Can users finish their work?
Test a complete task, including corrections and exceptions. Compare totals, statuses and generated documents with the expected result. Include representative data volume and simultaneous work by more than one user.
Can a user reach forbidden data?
Use accounts with different roles and organizations. Test direct record URLs, API requests, search, reports and exports. A hidden menu item alone is not an access check.
Can you recover after a failure?
Restore a backup into a separate test environment and open the recovered records and files. Check encryption keys and integration credentials where they are needed. Measure the recovery time and decide whether the business can tolerate it.
Who responds when something stops?
Assign monitoring, support and maintenance to named people. Test an alert by stopping a worker or causing a safe test failure. Document how to retry failed work and how to check whether it already produced an external effect.