“Good testing involves balancing the need to mitigate risk against the risk of trying to gather too much information.”