As a tester in a normal test situation, you test with a set of requirements. These requirements provide us information how to test the application and what is needed to do that. Do we than have all the requirements? No, we don’t.
The “requirments” we have are explicit. We know of their existence and where they can be found. Our customers and/or stakeholders provide us only with these requirements in the form of documents. This information tells us, how the application is designed. Does it?
As a software tester we need to understand “how the application is designed?”, to know the application properly and to make the application work in a very efficient manner by identifying risks. A good tester will make use exploratory tests as an approach to identify those risks.
Some of these risks tend to be implicit requirements. A very simple example.
The value of the search variable is a number value. Here you already have tsome implicit requirements. One is very easy, negative numbers are not allowed for search strings. Another, which most of the time is forgotten, is the maximum value. Unless it is specifically mentioned that negative numbers are also used, you have the implicit requirement that you to deal with the maximum value of the number on the negative side. If you don’t deal with this properly, you can get very strange behavior in your application.
One specific example I experienced is the following. In the mobile telecom world, our handset (mobile telephone) uses a SIM card. This SIM card has an identifier which is called ISMI. This IMSI number is used to register to the mobile network, no matter where you are. One specific detail about the IMSI. It is a string of 15 numerical characters, e.g. 204160544313597. You find this not in the requirements, because it is common knowledge within our field. What most of the people forget is that there is an IMSI range still operational that consist out of 14 numerical characters. We have here an implicit requirement that this IMSI string consist out of a range with a length between 14 and 15 numerical characters.
Just two examples to illustrate that the requirements you get from the customers/stakeholders are not complete. You still have implicit requirements.
So, implicit requirements are gathered from experience and proper understanding of the application. A good tester knows how to find them.