When the likelihood or impact of a risk changes, the response should include adapting the testing effort accordingly. Since the risk level has increased,the coverage of the risk through test cases should be increased as well. This aligns with the principle of risk-based testing that uses updated risk levels to prioritize and adjust test planning and execution:
"Risk-based testing... involves product risk analysis which includes the identification of product risks and the assessment of each risk's likelihood and impact... The resulting product risk information is used to guide test planning, specification, preparation and execution of test cases".

The effectiveness of a review process can be measured by how well it detects and removes defects from the work products being reviewed1. One of the metrics that can indicate the defect detection capability of a review process is the number of defects found in production for each module that was reviewed2. This metric can show how many defects escaped the review process and were not detected until the software was deployed. A lower number of defects found in production means a higher review effectiveness. Therefore, option A is the correct answer. Option B is incorrect because the development language used to create each module that was reviewed is not relevant to the review process effectiveness. Option C is incorrect because the elapsed time between each module's review and its corresponding deployment into production is not a measure of defect detection or removal, but rather a measure of development speed or efficiency. Option D is incorrect because the business criticality of each module that was reviewed is not a measure of defect detection or removal, but rather a measure of risk or priority. Reference: 1: ISTQB Advanced Level Test Manager Syllabus, Section 2.3.2 2: Software Testing Metrics: What is, Types & Example

Cost of Quality Analysis:
The given table lists costs for defect prevention, appraisal, internal failure, and external failure.
Defect prevention cost is $50,000, while costs for appraisal, internal failures, and external failures are $250,000, $200,000, and $200,000, respectively.
The combined cost of internal and external failures is significantly high compared to defect prevention costs.
Defect Detection and Prevention (DDP):
DDP measures the effectiveness of defect prevention activities and early detection mechanisms.
In this case, 1,000 defects were caught before release (appraisal) and 100 defects escaped to production.
DDP = (Defects found before release / Total defects) = 1000 / (1000 + 100) = 90.91%.
While this DDP is relatively high, the costs of appraisal and failures indicate that prevention strategies need more investment.
Key Cost Drivers:
High internal and external failure costs indicate inefficiencies in earlier stages of quality assurance.
Shifting investments from appraisal and failure costs towards defect prevention would reduce the overall cost of quality.
Evaluating Options:
Option A ("More testing needed because DDP < 90%") is invalid since DDP is above 90%.
Option C ("The cost of testing is justified") does not address the imbalance between high failure costs and low prevention spending.
Option D ("More effort on appraisal") contradicts the cost-benefit focus of investing in prevention.
Option B is correct because enhancing defect prevention strategies will reduce downstream costs.
Reference and Syllabus Alignment:
This conclusion aligns with the ISTQB Advanced Test Management syllabus section on "Cost of Quality" and strategies to optimize testing investments. Specifically, prevention is emphasized as more cost-effective than appraisal and failure management.