How do you handle testing for regulated industries (banking, healthcare)?
60-second answer
Regulated environments need the same engineering practices plus evidence and traceability. I keep requirements traceable to tests and results, with automated reports as audit artefacts, versioned and retained. Test environments and data follow privacy rules, so production data is masked and access is controlled. Risk-based validation decides the depth of testing per feature, with formal sign-off for high-risk changes. Pipelines enforce segregation of duties, reviews and approvals, and generate immutable logs. Security and accessibility testing are mandatory. The trick is automating compliance evidence so it doesn't slow delivery.
Explanation
Typical requirements: SOX, PCI DSS, HIPAA, GDPR, DPDP, FDA 21 CFR Part 11, ISO 13485, ISO 27001.
Practices:
- RTM generated from Jira/Xray links and test results, not hand-written.
- Signed, time-stamped reports stored in an artefact repository.
- Change control via PR approvals and release records.
- Separation of test and production credentials; least privilege.
- Validation of test tools themselves (tool qualification) in some domains.
Example
A healthcare client needed documented evidence for every release. Allure reports, RTM exports and pipeline approval logs were bundled automatically into a release evidence package, reducing audit prep from two weeks to a day.
Sample code
- name: Build release evidence package
run: |
mkdir evidence
cp -r target/allure-report evidence/test-report
./scripts/export-rtm.sh ${{ github.ref_name }} > evidence/rtm.csv
gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/reviews > evidence/approvals.json
tar czf evidence-${{ github.sha }}.tgz evidence
- uses: actions/upload-artifact@v4
with: { name: release-evidence, path: evidence-*.tgz, retention-days: 2555 }