📖 Quality Triad: Plan → Assure → Control

🇺🇸 English

Quality Planning (Plan Quality Management): Define quality standards, metrics, and how quality will be measured. Output: Quality Management Plan.

Quality Assurance (QA): Audit of quality PROCESSES to ensure they are being followed correctly. Proactive, done during execution. Identifies process improvements.

Quality Control (QC): Inspecting DELIVERABLES to verify they meet quality standards. Reactive, identifies defects. Compare to acceptance criteria.

Key distinction: QA = process audit (are we doing things right?). QC = product inspection (did we do it right?).

Gold-plating: Adding features beyond agreed scope "as a bonus." This is NOT quality improvement — it risks unintended impacts, wastes budget, and should be avoided.

Reference: PMI — Quality Management Fundamentals

🇻🇳 Tiếng Việt

Quality Planning: Xác định tiêu chuẩn chất lượng, metrics và cách đo lường. Output: Quality Management Plan.

Quality Assurance (QA): Kiểm tra QTRÌNH chất lượng để đảm bảo chúng đang được tuân thủ đúng. Proactive, thực hiện trong execution.

Quality Control (QC): Kiểm tra KẾT QUẢ để xác minh chúng đáp ứng tiêu chuẩn. Reactive, xác định defects.

Phân biệt quan trọng: QA = kiểm tra quy trình. QC = kiểm tra sản phẩm.

Gold-plating: Thêm tính năng ngoài phạm vi đã đồng ý "như một bonus" — KHÔNG phải cải thiện chất lượng, cần tránh.

AspectQuality Assurance (QA)Quality Control (QC)
FocusProcess (How we work)Product/Deliverable (What we produce)
TimingDuring execution (ongoing)After work is done (inspection)
NatureProactive (prevent defects)Reactive (find defects)
WhoPM, QA team, process auditorsQC team, testers, inspectors
OutputProcess improvement recommendationsVerified deliverables, defect reports
ExampleAuditing code review process complianceRunning regression tests on released build

💰 Cost of Quality (CoQ)

🇺🇸 English

Cost of Quality is the total cost incurred to prevent poor quality plus the cost when quality fails. Two categories:

Cost of Conformance (doing quality right):

  • Prevention costs: Training, process design, standards documentation — costs to prevent defects
  • Appraisal costs: Testing, inspections, audits — costs to find defects before delivery

Cost of Non-Conformance (paying for failures):

  • Internal failure costs: Rework, scrap — defects found before delivery
  • External failure costs: Warranty claims, lost business, reputation damage — defects found after delivery

PMP principle: Prevention is cheaper than inspection. Inspection is cheaper than failure. "Pay now or pay more later."

🇻🇳 Tiếng Việt

Cost of Quality (CoQ) là tổng chi phí để ngăn ngừa chất lượng kém + chi phí khi chất lượng thất bại.

Cost of Conformance (làm đúng từ đầu):

  • Prevention costs: Training, thiết kế quy trình — chi phí ngăn ngừa lỗi
  • Appraisal costs: Testing, kiểm tra — chi phí tìm lỗi trước khi giao

Cost of Non-Conformance (trả giá cho thất bại):

  • Internal failure: Làm lại, hủy — lỗi tìm thấy trước khi giao
  • External failure: Claim bảo hành, mất kinh doanh — lỗi tìm thấy sau khi giao
Cost of Quality Analysis
── COST OF CONFORMANCE ────────────────────────────────── Prevention Costs • Developer training on secure coding $5,000 • Code review process documentation $1,000 • Automated testing infrastructure setup $8,000 Total Prevention: $14,000 Appraisal Costs • QA team testing (3 sprints × 2 weeks) $12,000 • Security audit (external) $10,000 • UAT coordination $3,000 Total Appraisal: $25,000 ── COST OF NON-CONFORMANCE ────────────────────────────── Internal Failure • Bug rework time (est. 15% of dev time) $18,000 Total Internal Failure: $18,000 External Failure • If data breach occurs: regulatory fines $200,000+ • Customer churn (est. 5% if bugs at launch) $50,000 Total External Failure (risk-adjusted): $30,000 ── TOTAL CoQ ───────────────────────────────────────────── Invest $39K in conformance to avoid $48K+ in failures = WORTH IT
🎯
Exam Tips — Quality Management
  • QA = process, QC = product — this distinction is always tested
  • Gold-plating is WRONG — even if well-intentioned, it's scope creep disguised as quality
  • Prevention > Inspection > Internal failure > External failure (cost order, cheapest to most expensive)
  • In Agile: quality is built in via Definition of Done, automated testing, and continuous integration
  • Fitness for use = meeting customer needs. Conformance to requirements = meeting specifications. Quality = both.
  • Deming's Plan-Do-Check-Act (PDCA) cycle underlies quality management

🔧 Quality Tools

ToolPurposeWhen to UseExample
Cause-and-Effect (Fishbone/Ishikawa)Root cause analysisWhen a quality defect is foundAPI timeout root cause: 6M framework (Machine, Method, Material, Man, Measurement, Environment)
Pareto Chart80/20 rule — identify top causesPrioritizing defect resolution80% of bugs come from 20% of modules → focus there
Control ChartMonitor process stability over timeOngoing process monitoringAPI response time tracked; alert when outside upper/lower control limits
HistogramDistribution of defects by categoryUnderstanding defect patternsBugs by sprint, by component, by severity
Scatter DiagramCorrelation between two variablesTesting cause-effect relationshipTeam size vs defect rate correlation
ChecksheetStructured data collectionManual inspection, auditDeployment checklist, code review checklist

💼 Thực chiến / Scenario

🏢

FinTech Company X — Quality Incident & Root Cause

Situation: Sprint 7 production deploy của Project Alpha. Critical defect: loan application data from Partner Bank A showing incorrect interest rates due to a rounding error in the credit engine. 3 customer applications affected before caught.

QC finding: Unit tests for the calculation module did not cover edge cases for rates above 18%. Integration tests didn't include real bank rate schedules.

QA process audit (Fishbone analysis):

  • Method: Definition of Done did not require interest rate edge case coverage
  • Man: Developer who built module was new PH team member, unfamiliar with local rate regulations
  • Measurement: No acceptance criteria for rate calculation accuracy in stories

Cost of Non-Conformance: $15,000 in rework + remediation. $5,000 regulatory notification cost. No external failure — caught before broader impact.

Corrective actions (QA improvements): DoD updated to require rate edge case coverage. Acceptance criteria template updated with mandatory precision requirements. Partner bank rate schedule added to test fixtures.

PMP lesson: Quality management is a system — one defect reveals a process gap. Fix the process, not just the bug.

✏️ Practice Questions

Question 1
A developer adds extra security features to an application module because they believe it will make the product better, even though these features were not in the requirements. This is an example of:
  • A. Quality assurance in action
  • B. Gold-plating, which should be avoided
  • C. Scope management best practice
  • D. Proactive risk mitigation
✅ Answer: B — Gold-plating. Adding unrequested features, even beneficial ones, is gold-plating. It consumes budget/time not in the plan, may create unintended side effects, and wasn't validated by the customer. PM should ensure work aligns to approved scope through change control — even "improvements" need approval.
Question 2
The project team is reviewing their code review and testing processes to ensure they are being followed consistently by all developers. This is an example of:
  • A. Quality Control
  • B. Quality Assurance
  • C. Quality Planning
  • D. Cost of Conformance
✅ Answer: B — Quality Assurance. Auditing/reviewing PROCESSES (code review process, testing process) to ensure compliance = QA. Quality Control (A) would be inspecting the actual code/output. Quality Planning (C) was done earlier to define the process. Cost of Conformance (D) is a financial concept, not an activity.
Question 3
A Pareto analysis of defects shows that 78% of all bugs came from 3 modules out of 20 total modules. What is the BEST PM action?
  • A. Fix all 20 modules equally since all bugs matter
  • B. Focus quality improvement efforts on those 3 modules first — Pareto principle (80/20 rule) means maximum impact from targeted effort
  • C. Remove the 3 problematic modules from scope
  • D. Assign more testers to the other 17 modules
✅ Answer: B — The Pareto principle (80/20 rule) states that roughly 80% of effects come from 20% of causes. Here, 3 out of 20 modules (15%) are responsible for 78% of defects. Focusing improvement effort on these vital few modules delivers maximum quality gain for minimum effort. Spreading effort equally (A) is inefficient. Removing modules (C) changes scope without solving root causes. Adding testers elsewhere (D) targets the wrong modules.

🤖 AI Tools for PMs

🤖
How AI Augments This Process

AI helps PMs generate QA checklists, analyze defect patterns using Pareto logic, draft root cause analyses, and create quality reports that connect technical metrics to business impact.

Sample Claude Prompts

Definition of Done quality checklist generation Generate a Definition of Done (DoD) checklist for our development team. Project type: [web app / mobile / API / data pipeline] Team practices: [code review / automated testing / CI/CD pipeline] Quality standards we must meet: [security / performance / accessibility / regulatory] Stakeholder acceptance criteria requirements: [what customer expects before accepting a story] Create a DoD checklist with criteria across these dimensions: 1. Code quality (review, standards, coverage) 2. Testing (unit / integration / regression / performance thresholds) 3. Security (OWASP checks, secrets scanning, dependency vulnerabilities) 4. Documentation (inline code docs, API docs, runbook) 5. Deployment readiness (feature flags, rollback plan, monitoring) 6. Product acceptance (AC met, PO demo, no P1/P2 open) Flag which items are "must pass" vs. "best effort" and suggest automation checkpoints.
Defect root cause analysis I have a production defect or quality incident. Help me run a root cause analysis. Defect description: [what failed, observable symptoms] Affected area: [module / feature / integration] Discovery method: [found in QA / UAT / production / customer report] Severity: [P0/P1/P2/P3] User/business impact: [what happened to users or business] Timeline: [when introduced vs. when found] Initial hypothesis: [what we think caused it] Run a structured RCA using the Fishbone (Ishikawa) 6M framework: - Machine (systems, tools, infrastructure) - Method (process, procedures, frameworks) - Material (data, inputs, dependencies) - Man (human error, training gaps, communication) - Measurement (testing coverage, monitoring, alerting) - Environment (deployment, config, external factors) Output: 1. Most likely root cause with evidence 2. Contributing factors 3. Why wasn't this caught earlier? (QA process gap) 4. Corrective actions (fix the defect) vs. preventive actions (fix the process) 5. Lessons learned entry
Quality metrics dashboard narrative I need to write a quality section for my sprint / project report. Quality data: Test coverage: [%] Defects found this sprint: [count] — severity breakdown: P0:[n] P1:[n] P2:[n] Defects resolved: [count] Open defects: [count] — aging: [average days open] Escaped defects (found in prod): [count] Test pass rate: [%] Performance: [API p95 latency, error rate, uptime] Write a quality narrative that: 1. Gives a RAG status with 1-sentence justification 2. Highlights the most important quality signal (positive or negative) 3. Explains any defect trends (improving / stable / worsening) and root cause 4. States what the QA team will focus on next sprint 5. Connects quality to business impact (avoid pure technical metrics) Keep it under 200 words, suitable for a steering committee report.

Jira / Confluence Template

Confluence — Sprint Quality Report
── CONFLUENCE: SPRINT QUALITY REPORT ──────────────────── Sprint: [Sprint #] | Date: [YYYY-MM-DD] | QA Lead: [name] Status: 🟢 Green / 🟡 Amber / 🔴 Red ── DEFECT SUMMARY ──────────────────────────────────────── New defects: [count] | P0:[n] P1:[n] P2:[n] P3:[n] Resolved: [count] | Net delta: [+/-] Open total: [count] | Avg age: [days] Escaped to prod: [count] | Severity: [highest] ── TEST COVERAGE ───────────────────────────────────────── Unit test coverage: [%] (target: >80%) Integration test pass rate: [%] Regression suite: [pass/fail] | Duration: [minutes] Performance (p95): [ms] (SLA: <500ms) ── ROOT CAUSE — TOP DEFECT ─────────────────────────────── Defect: [Description of top defect this sprint] Root cause: [Brief RCA finding] Prevention: [Process change to prevent recurrence] ── NEXT SPRINT FOCUS ───────────────────────────────────── Priority: [what QA will focus on] | DoD update: [any DoD changes]