Testing
How To Test Banking Domain Applications: A Complete BFSI Testing Guide
#1) Requirement Gathering
Requirement Gathering phase involves the documentation of requirements either as Functional Specifications or as Use Cases. Requirements are gathered as per customer needs and documented by Banking Experts or Business Analyst.
Experts are involved in writing requirements on more than one subject as banking itself has multiple sub-domains and one full-fledged banking application will be the integration of all these domains.
For Example, A banking application may have separate modules for Transfers, Credit Cards, Reports, Loan Accounts, Bill Payments, Trading Etc.
#2) Requirement Review
The deliverable of Requirement Gathering is reviewed by all the stakeholders such as QA Engineers, Development leads and Peer Business Analysts.
They cross-check that neither existing business workflow nor new workflows are violated. All the requirements are verified and validated. Follow up actions and requirement document revisions are done based on the same.
#3) Business Scenario Preparations
In this stage, QA Engineers derive Business Scenarios from the requirement documents (Functions Specs or Use Cases); Business Scenarios are derived in such a way that all Business Requirements are covered. Business Scenarios are high-level scenarios without any detailed steps.
Further, these Business Scenarios are reviewed by Business Analysts to ensure all of the Business Requirements are met. It is easier for BAs to review high-level scenarios rather than reviewing low-level detailed Test Cases.
For example, a customer opening a Fixed deposit on the digital banking interface can be a business scenario. Similarly, we can have different business scenarios related to net banking account creation, online deposits, online transfers, etc.
#4) Functional Testing
In this stage, functional testing is performed and the usual software testing activities are performed such as:
Test Case Preparation: In this stage Test Cases are derived from Business Scenarios, one Business Scenario leads to several positive test cases and negative test cases. Generally, tools used during this stage are Microsoft Excel, Test Director or Quality Center.
Test Case Review: Reviews by peer QA Engineers
Test Case Execution: Test Case Execution could be either manual or automatic involving tools like QC, QTP, etc.
The functional testing of a banking application is quite different from ordinary software testing. Since these applications operate with customer’s money and sensitive financial data, they are required to be tested thoroughly. No important business scenario should be left to be covered.
Also, the QA resource who is testing the application should have the basic knowledge of the banking domain.
#5) Database Testing
Banking Application involves complex transaction which is performed both at UI level and Database level, Therefore, Database testing is as important as functional testing. The database is complicated & an entirely separate layer in the application and thus its testing is carried out by database specialists. It uses techniques like:
- Data loading
- Database Migration
- Testing DB Schema and Datatypes
- Rules Testing
- Testing Stored Procedures and Functions
- Testing Triggers
- Data Integrity
The major purpose of database testing is to ensure that:
- The Application is able to store and retrieve data from the database without any loss of data.
- Completed transactions should be committed and aborted transactions are reverted back to avoid any mismatch in data stored.
- Only authorized applications and users are allowed to access the database and the underlying tables.
There are primarily three ways of Database Testing:
- Structural Testing
- Functional Testing
- Non-Functional Testing
Structural Testing
It involves testing the database objects like databases, schema, tables, views, triggers, access controls, etc. Ensuring that data types in tables are in sync with the corresponding variables in the application. Validating data and referential integrity in the tables.
For Example, An amount field in the application should have a data type of decimal/float in the table.
– In order to comply with standards, users should be given access controls through views.
Functional Testing
It involves testing the databases that satisfy user requirements. There are two ways to achieve: Black box testing and White box testing.
For Example, When we do an online money transfer, the sender account should be debited and the receiver account should be credited with the exact same amount. If the transaction fails then whole transactions should be reverted and the sender account should not be debited or credited back.
Non-Functional Testing
It involves load & stress testing and performance optimization. Load testing helps in identifying the most number of transactions that can be performed concurrently without impacting database performance.
For Example, Based on the input from load and stress testing banking applications can decide to add more resources to their application during peak business hours and reduce the resources during off business hours. This helps the bank to make optimum use of resources and save money.
#6) Security Testing
Security Testing is usually the last stage in the testing cycle. A prerequisite to commencing security testing is the completion of functional and non-functional testing. Security testing is one of the major stages in the entire Application testing cycle as this stage ensures that application complies with Federal and Industry standards.
Due to the nature of the data they carry, banking apps are very sensitive and are a prime target for hackers & fraudulent activities. Security testing makes sure that the application does not have any such web vulnerability that can expose sensitive data to an intruder or an attacker. It also assures that the application complies with standards like OWASP.
In this stage, the major task is the whole application scan which is carried out using tools like IBM AppScan or HP WebInspect (these are the most popular tools).
Once the scan is completed, the Scan Report is published. Over this report, False Positives are filtered out and the rest of the vulnerabilities are reported to the Development team so that they start fixing the issues depending on the severity of each issue.
Penetration testing is also done at this step to reveal the propagation of errors. Rigorous security testing should be done across platforms, networks, and OS.
Some Other Manual tools for Security Testing used are Paros Proxy, Http Watch, Burp Suite, and Fortify.
The main purpose of security testing is to pinpoint any vulnerabilities the software application, may have.
The security testing tests the application against:
- Any external attack or attempt to hack the application with malicious intent.
- Any loophole in the software application could be exploited causing data or monetary loss.
- Any vulnerability in the network, servers, and workstations that hosts the application.
Following are the various types of security testing:
Vulnerability Testing: An automated program is developed and executed to check for various vulnerabilities.
Security Scanning: This variant revolves around investigating network and system vulnerabilities, provide solutions to reduce the associated risk.
Penetration Testing: This variant of security testing imitates a hacking attempt to capture vulnerabilities and loopholes, which otherwise could have gained access to the database or the application data.
Security Auditing: It involves auditing of the application and the associated networks for any security lapses.
Risk Assessment: This variant does an analysis to assess the level of risk, in an event when a vulnerability or loophole is exploited for malicious intent. Such risk could be categorized in to low, medium and high. Based on the level of risk, proper measures are advised by the testing team to reduce or avert the risk.
Ethical Hacking: This is performed by an organization on its systems to identify loopholes that could be exploited in its application or network. The intent of this kind of hacking is not to steal or cause damage to the application or network.
Posture Assessment: This is an umbrella assessment comprises of security scanning, risk assessments, and ethical hacking.
SQL Injection: SQL Injection could be used to gain access to the server database. The testing is done to ensure that the code is working correctly, which execute queries on the database based on following inputs from user:
- Brackets
- Apostrophes
- Commas
- Quotation Marks
Other Stages In Testing BFSI App
Apart from the above main stages, there might be different stages involved such as Integration Testing, Usability testing, User acceptance testing, and Performance Testing.
Let us talk in brief about these stages as well:
Integration testing
As you know that in a banking application, there might be several different modules like transfers, bill payments, deposits, etc. And thus, there are a lot of components developed. In integration testing, all the components and integrated together and validated.
Usability Testing
A banking application serves a wide variety of customers. Some of these customers might lack the skills and awareness required to perform the banking tasks over the app.
Thus, the banking application should be tested for simple and efficient design to make it usable across different groups of customers. The simpler & easy to use interface is, the higher number of customers will be benefited from the banking application.
It’s about examining the level of ease, business users or bank customers have in using the application. This testing is not performed by the developer or tester but is performed by the business users.
For Example, Nowadays everyone uses mobile apps. The banking app should be user-friendly and easy to understand and use by the end-user.
Types Of Usability Testing
Comparative Usability Testing: This is comparison-based testing, where ease of usability of one website or application with another. The target for such testing is to provide the best user experience.
Explorative Usability Testing: The aim of this testing is to identify what features should the new application or software should possess in order to meet the bank’s customer requirements.
Following are advantages and disadvantages of Usability Testing
Advantages:
- The end-users of the application are usually involved with the testing, hence first-hand feedback is obtained.
- Rather than spending time on analysis and discussion about a feature that a product should have or not, it is better to get the inputs from the end-user directly.
- We can catch any potential issues beforehand.
Disadvantages:
- As multiple end-users are involved in testing, their opinions if not precise can affect the requirement.
- The feed from end-users may get influenced.
Performance Testing
Certain periods of time like payday, end of the financial year, festive seasons might bring in change or spike in the usual traffic on the app. Hence, thorough performance testing should be done so that customers don’t get affected by performance failures.
A significant example from the past where bank customers got personally affected due to performance failures is NatWest and RBS cyber Monday IT outage in which the customers had their debit and credit card got declined transactions across shops in the country.
User Acceptance Testing
This is done by involving the end-users to ensure that the application complies with the real-world scenarios and will be accepted by users if it goes live.
In today’s scenario majority of Banking Projects are using: Agile/Scrum, RUP, and Continuous Integration methodologies, and Tools packages like Microsoft’s VSTS and Rational Tools.
As we mentioned about RUP above, RUP stands for Rational Unified Process, which is an iterative software development methodology introduced by IBM which comprises of four phases in which development and testing activities are carried out.
Four phases are
i) Inception
ii) Collaboration
iii) Construction and
iv) Transition
RUP widely involves IBM Rational tools.
Sample Test Cases For Banking Application
Test cases for New Branch
- Create a new branch with valid and invalid test data.
- Create a new branch without data.
- Create a new branch with existing branch data.
- Verify the reset and cancel options.
- Update branch details with valid and invalid test data.
- Update branch details with existing branch test data.
- Verify if the new branch can be saved.
- Verify the cancel option is working.
- Verify the branch deletion with and without dependencies.
- Verify if the branch search option is working.
Test Cases for New Role
- Create a new role with valid and invalid test data.
- Create a new role without data.
- Verify a new role can be created with existing test data.
- Verify the role description and role types.
- Verify the cancel and reset option is working.
- Verify the role deletion process with and without dependency.
- Verify the links in the role details page.
- Verify the admin login without test data.
- Verify all home links for the admin role.
- Verify the admin can change the password with valid and invalid test data.
- Verify the admin log out successfully.
Test cases for Customer and Banker
- Verify if all visitor and customer links are working properly.
- Verify the customer login with valid and invalid test data.
- Verify the customer login without any data.
- Verify the banker login without any data.
- Verify the banker login with valid or invalid test data.
- Verify the customer or banker can log out successfully.
Test cases for New users
- Verify if the new user can be created with valid and invalid test data.
- Create a new user with existing branch test data
- Verify if the cancel and reset option is working properly.
- Update user details with valid and invalid test data.
- Verify the deletion of the new user.
- check if the new user can be verified.
- Verify mandatory input parameters.
- Verify optional input parameters.
- Verify if a user can be created without optional parameters.
Test cases for the creation of a New Account
- Create a new account with valid and invalid user data.
- Verify if user details can be updated.
- Verify if a new user can be saved.
- Create a new account with the existing user’s data.
- Verify the user can deposit the amount in the newly created account (and update the balance).
- Verify the user can withdraw an amount from the new account (after deposit and update the balance).
- In the case of salary, account verify the company name and other details are provided by the user.
- Verify if the primary account number is provided in case of a secondary account.
- Verify user details provided in cases of the current account.
- Verify the provided proofs for joint account in case of a joint account.
- Verify whether able to maintain zero balance in salary account.
- Verify whether able to maintain zero balance or minimum balance for the non-salary account.
- Verify the new user can log out successfully.
Test Cases For Net Banking Application
- Check if the user is able to open the bank site.
- Check if all the links on the site are working.
- Verify if the user is able to create a new account.
- Check if the user is able to login with valid and invalid username and password.
- Verify if either of the username or password is blank while login, the user should not be allowed to login and an alert message is shown.
- Check if the user is allowed to change the password.
- If an invalid user or password is entered proper error message is shown.
- Users with an invalid password should not be allowed to log in.
- Verify that after repeated attempts to log in with an incorrect password, the user should be shown an error message and blocked.
- Check if the user is able to perform some basic transactions.
- Verify that the user is able to add a beneficiary with valid and invalid details.
- Verify if the user can delete the beneficiary.
- Verify that the user is able to make transactions to the newly added beneficiary.
- After transaction verify if the accounts of both user and beneficiary are updated.
- Check if the user is able to enter the amount in decimal number.
- Verify if the user is not able to enter negative numbers in the amount field.
- Verify if the user is allowed to do transactions with or without minimum balance.
- Verify if the user can do a new RD.
- Verify that proper message is shown in case of transaction done with insufficient balance.
- Check if the user is asked for confirmation before any transaction is done.
- Verify if acknowledgment receipt is provided on each successful transaction.
- Verify if the user is able to transfer money to multiple accounts.
- verify if the user can cancel the transaction.
- Verify that account details reflect financial transactions done also.
- Verify that the time-out feature is implemented.
- verify that in case of session time out a user should log in again.
- verify that proper session time out is done in case any inactivity.
- verify that while doing transaction user is taken to secure mode.
- Verify if the user can log out successfully.
- Verify search and reset options.
Conclusion
In this article, we discussed how complex a Banking application could be and what are the typical phases involved in testing the application. Apart from that we also discussed current trends followed by IT industries including software development methodologies and tools.
Feel free to share your experience or queries on this topic!