Quality assurance vs quality control
In software, quality assurance is the set of process activities that prevent defects: defining how requirements are written, how code is reviewed, how tests are planned and how releases are gated. Quality control is the set of product activities that detect defects: executing tests, inspecting builds and reporting what fails. Assurance works on the process before the product exists; control works on the product once it does.
The longer version
Assurance is process-facing and preventive. Its outputs are standards and checks: a definition of done, a code review policy, a test strategy, a rule that no story enters development without acceptance criteria, an audit that those rules are being followed. Control is product-facing and detective. Its outputs are results: a test run with passes and failures, a bug report, a rejected build. A tester executing a regression suite is doing control. A test lead deciding that regression runs on every release candidate, and checking that it did, is doing assurance.
The terms come from general quality management and manufacturing, where control means inspecting units off the line and assurance means designing the line so fewer units fail; that sense is broader than this page, which is about software. The confusion in software is that one team, usually called QA, does both, and the label attaches to the people rather than the activity. Testing itself is entirely control. Verification and validation is a different axis again: it asks what a check is measured against, the specification or the user's need, rather than whether the activity prevents defects or detects them.
The practical failure is a team that does control and calls it assurance. Every release is tested, bugs are found and fixed, and the same classes of bug come back next release because nobody changed the process that produces them: requirements still arrive without acceptance criteria, reviews still skip the error paths, the staging environment still drifts from production. Control catches defects one at a time; only assurance reduces the rate at which they are created. A team that only measures bugs found has no way to see whether prevention is working, which is why escaped defects and defect removal efficiency are assurance measures read off control's output.
Common questions
Is software testing QA or QC?
Testing is quality control: it examines the built product and reports defects. Quality assurance is the process work around testing, such as deciding what will be tested, at which stage, to what standard, and checking that it was. The team labelled QA usually does both, which is where the words get merged.
What is the difference between QA and QC with an example?
A rule that every pull request needs a reviewer and a passing test suite before merge is assurance: it shapes the process so fewer defects get through. A tester running the checkout flow on a release candidate and filing three bugs is control: it inspects the product and finds what got through anyway.
Who is responsible for quality assurance and who for quality control?
Control is done by whoever tests: QA engineers, developers running their own tests, clients during acceptance. Assurance is owned by whoever sets and audits the process: a QA lead, an engineering manager or a delivery lead. In small teams one person holds both roles and the distinction lives in which hat they are wearing.
Which comes first, quality assurance or quality control?
Assurance, because it sets the process before there is a product to inspect: how requirements are written, when reviews happen, which tests run at which stage. Control starts once a build exists and produces the results assurance reads to judge whether the process is working. The two then loop, with each class of defect that control keeps finding feeding a change to the process that assurance owns.
Can a team have quality control without quality assurance?
A team that tests every release and fixes what it finds has control without assurance, and it is the commonest arrangement in small teams. The cost shows up as repetition: the same classes of defect return each release because nothing about how the work is produced has changed. Adding assurance means picking the recurring class, changing the rule that lets it through, and checking that the rule is followed.
Bug reports that arrive ready to triage.
Collect replay, console, network and browser context with the Free plan.