The Quality Gate Everyone Wants to Skip
You lead a 9-month project delivering a customer-facing claims portal. The quality plan requires a load test at 3x projected peak traffic and a security penetration test before the final iteration. Both are scheduled in weeks 30-32. In week 29 the product owner reports that a competitor launched a similar feature and asks you to release in week 30 instead, skipping both tests, with a promise to 'test in production and patch fast.' The portal handles personal and payment data. Your defect log shows 3 open severity-1 defects, all in the payment flow, with fixes in progress. Historical data from your organization shows that projects skipping the load test have averaged 4x the post-release incident volume in the first 60 days.
1. Evaluate the product owner's request and respond.
Read the worked answer
The request trades a competitive advantage against a known, quantified risk on a system handling personal and payment data. Evaluate against evidence:
- 3 open severity-1 defects in the payment flow means the release is not stable on its most sensitive path. Shipping with known S1 defects in payments is not a schedule decision, it is a risk acceptance decision that needs the right authority.
- Skipping the load test removes the only evidence the system survives peak. The 4x incident history is your organization's own data - that is the strongest argument available.
- Skipping the pen test on a payment-handling portal may also breach contractual or regulatory obligations. Check before responding.
Response: decline to skip both, and offer a compressed path - run the pen test and a reduced-scope load test in a 5-day window, release in week 31, close the S1 defects first. Present the tradeoff explicitly: what the 5-day compression costs versus the expected incident cost. If the product owner still wants to release in week 30, that is a risk acceptance that must be documented and approved by someone with authority to accept it - not by the PM alone.
2. If leadership overrides you and directs the week-30 release, what is your responsibility?
Read the worked answer
Document, escalate appropriately, and make the residual risk visible - then support the release professionally if the decision stands.
Concretely:
- Write a risk acceptance record: the skipped tests, the 3 open S1 payment defects, the historical incident data, the regulatory exposure, and who accepted the risk and when.
- Ensure the acceptance is signed by someone with the authority to accept it - typically a business owner or executive, not the PM.
- Put a mitigation plan in place: monitoring on the payment flow, a rollback plan, on-call staffing for the first two weeks, and a committed date for the pen test post-release.
- Escalate to compliance or security if the payment-data exposure is not being acknowledged at the right level.
What you must not do is quietly comply and let the record imply the release was properly tested. Your responsibility is to make sure the decision is informed and attributable, not to make it disappear.