exploratory-testing

Overview

Session-Based Test Management (SBTM) is the dominant framework for managing exploratory testing as a measurable, accountable activity. It was developed by Jonathan Bach + James Bach (1999-2000) and is documented at satisfice.com/sbtm.

The unit of work is a session - a time-boxed (60-90 min) chunk of focused exploratory testing against a mission stated as a charter. Sessions produce session sheets that capture what happened in a structured-enough format for management to aggregate, while leaving room for the tester to learn freely.

Exploratory testing is not "clicking around". ISTQB defines it as testing where "tests are simultaneously designed, executed, and evaluated while the tester learns about the test object" (ISTQB CTFL Syllabus v4.0.1 §4.4.2, p.44). Human-driven testing has two modes, and this skill owns one of them:

For the scripted side (step-tables, Gherkin, UAT scripts, checklists), use manual-test-script-author. This skill covers the exploratory side end to end: charter, session, heuristics, debrief, review.

When to use

• Onboarding a tester to SBTM vocabulary.
• Authoring a charter - what fields belong, what mission framing to use (references/charter-template.md).
• Picking which tour, heuristic, or oracle to apply in a session (routing table below).
• Reviewing a session sheet for completeness (references/session-review-checklist.md).
• Building a session-tracking dashboard.

How to use

1. Write the charter - "Explore with to discover ". Keep it a mission, not a test-case list. Ready-to-fill card: references/charter-template.md.
2. Time-box the session - 60-90 min, one charter, uninterrupted; ~2-hour hard cap before focus degrades.
3. Test and record - explore per the charter (applying tours + heuristics from the routing table below) and log Areas, Bugs, and Issues in the session sheet as you go. Full template: references/session-sheet-and-metrics.md.
4. Track TBS - note the Test / Bug / Setup split (plus Opportunity / Idle). Verify: T should land in the healthy 60-80% range before you trust the session; if T < 50%, stop and fix the cause (stabilise the environment or narrow the charter), then re-run the session before aggregating.
5. Close with PROOF - debrief Past, Results, Outlook, Obstacles, Feelings with the lead within 24h (full template + worked example: references/debrief.md; lead-side review rules: references/session-review-checklist.md).
6. Aggregate on the dashboard - roll sessions up weekly (throughput, avg T%, charter progress) to drive strategy, not a bugs-per-session KPI.

The unit: a session

Per Jonathan and James Bach's SBTM paper (satisfice.com):

"A session is an uninterrupted block of reviewable, chartered test effort... A session may be short (around 60 minutes) or long (up to about 2 hours). Two hours is generally considered the upper limit because tester focus degrades."

Properties of a session:

• Time-boxed: 60-90 minutes typical; absolute upper bound ~2 hours
• Chartered: has a stated mission (what to explore, what to learn)
• Uninterrupted: no context-switching to other work mid-session
• Reviewable: produces a session sheet that the lead can review

The charter

A charter states the mission for one session. Per Bach:

Explore <area>
With <tools / resources>
To discover <information>

Example: "Explore the cart promo-stacking flow with manual sample inputs to discover discount-application bugs." More charter examples are in references/session-sheet-and-metrics.md; a full charter-card template (mission + areas + oracles + dimensions + tours + deliverables) is in references/charter-template.md.

Charters are not test cases. They state what to investigate and leave the how to the tester's judgment in the session.

A backlog of charters drives multi-session campaigns. The lead prioritises charters per the test strategy (test-strategy-author) and the risk register (risk-matrix).

Choosing a heuristic or tour

Each reference is a distinct lens; a strong session composes 2-3, never all of them. Route by what the session needs:

The catalogs complement each other: tours give the session a theme, SFDPOT gives variations, HICCUPPS-F interprets observations, and CRUSSPIC STMPL frames the criteria. Bach + Bolton's Rapid Software Testing curriculum teaches them as one toolkit.

The session sheet and metrics

Each session produces a session sheet whose sections are: Charter, Areas, session timings, TBS metrics, Data files, Test notes, Bugs, Issues (meta process problems), and the PROOF debrief. The TBS time-breakdown splits each session into T (test design + execution), B (bug investigation + reporting), and S (setup / overhead), plus Opportunity and Idle. Healthy ranges: T 60-80%, B 10-20%, S 10-15%; T under 50% signals trouble.

Full sheet template, the TBS definitions, and the cross-session dashboard metrics: references/session-sheet-and-metrics.md.

PROOF debrief

Every session closes with a PROOF debrief - the five-section report from the original Bach & Bach SBTM paper:

The debrief flow: the tester fills the PROOF template within 30 min of session end (memory fades fast); every Result links a bug ID or a confirmed-working item; Outlook names the recommended next charter (the chain to the next session); the lead reviews the debrief with the tester briefly (5-10 min) within 24h before the session sheet is filed, using the checklist in references/session-review-checklist.md. Feelings is the load-bearing field teams skip - the tester's qualitative judgment is signal no metric captures. Aggregated debriefs drive the next round of charters: which areas are well-covered, which are stale, which were never touched.

Full blank template, a fully worked debrief, the quarterly rollup table, and the attention tracker: references/debrief.md.

Worked example

A full 90-minute session (charter, timings, bugs, issues, TBS, PROOF outlook, and how the lead acts on it) is worked through in references/session-sheet-and-metrics.md.

Common confusions

Anti-patterns

Limitations

• Requires tester skill. The framework's value rises with tester expertise; it doesn't make bad testers good.
• Cadence overhead. Sessions + sheets + reviews add coordination cost - worth it for medium-+ teams, overhead for solo testers.
• Charter authoring is hard. Vague charters produce vague sessions; charter discipline pays off.
• Dashboard interpretation requires context. Raw metrics (sessions/week, bugs/session) can mislead without charter framing.
• Doesn't replace automated coverage. SBTM is for exploration, not regression - pair with automated suites.

References

• Bach J., Bach J. Session-Based Test Management (2000) - satisfice.com/download/session-based-test-management.
• Bach J. Exploratory Testing Explained - satisfice.com/exploratory-testing.
• Bolton M. Exploratory testing series - developsense.com.
• Hendrickson E. Explore It! (Pragmatic Bookshelf, 2013) - book.
• ISTQB CTFL Syllabus v4.0.1 §4.4.2 (exploratory testing definition) - istqb.org.
• Bundled references: session-sheet-and-metrics.md, tours.md, fcc-cuts-vids.md, sfdpot.md, hiccupps-f.md, crusspic-stmpl.md, charter-template.md, debrief.md, session-review-checklist.md.
• manual-test-script-author - the scripted-manual sibling (step-table, Gherkin, UAT, and checklist formats).
• bug-bash-facilitator - multi-cohort bug bash; inherits the PROOF debrief format.