Part I · Chapter 1 · The Ask · lesson 4
The bill is not the audit fee
13 min
Part I · Chapter 1 · The Ask · lesson 4
13 min
The quote arrives and it has one number on it. Somebody forwards it, somebody else says that is less than they feared, and the decision gets made on that number.
It is the wrong number. Not because it is misleading — it is a perfectly honest price for the thing it covers — but because it is the only part of this that somebody bothered to total up. Everything else arrives later, in hours, spread across people who were doing something else.
Predict
Costing one control takes two multiplications and an addition.
The scheduled part is instances a year, times hours an instance, times people in the room. A quarterly review that takes three hours and needs three people is thirty-six hours a year, and it is thirty-six hours whether the company has forty people or four hundred.
The event-driven part is the number of things that happen times the hours each one takes. Joiners, leavers and people changing teams all pull on the same control, and that count does move with the size of the company.
Add them and divide by eight to get person-days. One owner is taken to have some bounded share of a year to give this — a tenth of a working year is twenty-four days — and the question is whether the control fits inside it.
The control below is the recurring one where somebody with the standing to say no looks at who still has access and confirms each entry still has a reason behind it. In the registry it is "access-recertification". Four times a year, three hours each, three people in the room. Twenty-four joiner-and-leaver events in a year at forty people, an hour and a half each.
Control cost
Hypothetical model, not a forecast
The recurring effort one control consumes in a year, in person-days, and the headcount at which it outgrows a single owner.
It assumes
It ignores
One owner has twenty-four days a year for this. Ignore churn entirely and push the scheduled part alone past that — and get it only just past, not far past.
Scheduled operations of the control: 12 monthly, 4 quarterly, 52 weekly.
Hours one instance takes, per person involved.
| Headcount | From the schedule | From joiners and leavers |
|---|---|---|
| 1 | 4.5 | 0.112 |
| 10 | 4.5 | 1.13 |
| 25 | 4.5 | 2.81 |
| 40 | 4.5 | 4.5 |
Not there yet — keep moving the controls.
Nine person-days a year. One control. Half of it is the four reviews and half of it is the twenty-four joiners and leavers — the model splits them, and the split is the surprise, because the reviews are the part anybody would have thought to count.
The challenge lands at twenty-two instances: roughly fortnightly. A control performed every two weeks by three people for three hours has eaten a tenth of somebody's working year on its own, before a single person has joined or left. Most registers contain at least one control at that cadence, usually because somebody wrote fortnightly into a policy in an afternoon and nobody converted it into days.
Raise the headcount on its own and the total does not move. That looks like a bug and is not one: the model was told how many events happened, not how often they happen per person. Twenty-four events cost twenty-four events' worth of hours whether they happened among forty people or four hundred.
What the headcount does change is the rate — twenty-four events at forty people is a different per-person churn from twenty-four at four hundred — and the model uses that rate to answer a forward question: at what size does this one control stop fitting inside one owner's twenty-four days? At these numbers, a hundred and seventy-four people.
That figure is the useful one to carry into a hiring plan, and it is the one nobody computes, because the control feels free at forty people. It is free in the sense that nobody has been given it as a job. It is not free in the sense of not consuming nine days of somebody's year.
Check
Because it is the only one somebody is selling.
A fee has a supplier, a proposal and a signature. It fits in a budget line, it is comparable between two firms, and it arrives as a document with a total at the bottom. All of that makes it feel like the cost of the exercise, in the same way that a flight feels like the cost of a holiday.
The hours have no supplier. They are spread across people whose time is already spoken for, they turn up as a slightly later roadmap rather than as an invoice, and nobody receives a statement at the end of the year saying what they came to.
There is a practical move here, and it is not a spreadsheet. When the quote arrives, price two or three of the controls in person-days before anybody signs, and put that figure in the same email. It will not change the decision in most cases. It changes who is surprised in month seven.