Waiting for review
Testing finished on Friday. The tester wrote the report on Monday and Tuesday and put it in the review folder. The only senior reviewer available is on a five-day engagement this week and next. They look at reports in the evenings, when they can. The client, who was told they would have the report within a week of testing, emails on Thursday asking where it is.
When the reviewer gets to it, half their comments are mechanical: the executive summary mentions a finding that was later downgraded, one section still has the template placeholder text, an IP range in scope does not appear anywhere in the results, and one finding is rated high where your guidelines say medium. The rest are the comments that actually need senior judgement.
The report goes back to the tester, who is now on another engagement. Round two happens the following week.
The client is not the only one waiting. The invoice cannot go out until the report is issued, so every day in the review queue is also a day of cash your firm has earned but not billed.
Why QA becomes the bottleneck
- Only a few people are senior enough to review, and they are also your most sought-after testers.
- Review time is not booked, so it happens in gaps and evenings.
- Much of the review is mechanical checking that does not need senior judgement.
- Reports come back for a second round because the first round mixed trivial and important comments.
- Nobody can see the queue, so promised delivery dates slip without warning.
What the queue costs
| Delay | Cost |
|---|---|
| Report late | Client chases, confidence drops |
| Senior time on mechanical checks | Less time for testing and judgement |
| Several review rounds | Tester context lost between rounds |
| No visible queue | Delivery promises made blind |
| Invoice tied to report | Cash delayed |
The review workflow we build
- Automatic checks run as soon as a tester submits a draft: every in-scope target appears in the results or is explained, no placeholder text remains, the client name is consistent, findings in the summary match the findings in the body, severities are within your guidelines, and required sections are present.
- The tester fixes anything the checks flag before the draft reaches a reviewer, so review starts with a clean document.
- Review time is booked as part of each engagement when it is scheduled, with a named reviewer, so it appears in the reviewer's diary rather than their evenings.
- The reviewer sees the draft with the automatic check results, the scope and the tester's notes in one place, and comments by finding.
- The queue is visible to operations: each report's promised date, where it is, and which reviewer holds it. Reports at risk of missing their date are flagged early.
- When the report is approved and issued, the invoice step and the remediation tracker are triggered automatically.
The checks run against reports from your reporting platform or its export. An AI model can help with some checks, such as flagging a summary that contradicts the findings, but it highlights issues for a person; it does not approve anything.
What delivery looks like afterwards
Reviewers spend their time on judgement: the quality of the evidence, the business impact, the clarity of the recommendations. The mechanical corrections are gone before they see the draft. Review time is planned, so reports move through on the days booked. Operations can tell a client exactly when their report will arrive, and be right.
Testers benefit as well. They get the mechanical feedback within minutes of submitting, while the engagement is still fresh, instead of a week later when they are deep in the next client's environment.
Over time, the automatic checks also show which kinds of mistakes are most common, which tells you where testers need guidance or templates need fixing.
Is your review queue like this?
- Reports wait days or weeks for a senior reviewer.
- Reviewers correct the same mechanical mistakes repeatedly.
- Reports go through several review rounds.
- Clients chase for reports after the promised date.
- Nobody can see which reports are waiting and for whom.