The cheapest thing that would actually address it

One risk, written as a sentence with a victim in it: a former contractor keeps working access to the customer database for months, because contractors arrive through a different process from employees and nobody owns closing it.

Three designs address it. They cost roughly nothing, a few engineer-days, and a five-figure annual licence plus an integration project. The usual assumption is that they sit in increasing order of strength.

They do not. They sit in increasing order of purchasability, which is a different ordering and the reason the expensive one gets chosen.

Predict

Three designs for the same risk: a monthly reminder to check, an automatic closure hung off the contract end date, and an identity platform that provisions and removes contractors centrally. Which produces the best evidence of operation?

Choose one answer

The platform — it reports continuously and produces more records than the other two combinedThe automatic closure, because the artefact is a dated ticket per contractor that nobody had to writeThe monthly reminder, since a person writing down what they found is a direct recordAll three equally — evidence quality is about discipline, not design

Lock in answer

What would you do

A sixty-person company. Fourteen contractors at any time, arriving through two routes: most via an agency with a contract record in the finance system, a few directly through engineering with nothing but a Slack message and a start date.

The ops lead has about two hours a month for this. One engineer could spend three days building something. There is budget for a platform if somebody writes the case, and the security questionnaire from a large buyer arrives in two months.

Optimising for

Within one quarter, every contractor's access ends when their contract does, with a dated artefact per contractor that a stranger could count against the list of contracts that ended — and taking no more than four person-days a quarter from the team once it is running.

You cannot know

• How many former contractors currently hold access, which nobody has counted
• Whether the engineering-route contractors would ever appear in the finance system
• Whether the ops lead is still in that role in a year
• What the platform's scope would actually be once connected to the systems that exist

Choose an option

A recurring reminder on the first of each month: the ops lead compares contractor accounts against contract end dates and removes what has expired.Hang the access closure off the contract end date already in the finance system: three engineer-days to raise a dated ticket and revoke on expiry.Buy the identity platform and route all contractor access through it.Close the second route: require every contractor to have a contract record before access is granted, then hang the closure off it.

The condition that breaks the cheap design

A control that depends on one person remembering is not a cheap control. It is a control with a hole in it, and the hole is not priced.

That is the condition under which everything above stops holding: if the inexpensive design's trigger is a human intention rather than an event, then no cadence, procedure or reminder makes it a control — it makes it a habit, and habits end when somebody is on holiday in the week it fell due, changes teams, or has a quarter where everything is on fire.

The test is one question: what has to happen for this to be skipped? If the answer is "somebody forgets", it will be skipped. If the answer is "a contract has to end without anybody recording that it ended", you have bought something real for three engineer-days.

Check

Two designs address the same risk. One costs a licence and produces continuous reports; one costs three engineer-days and produces a dated ticket per event. What should decide between them?

Choose one answer

Which population each one reaches, and whether anything outside it is where the risk actually livesWhich produces more evidenceWhether the team has three engineer-days availableWhich one an auditor would prefer to see

Check answer

Worth remembering

• Control designs sort by purchasability rather than by strength, and the expensive one is the one somebody can announce.
• The strongest evidence is produced by the work as a by-product, which is a property of the design and not of the price.
• A control that depends on somebody remembering is not cheap; it is a control with an unpriced hole, and it will be skipped.
• Hanging a control off an event that has to happen anyway removes the forgetting failure entirely.
• Scope is usually the real decision: a control is only as wide as the population it reaches, and the risky cases often arrive by the route it cannot see.
• A human looking at a list can spot a name no system has heard of, which is the thing people are better at and the thing that stops happening in a busy month.
• An automated design needs a second small control that notices the day it stops acting, because its silence looks like nothing to do.