Software risk management has been receiving increasing attention lately. A key activity of software risk management is the quantification of the risk of using a software product. Previous attempts to define the risk index have taken the users' viewpoint. The loss due to a product failure is computed based on its impact on the users. Yet, the impact of a failure on the software producer is different from that of the users. A high risk module according to the users may not be treated the same by the producer. This paper presents a method to determine the producer risk index for quantifying the probability and impact of failure on the producer at the product release time. The producer can use the results to determine whether it is more economical to improve the software quality or to release the product with the achieved quality level. The index can also be used to estimate the maintenance effort. The approach makes use of two recent developments in software complexity metrics, principal component analysis and reliability growth modelling. A new classification scheme for failure impact is introduced. Results from applying the producer risk index to a telecommunication software system are presented.