounts: a test account for each role (customer, support agent) can log in, and guest checkout works without an account.
- Integrations: the payment sandbox responds (failed on the first run); the SMS service is replaced by a stub that records messages.
- Testware: procedures TP-PROMO-01 to 03 are reviewed, traced to their test cases and loaded as a test run.
- Observability: testers can read application logs and the browser console.
- Smoke suite: all 8 checks pass on this build.
Common mistakes
- Copying test cases into the tool without set-up, wrap-up or order, so one failure leaves data that breaks the next cases.
- Creating test data by hand on execution day, with no record and no way to restore it.
- Assuming the environment is ready because it was last sprint, instead of verifying build, configuration and integrations each time.
- Scheduling by priority alone, so a high-priority suite waits for data only a lower-priority suite creates.
- Skipping the smoke test and finding a broken deployment after an hour of failed and blocked tests.
The QA perspective
On a real team, implementation overlaps with design and starts once the first test cases are stable. Send environment and data requests early, because others fulfil them: developers or DevOps engineers deploy builds and configure environments, a database owner may run seed scripts, and the test lead agrees the schedule.
Record what you prepared: procedures and suites traced to test cases, the data baseline and how to restore it, the build and configuration under test, and the dated readiness result. Before execution, ask: which build exactly are we testing? What does the stub not simulate? Who restores the data if a run corrupts it? The next lesson, test monitoring and control, starts from these records.
Practice exercise
Implement the tests for a password reset
Test design produced six test cases for "Forgot password" on a web app: TC-1 request a reset link for a registered email; TC-2 request one for an unregistered email (same neutral message); TC-3 open the link and set a new valid password; TC-4 open a link older than its 30-minute validity; TC-5 reuse a used link; TC-6 log in with the new password.
Implement them: build the procedures, order them, list the test data and environment elements, and write a readiness checklist of at least six items.
- Group cases that share preconditions into procedures and write each set-up and wrap-up.
- Order the procedures, noting dependencies.
- List the data and environment elements, including how reset emails are received, then write the checklist.
Show the model answer
Procedures: TP-1 "Request a reset" (set-up: a registered account and an unregistered address; wrap-up: clear the captured emails) runs TC-1 and TC-2. TP-2 "Use a reset link" (set-up: a fresh link for the registered account) runs TC-3, TC-6, then TC-5, which must refuse the used link; wrap-up: restore the baseline password. TP-3 "Expired link" (set-up: a second seeded account with a link older than 30 minutes, so it cannot interfere with TP-2; wrap-up: undo any change to the clock or the validity setting) runs TC-4.
Order: TP-1 first, because it proves reset emails arrive; then TP-2, whose cases depend on each other. TP-3 needs a link older than 30 minutes: request it at the start of the session and run TC-4 once 30 minutes have passed, or ask the developers for a way to expire links, such as a shorter validity setting or a controllable clock, so it can run at any time.
Data and environment: two seeded accounts with a known baseline password, test addresses on a reserved domain such as example.com, an email capture service or stub so reset emails never reach a real person, a way to expire links or time to wait, and the build under test on staging.
Checklist: the build is deployed and recorded; the email capture receives a test message; both seeded accounts log in; the password restore works; link expiry can be simulated, or the 30-minute wait is in the schedule; testers can read the logs; a smoke check of login and the reset page passes.
Frequently asked questions
What is the difference between a test case and a test procedure?
A test case states the preconditions, inputs, steps, expected results and postconditions for one check. A test procedure is a sequence of test cases in execution order, plus the actions that set up preconditions before them and wrap up after them. One procedure often runs several cases that share a set-up.
Is test implementation the same as writing automated tests?
No. Writing automated test scripts is part of implementation when tests are automated, but implementation also covers manual procedures, test data, suites, the execution schedule and the environment. A team with no automation still implements its tests.
How does test implementation map to the STLC phases?
The STLC is an industry model, not an ISTQB term. Its "test case development" phase covers test design plus most of implementation, and its "test environment set-up" phase is the environment part of implementation shown on its own. The work is the same; only the grouping differs.
Who is responsible for the test environment?
It varies by team. Developers, DevOps or platform engineers often build and deploy it, and testers verify that it is ready for the tests they planned. Whoever builds it, execution should not start until the readiness checklist has been run and its result recorded.
References
- ISTQB Certified Tester Foundation Level (CTFL) v4.0The foundation syllabus of software testing: test levels and types, test design techniques, test management and tools.
- ISTQB GlossaryThe standard definitions of testing terms — test case, regression testing, severity, priority, boundary value analysis and the rest.
- ISO/IEC/IEEE 29119-2:2021 — Software and systems engineering — Software testing — Part 2: Test processesThe test process model: organisational, test management and dynamic test processes, with their activities and outcomes.
Practise with Mutqan tools
One-stop factory for synthetic test data: users, customers, companies, addresses, numbers, dates and strings in JSON, CSV, SQL or XML.
Generate SQL seed scripts (CREATE TABLE + INSERTs) with realistic test rows for any dialect.
Generate fake user records (name, username, email, password, avatar seed, role) for test accounts.
Generate test email addresses with safe reserved domains (example.com, test) and plus-addressing variants.
Generate complete mock API responses (status, headers, JSON body) for success, list, detail, error and empty cases.
Check several API health endpoints at once and get status, latency and a pass/fail summary.
Go deeper
- Software Testing Life Cycle (STLC)Phase 3 — Test case development (test design and implementation)
- Software Testing Life Cycle (STLC)Phase 4 — Test environment set-up
- Smoke vs Sanity vs Regression TestingSmoke testing: is the build testable?
- How to Write a Test PlanPrioritisation, schedule and resources
Your progress on this topic
Not started
Mark the topic complete when you have studied it and done the exercise.
Sign in to track your progress
Mark topics complete, continue where you left off and unlock specialisation exams.