Price your own controls in hours, not in licences

Price one control. Not the licence, not the audit fee — the hours, in the weeks of people who already have jobs.

Take the quarterly access review from earlier in this track. Four times a year, about six hours each time, three people in the room: the person who knows what a role grants, the person who knows what the holder does, and whoever has the standing to remove something. Call the company a hundred and twenty people, with roughly forty joiners and leavers a year, each costing an hour and a half of access work on top of the scheduled reviews.

Before the model runs: how many person-days a year is that, and does it fit inside one person's spare capacity?

Predict

Four reviews a year at six hours and three people, plus forty joiner and leaver events at ninety minutes. How much of a person's year does this control consume?

Choose one answer

About three days — it is four meetings and some paperworkAround sixteen or seventeen days, split roughly evenly between the schedule and the churnAround forty days, once you count the chasingIt cannot be estimated without measuring what people actually spend

Lock in answer

Control cost

≈ Hypothetical model, not a forecast

The recurring effort one control consumes in a year, in person-days, and the headcount at which it outgrows a single owner.

It assumes

• A person-day is eight hours and a working year is 240 of them.
• One owner can give this control twelve days a year — a twentieth of their time — which is a declared input rather than a finding.
• Joiner and leaver events scale with headcount at the rate observed today.
• Every instance costs the same hours, with nobody getting faster at it.
• Everyone in a review is present for the whole review.

It ignores

• Expected loss, and any comparison of this cost to the risk the control reduces. That division is where a model like this rots: the avoided-loss figure is invented, it is always large enough to justify whatever was already decided, and putting it next to a real cost lends it a precision it has not got. This model costs the control and stops
• Whether the control is worth running, which is a judgement and not an output
• Build cost, tooling, licences and the one-off effort of standing the control up
• Evidence collection, review, and the effort of explaining the control to a reviewer
• Failure cost: an instance that goes wrong costs several times an instance that does not
• The opportunity cost of the owner, usually the most senior person in the arithmetic
• Context switching, which makes twelve one-hour tasks cost far more than twelve hours

Leave the headcount where it is. Find the hours per instance at which the scheduled reviews alone already exceed what one owner can give this control — before a single joiner or leaver is counted.

Hours per instance6

Hours one instance takes, per person involved.

Headcount120

People in the organisation, which is what the event rate is measured against.

Person-days a year this control consumes

16.5

Person-days a month, averaged

1.38

Person-days from the scheduled instances

9

Person-days from joiner and leaver events

7.5

Share of the effort that comes from churn rather than schedule

0.455

Headcount at which this outgrows one owner

48

Owners this already needs, at the declared person-days each

2

Person-days a year one owner was taken to be able to give it

12

The scheduled part alone already exceeds one owner

0

The crossing lies past the largest headcount modelled

0

Hours a year, before conversion to days

132

• What the control costs in total
• The scheduled part, which never moves

◷ Not there yet — keep moving the controls.

Sixteen and a half person-days. Nine of them from the four reviews, seven and a half from the joiners and leavers — so nearly half the cost of this control is driven by hiring rather than by the calendar, and nothing in the control's own description mentions hiring at all.

Then the line that matters. At twelve days a year per owner, this control outgrew one person at around fifty people. The company is at a hundred and twenty. It has needed two owners for a long time and has one, and nothing anywhere in the register says so.

The second job

That is the output of this model, and it is not the total.

Somebody is currently absorbing sixteen and a half days a year of access review. If they are the only name in the owner field, they have been given three weeks of annual work that appears nowhere in their objectives, was never discussed, and does not show up as a line in anyone's plan. It shows up as somebody being slightly behind all year.

Now do it for the rest of the register. Eleven controls at a few days each is a person. Not a person anybody hired — a person assembled out of fragments of other people's weeks, and the fragments are distributed unevenly: the controls cluster on whoever is nearest to access, deploys and suppliers, which in a company this size is usually one or two engineers and whoever does the contracts.

The condition under which all of this misleads you is the interesting one, and it is common: a control's hours are often spent by somebody who does not know they are a control owner. Nobody told the engineer who wrote the access script that they now own a control. Nobody told the office manager that chasing acknowledgements is an operating control with a cadence. Their hours are real and absent from every register, which means the model understates them and the people in question cannot push back, because the work has no name.

Check

This model deliberately refuses to divide the cost by the loss the control avoids. Why?

Choose one answer

Because the avoided-loss figure is invented, and it is always large enough to justify whatever was already decidedBecause the two numbers are in different unitsBecause the avoided loss is usually smaller than the costBecause whether a control is worth running is not a question with a number in it

Check answer

›Why the churn half is the one that surprises peopleOptional

The scheduled half of a control's cost is fixed and feels like the whole thing, because it is the part written in the policy. Four reviews a year is four reviews whether the company is forty people or four hundred.

The churn half is per event, and events are per head. That is the entire reason a control that was genuinely free at twenty people is somebody's second job at a hundred and twenty: nothing about the control changed, nothing about the policy changed, and the company tripled.

It is also why the honest answer to “has this control got more expensive?” is usually that nobody has looked since it was designed. The design was costed, if at all, against the organisation that existed at the time, and the only signal that the cost has moved is one person falling behind.

Worth remembering

• A control's cost has two halves: a scheduled part that never moves, and a churn part that grows with every hire.
• Four reviews a year with three people, plus forty joiner and leaver events, is a little over three working weeks a year from one control.
• The useful output is not the total but the headcount at which the control outgrew one owner, which is usually in the past.
• Eleven controls at a few days each is a person nobody hired, assembled out of fragments of other people's weeks.
• The hours cluster on whoever is nearest to access, deploys and suppliers rather than spreading evenly.
• The model refuses to divide cost by avoided loss, because an invented benefit figure placed beside a real cost borrows its precision.
• Some control hours are spent by people who do not know they are control owners, so they appear in no register and cannot be argued about.