Rank failures by consequence
Start with actions involving payment, account access, data loss, lead capture, or legal obligations. Then consider traffic and change frequency. A rarely used settings screen and the signup form should not receive equal attention.
Keep this risk map short and revise it after incidents. The best test plan reflects what has actually gone wrong, not only what seemed important at project kickoff.