Manual Testing and QA in Singapore

About Manual Testing and QA

We run manual QA on every website and app we build, so we offer it as a standalone service too. Send us a staging URL or a build and we write a test plan, run functional, regression, exploratory, cross-browser, and cross-device passes, then hand back bug reports your developers can actually act on. Flat quote against a written scope, GST included, back in 24 hours.

What the engagement includes

• A clear title and a one-line summary of exactly what is wrong.
• Numbered steps to reproduce, from a known starting point, so anyone can follow the same path to the same failure.
• Expected result versus actual result, side by side, so the defect is unambiguous and not a matter of opinion.
• The environment it happened in: browser and version, device, OS, screen size, and the specific build or URL.
• A screenshot or screen recording, plus the relevant console or network error where it helps pin down the cause.
• A severity and priority call, so your team fixes the checkout blocker before the cosmetic misalignment.
• Everything logged in your tracker (Jira, Trello, GitHub Issues, Linear, or a shared sheet), in the format your team already uses, not a PDF nobody opens.

The penetration testing licence, the public holiday calendar and IoT labels in Singapore manual testing

The first Singapore question in a manual testing engagement is where testing stops and penetration testing starts, because the second is a licensed activity here. Since Part 5 of the Cybersecurity Act took effect on 11 April 2022, nobody may engage in the business of providing a penetration testing service, or hold themselves out as willing to, without a licence from CSA's Cybersecurity Services Regulation Office, on pain of a fine of up to S$50,000, imprisonment of up to two years or both. The Office's guidance, updated on 29 September 2026, applies this to anyone serving the Singapore market, overseas providers, resellers and third-party vendors included, while employees of a licensed firm need no licence of their own. The Act defines the service as assessing a system's cybersecurity by searching for vulnerabilities in, and compromising, its defences, and lists determining vulnerabilities and demonstrating how they can be exploited, simulating attacks to test incident response, identifying and quantifying vulnerabilities with mitigation advice, and social engineering. That is broad enough that a QA plan with a section headed security testing can drift into it, so the statement of work draws the line in writing. Manual testing verifies that the system behaves as specified: a role without export permission sees no export button and is refused by the endpoint, a session ends when it should, a password reset link expires, a file of the wrong type is rejected, and every case traces to a requirement. Attempting to bypass those controls, chaining weaknesses to show impact or phishing your staff belongs to a licensed provider, which you can check against the Office's public list, and a tester who finds something that looks exploitable records the symptom and stops rather than proving it. Unless your testing provider holds the licence, penetration testing stays out of its quotation and its report titles, since holding out is itself caught. Whether a given activity falls within the definition is for the Office or your own counsel.

Singapore's public holiday calendar is a test oracle that changes every year, and 2026 shows why. Vesak Day on 31 May, National Day on 9 August and Deepavali on 8 November all fall on a Sunday, and the Ministry of Manpower lists the Monday after each as a public holiday for employees whose rest day is that Sunday, while Hari Raya Puasa on Saturday 21 March produced no Monday at all. Chinese New Year, Hari Raya Puasa, Hari Raya Haji, Vesak Day and Deepavali move with lunar and religious calendars, so their dates are loaded from MOM's published list rather than computed, and the list can still grow: 3 May 2025 was Polling Day, declared for a general election. For delivery promises, booking slots and service-level clocks we therefore test the substitute Monday, a Saturday holiday with none, the two days of Chinese New Year, which in 2027 fall on Saturday 6 and Sunday 7 February with Monday 8 February following, and a holiday added to the data after orders were already promised. Payroll and HR systems need a second set of oracles, because the Employment Act treats the same date differently by work pattern. A holiday on a rest day makes the next working day a paid holiday; on a non-working day, Saturday for someone on a five-day week, it earns another day off or an extra day's salary at the gross rate; and an employee absent without consent or reasonable excuse on the working day immediately before or after loses the holiday pay, though approved unpaid leave on one side only, MOM's example being 8 August, does not cost the holiday on 9 August. Working on the holiday earns an extra day's salary at the basic rate unless another arrangement is agreed. Each becomes a scripted case with the work pattern as input, rerun when the next year's list is loaded. How the rules apply to staff outside the Employment Act depends on their contracts, which is for your HR adviser.

If the product is a connected device with a companion app, Singapore's Cybersecurity Labelling Scheme turns part of the test plan into submission evidence. CSA rates consumer IoT devices at four levels, each requiring the assessment tiers below it in sequence: Tier 1 is a baseline drawn from ETSI EN 303 645 that targets common mistakes such as default passwords, missing security updates and no way to report vulnerabilities; Tier 2 is adherence to all the mandatory requirements of that standard; Tier 3 adds lifecycle requirements from IMDA's IoT Cyber Security Guide and an automated binary analysis by a test laboratory; and Tier 4 is penetration testing by a laboratory. For residential routers the label is not optional. Every router sold here must already meet Level 1, and CSA said on 2 March 2026 that it will work with IMDA to raise the mandatory level to Level 2 by the end of 2027, after a 2025 operation found over 2,700 infected Singapore devices in a global botnet. Tiers 1 and 2 are where manual testing earns its place, because many of the provisions are observable behaviour on a real unit and in the app: whether each device ships with a unique password or forces one to be set, whether pairing happens over an authenticated channel, whether an update can be installed and its availability is shown to the user, whether a factory reset removes personal data, and whether the published vulnerability disclosure contact actually reaches someone. Each applicable provision gets a case, run on production firmware and the store build of the app, with dated screenshots, logs and serial numbers kept as the evidence pack, so laboratory stages start from a device that already passes the baseline. Mutual recognition shortens some routes: Germany's IT Security Label counts as Level 2 here and compliance with the UK's PSTI Act as Level 1. Which level your product needs, and whether it falls in a mandatory category, is for CSA and IMDA to confirm.

How we work with Singapore clients

Singapore is the one market we serve where the working day is simply shared. We are two and a half hours behind you and neither country moves its clocks, so our morning starts partway through yours and the whole of your afternoon is live time for both sides. That changes the shape of an engagement more than anything technical does: a call is booked for the same afternoon rather than the same week, a question raised before your lunch is answered after it, and the written-first method we run for North American clients is a courtesy here rather than a necessity. We keep the written record anyway, with a default chosen on every open decision, because it is the thing an auditor or a new hire can read later and a call is not.

Invoicing is worth stating plainly because the GST position confuses buyers on both sides. We are outside Singapore, so no GST appears on our invoice. Whether you account for it yourself is the reverse charge question, and IRAS's own guidance is that a GST-registered business making only taxable supplies is not affected, while a partially exempt one accounts for it in its own return. We quote in Singapore dollars, the figure holds for the project whatever the rupee does, and payment by bank transfer or Wise avoids the card fees a five-figure invoice does not need. The contract can sit under Singapore law with Singapore courts, and unusually among our overseas markets that clause has teeth: Singapore is a reciprocating territory under section 44A of India's Civil Procedure Code, so a judgment of the Singapore High Court can be executed in India directly rather than re-litigated.

Questions Singapore clients ask

Manual Testing and QA: common questions

Other markets we work in