Bugwolf

Release Manager UAT

The Go/No-Go Decision: How Release Managers Should Read UAT Defect Data

A defect count is a poor go/no-go signal. Release managers need to read UAT defects by business journey, impact, workaround, residual risk, and explicit owner sign-off before opening the go-live gate.

Ash Conway

Ash Conway

Founder & CEO, Bugwolf

August 27, 202610 min read

The last UAT status meeting often produces the least useful question in a release: how many defects are still open? A programme with five open defects may be ready to release; another with one may not. The number says nothing about whether a customer order cannot be completed, a payroll result cannot be reconciled, or a workaround depends on an unavailable specialist at 7am on launch day.

Release managers hold the go-live gate because someone must turn test results into a decision the organisation can defend. That requires more than a red-amber-green dashboard. It requires a clear view of affected journeys, remaining exposure, operational recovery, decision owners, and the thresholds that would make continuing more dangerous than delaying.

Read defects through the business journey

Severity labels are frequently inconsistent. One team may mark a defect critical because it is technically difficult; another may mark the same business failure medium because a workaround exists. Reframe the defect log around the journey it interrupts and the consequence if it occurs in production.

  • Order to cash: can customers place, amend, fulfil, invoice, and pay for orders without revenue leakage or manual intervention?
  • Hire to pay: can workers be created, approved, paid, and reported accurately, including exceptions that affect payroll cut-off?
  • Procure to pay: can urgent purchasing, approvals, goods receipt, invoice matching, and payment continue without bypassing controls?
  • Close and report: can Finance reconcile balances, produce required reports, and correct a failed posting before the reporting deadline?
  • Access and support: can the people who operate critical journeys sign in, see their work, receive alerts, and escalate an incident?

Set release and rollback thresholds before the cycle starts

Do not invent the release criteria while stakeholders are waiting for an answer in the go-live meeting. Define entry, exit, contingency, and rollback thresholds at the start of UAT, then test and report against them throughout the cycle. This prevents date pressure from turning a known business risk into an improvised judgement call.

  • No unresolved defect may prevent completion of a defined critical business journey for its intended production users.
  • No release may proceed with unreconciled conversion, payroll, financial, customer, or regulatory data beyond the agreed tolerance.
  • A workaround must be documented, tested, resourced for the expected volume, time-bounded, and accepted by the accountable business owner.
  • Rollback triggers must name the measurable condition, decision authority, communication route, data implications, and steps for restoring service.
  • Any change to an agreed threshold must be recorded with its rationale and approved by the people carrying the business risk.

Make every open defect a decision-ready record

The go/no-go pack should not force executives to decode a technical ticket list. For every open or recently closed material defect, present the information needed to decide whether the risk is tolerable and whether the proposed control will work in the first days of operation.

  • The affected business journey, user population, trigger condition, and a plain-language description of the production consequence.
  • Current status, defect owner, target resolution date, evidence of retest where available, and dependencies that could change the position.
  • The tested workaround, its capacity and control limitations, the team that will perform it, and when it will be removed.
  • Residual risk stated in business terms, including financial, customer, operational, regulatory, security, and reputational exposure.
  • Explicit sign-off from the business owner for each accepted open defect, rather than a generic approval of the whole defect log.

Run the gate as a structured decision meeting

A go/no-go meeting should confirm evidence and make decisions, not discover late risks through an unstructured status call. Circulate the pack early, require owners to resolve questions before the meeting, and work through agreed criteria in a fixed order: coverage and exit status, critical journeys, open defects, cutover readiness, rollback capability, and explicit approvals. Record the decision, conditions, owners, and the next checkpoint so there is no ambiguity once the release window opens.

The go/no-go decision is not a vote on whether the defect count feels comfortable. It is a documented judgement about whether critical business journeys, recovery options, and accepted residual risks make release responsible.

Frequently Asked Questions

Why is a UAT defect count not enough for a go/no-go decision?

A count does not show whether defects affect a revenue-critical order, payroll, customer service, a rare internal report, or the same business journey multiple times. The release decision depends on consequence, reach, timing, recoverability, and ownership, not on the total number of tickets.

How should release managers prioritise open UAT defects?

Prioritise by the business journey affected, the population exposed, the likelihood of occurrence, financial or regulatory consequence, availability of a safe workaround, and time to recover. Technical severity is useful input, but it should not replace a business impact assessment.

What are rollback thresholds?

Rollback thresholds are pre-agreed conditions that require the release to be halted or reversed, such as failure of a critical transaction, unreconciled data, unavailable access for a core user group, or breach of a regulatory control. They should be agreed before the release begins, with authority and operational steps clearly assigned.

Who should sign off an accepted UAT defect?

The business owner accountable for the affected process should explicitly accept the residual risk, with input from technology, operations, security, compliance, or Finance where relevant. A project manager or release manager can coordinate the decision, but should not silently absorb a business risk on behalf of an owner.

Need a defensible go-live gate?

Talk to Bugwolf before go-live about turning UAT results and defect risk into a structured, evidence-led release decision.

Talk to the founder