Should I voluntarily provide a risk report to our customer?

Question

We are a consultant firm that offers software testing services to our customers. Once our contract is finished, we will no longer have access to customers sites or projects.

Recently one thing is bugging me:

• The project we have been working on suffers from a large number of bugs
• Developers apply patches, which have fixed newer bugs but the patches introduced new bugs as well
• The deadline for this project is 28th July 2017, it is very likely for this project to fall apart

Should I voluntarily provide a risk assessment report to our customer to indicate this project is risky after its delivery?

Answer 1

In short, you do not have to submit a specific risk report but you can indicate the risks in your exit report.

As a rule, when contract testers finish their deployment at a customer site, they need to submit an exit report. This report is consisted of:

1. Report Summary
2. Software overview
3. What is in scope and what is not
4. Metrics
5. Tests executed
6. Testing environment and tools
7. Lesson learnt
8. Best practices
9. Recommendations
10. Exit Criteria
11. Management sign off
12. Appendix

There are a few places that you can describe the risks in detail or in summary and provide statistical arguments. As a sample, what you could do is:

Software overview

• Include a statement of how well this software fulfills its purpose; is there any deviation from design specifications?

Metrics

• Include metrics of outstanding bugs by the time this project delivers; many outstanding bugs is associated with high risks

Tests executed

• Is there any tests you would like to execute but could not due to incomplete features?

Lesson learnt

• Is there any critical issues and have they been resolved?

Exit Criteria

• If exit criteria is not met, the project is at risk by default.

Management sign off

• If you think this project is at risk, please do NOT sign if off.

Answer 2

You can ask them if they are interested in your report about the risks. You can suggest providing quick overview for free (as a good will gesture), and do more detailed research if they are interested to pay for it.

If they are not interested paying, you did not wasted too much of your resources. But when (not if) something goes wrong, you can say "we were aware of it and warned you".

You need to talk to management, this is a business decision: how providing such information will affect future relations with this particular client.

Answer 3

Generally, Yes, we should provide a risk report. But in your particular case, you should NOT.

We categorize risks in following two categories:

1. Internal

2. Customer shared

So,We maintain a risk register and whatever risks we see; should be communicated to customer, we share the risks falling under Customer Shared category with customer in calls/meetings.

But, we do it well in time.

And we also share the mitigation and contingency plan for the risks.

What's wrong with your case?

In your case, the problem is that, risks have not been shared with the customer in a timely manner and now when only 15 days are left for the project delivery, you want to share the risks with the customer. This is not a good idea. Client would be furious because this is a blunder from your project side.

What should you do?

I would not suggest you to hide the facts from customer. But don't share a formal risk report with the customer now. Try to fix whatever you can in whatever time is left in the project delivery and informally; during meetings and calls; try to give the customer some idea about the problems. Do not set a meeting or share a document at this point in time. It will be disaster. All your focus will shift towards pacifying the customer when your main focus should be to bring the project back on track.