Case study
Evidence, not assurances: an independent review of PRISM
Tetra Consulting's PRISM risk-management platform is built by an offshore development supplier, and Tetra had no independent way to judge the work. In 2023 we reviewed its codebases and AWS infrastructure; the findings shaped a strategy for the supplier relationship and a development consultancy that continues today.
2023–today
- 2 codebases
- reviewed, main and tablet, plus the AWS infrastructure2023
- 10–20%
- estimated test coverage on the supplier's tablet rebuild2024
- 3+ years
- as Tetra's development consultant2023–today
The challenge
Tetra Consulting offers PRISM, its own risk-management software, as part of its health and safety consulting. Development sat with an offshore supplier, and Tetra saw a risk in that relationship: thin documentation, few automated tests, logs nobody could reach, and a hosting environment only the supplier understood. With no technical capability of its own, Tetra had to take the supplier's word for the health of the platform.
What we did
- March 2023 — review of PRISM's main and tablet codebases using industry tooling and manual inspection, with read-only analysis of the AWS infrastructure
- 2023 — findings and next steps for the supplier relationship set out for Tetra's stakeholders
- 2024 — technical product ownership of the supplier's work, measuring the tablet rebuild's code health, tests and logging against what had been promised
- August 2024 — a strategy for change with Tetra: a separately run mobile project, hosting moved to Tetra-managed infrastructure with CI/CD, and KPIs the board can track
- Ongoing — development consultancy restructuring how Tetra's web, iOS and Android apps are built
What we built
The review found PRISM's core in good shape, with sound processes around it. The risk sat at the edges, in the web, mobile and tablet apps, where less experienced developers were placed. On the tablet rebuild, the improvements used to justify it had not arrived: we estimated test coverage at 10–20%, and logs were still held on the device with no way to retrieve them.
- Code health review of both codebases
- AWS infrastructure analysis
- Areas of concern and technical debt identified
- Evidence on tests, logging and code health
- Supplier KPIs the board can track
- Plan for Tetra-managed hosting and CI/CD
The result
Tetra's leadership got evidence instead of assurances: which parts of PRISM were sound, which needed attention, and specific questions to put to the supplier. The review became a development consultancy now in its fourth year, and in 2025 Tetra commissioned us to build an AI agent to quality-assure its fire risk assessments.
- AWS
- GitHub
- Android