Risk-based software validation and change control

1. A method, implemented at a computer system that includes at least one processor, for performing risk-based software validation, the method comprising:

calculating a risk score for one or more features in a software application, the risk score indicating a relative level of risk for installing and using the software application;

performing internal usage testing, as well as feature cross functional testing, to determine how the software application is recommended for use;

conducting one or more tests to determine how a specified client uses the one or more features of the software application as compared to a determined recommended use; and

based on the calculated risk score and the determined client use of the one or more features, providing a recommendation for the specified client indicating which portions of the software application are to undergo client-specific validation.

2. The method of claim 1 , further comprising performing the client-specific validation on the recommended features.

3. The method of claim 1 , further comprising:

identifying a business practice (BP) for the specified client whose functionality is provided by the software application; and

testing the BP in the software application to ensure that the BP operates at a minimum threshold level of effectiveness.

4. The method of claim 1 , further comprising implementing one or more transfer performance qualifications (TPQs) to identify usage defects prior to a software application version release.

5. The method of claim 4 , wherein the TPQs are updated and re-executed for each software version release, ensuring that enhancements to software functions are included in the client-specific validation.

6. The method of claim 1 , further comprising performing an initial assessment of software risk including determining at least one of the following: 1) to which degree a specified software component is included in a best practice configuration for the software application, 2) to which degree a failure of the specified software component prevents standard usage of the software application, or 3) to which degree the specified software component was tested during software operation functional testing.

7. The method of claim 1 , further comprising performing an initial assessment of client risk including determining at least one of the following: 1) an amount of variation from a specified set of best practices for software application usage, 2) an amount of regulatory sensitivity, 3) a subjective risk assessment performed by the specified client, or 4) a degree to which a software component was tested during software performance usage testing.

8. The method of claim 7 , wherein an overall risk score is indicated by a software risk score and a client risk score.

9. The method of claim 1 , wherein the risk score is calculated for each new version of the software application.

10. The method of claim 1 , further comprising generating a risk presentation showing a personalized risk for the software application based on client usage, the risk presentation indicating how the risk score was calculated.

11. The method of claim 10 , wherein the recommendation is generated in a specified format.

12. One or more non-transitory computer-readable media that store computer-executable instructions that, when executed, implement a method for applying change control when upgrading a software application, the method comprising:

comparing a first version of a software application and a second version of the software application to identify differences in features and functionality between the first version of a software application and the second version of a software application;

determining whether the identified differences affect software modules or features that are integrated in the software application beyond a threshold amount;

performing internal usage testing to determine how the first version of the software application is recommended for use;

based on an identified level of integration and based on the internal usage testing, determining that a particular portion of the second version of the software application should undergo client specific validation; and

recommending the particular portion of the second version of the software application for client specific validation.

13. The one or more non-transitory computer-readable media of claim 12 , wherein a level of integration is calculated by identifying how many connections or logic paths the software modules or features have to other software modules or features.

14. The one or more non-transitory computer-readable media of claim 12 , further comprising:

determining that a second version of the software application has been released;

identifying which software modules or features have changed from the first version of the software application to the second version of the software application;

for those software modules or features that have changed, determining how integrated the software modules or features are; and

recommending which software modules or features are to be validated on a client specific environment.

15. The one or more non-transitory computer-readable media of claim 14 , further comprising identifying which software modules or features among those identified as having changed from the first version of the software application to the second version of the software application was used by a client beyond a threshold usage level.

16. The one or more non-transitory computer-readable media of claim 15 , further comprising validating those software modules or features identified as having changed from the first version of the software application to the second version of the software application, as being sufficiently connected, and as being sufficiently used by the client.

17. A computer system for applying change control when upgrading a software application comprising:

one or more processors; and

one or more computer-readable media having stored thereon executable instructions that when executed by the one or more processors configure the computer system to perform at least the following:

calculate a risk score for one or more features in a software application, the risk score indicating a relative level of risk for installing and using the software application;

perform internal usage testing to determine how the software application is recommended for use;

conduct one or more use tests to determine how a specified client uses the one or more features of the software application as compared to a determined recommended use; and

provide, based on the calculated risk score and the determined client use of the one or more features, a recommendation for the specified client indicating which portions of the software application are to undergo client-specific validation.

18. The computer system of claim 17 , wherein the executable instructions include instructions that are executable to configure the computer system to provide a change control interface that allows users to manage software changes, including installations and upgrades, in a controlled manner.

19. The computer system of claim 17 , wherein the recommendation is tailored to unique regulatory requirements of a specific business.

20. The computer system of claim 17 , wherein new software application features are analyzed for risk before inclusion in a new software application version.