I work in as an IT auditor in the InfoSec profession. A colleague of mine in the IT Security department has asked me to peer review / provide my professional opinion on an application penetration testing / vulnerabilities report he has completed. This particular report is scheduled to be presented to senior management later this week.

My department cooperates frequently with Information Security department in a lot of the work we do. In the past, the InfoSec department has been very helpful to me in other work I did (PCI compliance among several other projects). I also have completed peer reviews in the past for work to be presented to management, both for my colleagues within my department, and for InfoSec team members.

However, I have several end of the quarter tasks that must be done by the end of the week to include different reviews / process audits. On top of this all, I am also in the middle of planning for several audits that will begin at the end of the year. I do not think I will have enough time to provide a professional, through peer review to my colleague with all the work I have. Anything less than through and honest feedback I feel would be unprofessional on my part.

How do I communicate to my colleague in Information Security that I cannot complete his request as politely as possible?


Don't overthink this. Just tell your colleague what you have told us here, that is clear and polite. You are making it clear that you cannot do the code review because you are overwhelmed with other important tasks. More importantly, a code review done "just to get it over with" would not only be unprofessional, but also cause potential harm to the project, especially if they hold your reviews in high regard.

You should also try to offer them an alternative so that their work doesn't get stalled just because you don't have the time. That way, you also avoid making it sound like "this is not my problem". Suggest them to contact someone else who you think could do the code review instead, or if there is no one like that, suggest (or even offer) to ask management to find someone.

It is quite common for IT folks to get overwhelmed with tasks every once in a while. I don't see any reason why your colleague would need to be offended by your refusal, as long as you are not a jerk about it (which you clearly are not).

In summary, something like the below should do:

I am afraid I wouldn't be able to do this code review because I am overwhelmed with other critical tasks. I am concerned that if I tried doing the review without my full attention to it, the review wouldn't be effective and I would likely miss something important.

I would suggest talking to John Doe and see if he can spare the time to do the review instead. If you insist on me doing the review, I will have to talk to my manager and let him decide the priority.

Not the answer you're looking for? Browse other questions tagged or ask your own question.