If new software is not sufficiently tested and approved, potential errors cannot be detected. In addition to endangering the productive use and information security of the software itself, such errors may impact other applications and IT systems in the productive environment.

If security functions or basic security requirements are not tested, there is no guarantee that the developed software will meet the security requirements of the organisation using it. As a result, sensitive information could be disclosed, manipulated, or destroyed (e.g. by unauthorised third parties who can access the software due to inadequate authentication functions).