Build a risk-based mobile test matrix and production acceptance record.
Mobile behavior changes with device resources, operating systems, permissions, networks, backgrounding, interruptions, account state, localization, accessibility settings, and upgrades. Build a matrix from user impact, platform distribution, architectural risk, and production evidence.
Prioritize critical journeys and states
List install, first launch, onboarding, sign-in, recovery, primary jobs, payment if applicable, notifications, deep links, settings, support, sign-out, update, and uninstall. For each, identify data loss, security, financial, accessibility, or trust consequences and the device capabilities involved.
Cover the mobile environment
- Supported devices, screen sizes, orientations, OS versions, and resource levels
- Fresh install, upgrade, restore, background, force-stop, restart, and interrupted state
- Offline, slow, switching, captive, metered, and failed network conditions
- Granted, denied, limited, revoked, and changed permissions
- Accounts, roles, locale, time zone, font scaling, screen reader, and input methods
- Security, privacy, battery, storage, performance, analytics, crash, and recovery evidence
Balance test layers
| Layer | Best coverage | Gap alone |
|---|---|---|
| Automated unit and integration | Rules and repeatable interfaces | Real device and platform behavior |
| Emulator or simulator | Fast configuration breadth | Some hardware and system interactions |
| Physical device and user test | Real lifecycle, performance, and usability | Expensive exhaustive combinations |
Build the release matrix
- Rank user journeys by consequence.
- Select representative device and OS tiers.
- Automate stable high-value checks.
- Exercise lifecycle, network, permission, and failure transitions.
- Run accessibility, security, performance, and exploratory sessions.
- Triage defects and preserve release evidence.
Test transitions, not just screens
- Losing input when the app backgrounds
- Permission denial creating a dead end
- Upgrade leaving cached or migrated data inconsistent
- Notifications opening the wrong account or stale state
Record coverage and residual risk
For each configuration record build, device, OS, account state, network, permissions, locale, assistive technology, scenario, result, defect, retest, and owner. Summarize untested combinations and why production monitoring or rollout controls make residual risk acceptable.
Continue with the next decision
Sources and further reading
Primary and contextual sources used to verify definitions or give readers a relevant next resource.
- Android core app quality Official Android quality guidance.
- OWASP Mobile Application Security Verification Standard Primary mobile application security verification standard from OWASP.