Specifically considering client websites where we have been asked to execute a pen test; at what point do we stop and say we're done?

We have access to various tools (some automated, some manual); but if we say "we tried all our tools, and couldn't make any progress", that could be construed as us saying that we're not clever enough (and there's always some hacker out there who could be cleverer). 

So; how do we protect ourselves against upset clients who claim that we didn't work with due diligence? Is there a standard report framework we can work within?