Clone this checklist for every release candidate. Each item should be checked or justified before production deployment. Record outcomes, owner, and date in your QA report.
- Acceptance criteria and scope validated with PM.
- Test plan updated with new features and regression areas.
- Test environment refreshed with latest build + migrations.
- Feature flags, credentials, and sample data prepared.
- Monitoring/logging endpoints accessible for triage.
- Happy paths exercised for every user story.
- Negative/edge cases validated per spec.
- API requests return expected payloads and error codes.
- Form validations, state persistence, and autosave flows behave as expected.
- Localization and currency rules display correctly (if applicable).
- 3rd-party integrations (payments, analytics, auth) validated in staging.
- Data model changes verified across downstream systems.
- Background jobs, queues, and cron tasks tested or dry-run.
- Webhooks, notifications, and emails rendered with correct content.
- Rollback/migration scripts tested on staging snapshot.
- Layout matches latest approved Figma designs.
- Responsive breakpoints tested for key devices (mobile, tablet, desktop).
- Browser compatibility confirmed for target browsers + versions.
- Content reviewed for spelling, tone, legal disclaimers.
- Animations/micro-interactions meet performance and accessibility guidance.
- Keyboard navigation works for all interactive elements.
- Screen reader audit performed (VoiceOver/NVDA) on critical flows.
- Color contrast meets WCAG AA.
- ARIA labels and semantic HTML validated.
- Focus management correct during modals, toasts, and dynamic content.
- Core Web Vitals measured in staging (LCP, INP, CLS).
- Critical API endpoints load-tested to agreed thresholds.
- Error budgets/SLIs reviewed; new alerts configured if needed.
- Caching and CDN rules verified (headers, invalidation).
- Memory/CPU utilization monitored during stress scenarios.
- Dependency scans run; high severity issues addressed or accepted.
- Authentication and authorization rules validated, including failure cases.
- Sensitive data storage and transmission reviewed (PII, secrets).
- Audit logging covers new flows.
- Compliance requirements (GDPR, SOC2, HIPAA) re-assessed.
- Release notes drafted and approved.
- Feature toggles / config flags documented with rollback steps.
- Support and success teams briefed on changes.
- Analytics dashboards updated with new events or metrics.
- Post-launch monitoring plan confirmed (who, what, when).
- QA Lead: ____________________ Date: __________
- PM: _________________________ Date: __________
- Engineering Lead: ___________ Date: __________
Store the completed checklist with the sprint/release documentation. If any item is intentionally skipped, add a rationale in the QA report and capture the risk in the RAID log.