Prepare a document with all the use cases. Detail the actions that each user role will be able to perform on the site and the way that the system should react to those actions.
Setup the VCS and code deployment workflow. Document it somewhere where you can share it privately and securely with the other team members.
During Development
Prepare user roles. Export them in code.
Create one user per role for internal testing purposes.
Verify that no pieces are still relying solely on the DB (features overriden or pieces not included in features or code)
Before Staging
Export all functionality into features. Nodes, views, blocks, vocabularies, roles, permissions, input filters, wysiwyg profiles.. everything that's exportable should be prepared for deployment via features or code.
Make sure the site is reverting correctly by running clean installs on your local environment.
Run a functionality test (see below)
During Staging (Dry Run Deployment Before Prod)
Check for conflicts in the features. All features should contain unique pieces of the site and should not overlap.
If a piece of functionality is missing, check if the feature was exported in code. If it wasn't, go back and find out why it wasn't exported in code.
After Deployment.
Check all user roles. Verify each role has just the right permissions.
Check one more time what permissions are assigned to authenticated and anonymous users and make sure there is a justification for them. i.e. view fields, or create comments.
Log in with test users from the roles with the least permissions and test the site trying to do the things the user is not supposed to do. Repeat gradually going towards users with all permissions.
Run at least once through all the use cases, hitting all the pages that you prepared functionality for.
Run through the pages that you don't expect the users to access and confirm they can't get to them.
Functionality Test:
If the site allows registration. Can the users register correctly? Is there a captcha present.
If applicable, can the users log in correctly?
If applicable, can the user request their password correctly.
Is the server capable of sending email messages.
Is cron setup and running correctly?
Are the automatic server notifications going out to an email address that will be monitored by the stakeholders?
Is the file system accessible to Apache only on the folders that Drupal requires?
Can Apache create new folders?
Quality Assurance: (The Tesla Test)
Check all the copy used in messages and notifications that the end user will receive.
Check for typos.
Check for broken links.
Check for areas of improvement. For every page you visit, try to answer the question: how can we do this section better?