Lending platform testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: After each release, a test borrower can apply, sign the loan agreement and see the first repayment scheduled against the account they named.Risks: money-loss. Tool class: browser automation. Usually run by: QA engineer.
2. 2.unit testsDone when: APR, amortization schedule and late-fee results match a reviewed spreadsheet for every loan product, including month-end and leap-day due dates.Risks: data-corruption, money-loss. Tool class: unit framework. Usually run by: developer.
3. 3.integration testsDone when: A repayment posted by the processor updates the loan balance and next due date on the servicing screen, and a returned payment reverses both.Risks: money-loss, data-corruption. Tool class: API client. Usually run by: QA engineer.
4. 4.penetration testingDone when: An external tester cannot open another borrower's loan file by changing an ID, and cannot submit an application that skips the identity check.Risks: data-breach, fraud-abuse. Tool class: proxy. Usually run by: external lab.
5. 5.compliance checksDone when: For a sample of applications, a reviewer finds the dated disclosures, the identity checks performed and the adverse action notice stored with each file.Risks: regulatory-penalty, fraud-abuse. Tool class: test management. Usually run by: product manager.
6. 6.payment and money-flow testingDone when: In the payment sandbox, an autopay debit pulls only from the account the borrower authorized, and a granted extension cancels the debit scheduled for that date.Risks: money-loss. Tool class: API client. Usually run by: QA engineer.
7. 7.end-to-end functional testsDone when: A declined test application produces an adverse action notice whose reasons match the factors the decision engine logged for that applicant.Risks: wrong-decisions, regulatory-penalty. Tool class: browser automation. Usually run by: QA engineer.
8. 8.data integrity and migration testingDone when: The credit bureau file for a set of test loans shows the same status, balance and days past due as the servicing screen, including a loan paid on its due date.Risks: data-corruption, regulatory-penalty. Tool class: data validation. Usually run by: QA engineer.
9. 9.security scanningDone when: The latest scan of the application portal and loan API shows no open finding that exposes bank statements, SSNs or credit reports.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.