Defect Management and Reporting

Severity model

Severity	Definition	UAT treatment
S1 — Blocker/Critical	Channel unavailable; security/privacy breach; financial corruption or duplication; no safe workaround.	Immediate escalation. Release cannot be accepted while open.
S2 — High	Critical business process cannot complete or produces a materially wrong result; workaround is unsafe or unacceptable.	Fix and retest before acceptance unless the sponsor approves a documented exception.
S3 — Medium	Function is impaired but a safe workaround exists; limited users or data are affected.	Fix in the agreed release or accept with owner, target date, and regression assessment.
S4 — Low	Cosmetic, wording, or minor usability issue without material business impact.	May be deferred with a documented backlog reference.

Defect lifecycle

1. Tester records the defect with test ID, build, role, data, steps, expected/actual result, and masked evidence.
2. UAT Manager validates reproducibility and agrees severity/priority with the business owner.
3. CIS Project Team investigates and records cause, solution scope, and target build.
4. Tester retests the original case and affected regression cases.
5. Business owner closes, reopens, or accepts the residual risk with justification.

Daily UAT report

Metric	Daily value
Release/build
Planned / executed	/
Passed / failed / blocked / not run	/ / /
Pass rate	%
Open S1 / S2 / S3 / S4	/ / /
Top blockers and owners
Retests due
Decision or attention required