1. A computer-implemented method for assessing risk of a software program and software updates to a program to prioritize verification resources, comprising: receiving software code for a software product for a testing assessment; analyzing the code according to a risk assessment criteria, the risk assessment criteria includes risk assessment factors; weighting the risk assessment factors for the code as part of the criteria; determining a risk assessment score of the code based on the criteria; and allocating testing resources in response to the risk assessment score.