Part IV · Chapter 7 · The Audit · lesson 7

What being audited costs the people who are not running it

13 min

Everybody prices the fee. Somebody sends a quote, somebody else puts it in a spreadsheet, and the number goes into the business case as the cost of the exercise.

Nobody prices the other one: the hours the audit takes from the people who are not running it. The engineer pulled out of a release to explain the deployment pipeline. The office manager who has to find two onboarding records from eleven months ago. The head of support who sits in a ninety-minute walkthrough about a control she performs twice a year. None of them are on the project. All of them are on the critical path.

Predict

A 120-person company goes through one audit cycle. Not counting the person running the project at all — just the hours taken from everybody else. How much is that, over the year?

Three or four person-daysAbout a weekSomething like six working weeks, spread thinly across a dozen peopleThree months or more

Two sources of effort, and only one of them grows with the company.

The scheduled part is the occasions. Walkthroughs, each sample round, the clarifications, the follow-up nobody put in a calendar. Each one costs some hours and interrupts some number of people. This part is almost completely independent of headcount: a walkthrough about change approval takes ninety minutes whether there are forty people or four hundred.

The churn part is the population that grows with you. Joiners and leavers produce the records that get sampled and chased, so a bigger organisation has more rows to go and find.

Price both, separately, and the shape of the answer is the lesson: at small and medium sizes this is mostly a fixed cost, which means being audited costs a sixty-person company nearly as much of its own time as it costs a four-hundred person one.

Control cost

Hypothetical model, not a forecast

The recurring effort one control consumes in a year, in person-days, and the headcount at which it outgrows a single owner.

It assumes

The twenty-six occasions are one audit cycle's worth of asks spread across a year: walkthrough sessions, two sample rounds, the clarifications on both, and the follow-up nobody scheduled.
Each occasion costs two and a half hours and pulls in three people — the one being asked, the one who knows where the artefact lives, and the one coordinating.
The joiner and leaver events stand in for the part of the burden that grows with the company: those records are what gets sampled and chased, so more people means more rows to find.
Every occasion costs the same hours, which no real week respects. A sample round during a release costs several times one in a quiet August.
The fee is not in here, at all. This is only the hours, and the two numbers are paid out of different budgets.
The person running the project is excluded on purpose. Their time is visible, planned and already in somebody's spreadsheet; the point of this model is the time that is none of those things.

It ignores

Expected loss, and any comparison of this cost to the risk the control reduces. That division is where a model like this rots: the avoided-loss figure is invented, it is always large enough to justify whatever was already decided, and putting it next to a real cost lends it a precision it has not got. This model costs the control and stops
Whether the control is worth running, which is a judgement and not an output
Build cost, tooling, licences and the one-off effort of standing the control up
Evidence collection, review, and the effort of explaining the control to a reviewer
Failure cost: an instance that goes wrong costs several times an instance that does not
The opportunity cost of the owner, usually the most senior person in the arithmetic
Context switching, which makes twelve one-hour tasks cost far more than twelve hours

Leave the occasions, the hours and the people where they are. Move only the last control: what is the smallest number of person-days a year one owner has to be able to give this before the scheduled occasions alone stop exceeding one person?

Instances per year26

Scheduled operations of the control: 12 monthly, 4 quarterly, 52 weekly.

Hours per instance2.5

Hours one instance takes, per person involved.

People per instance3

Headcount120

People in the organisation, which is what the event rate is measured against.

Person-days one owner can give this10

Where one person's share of this control stops. 24 is a tenth of a working year; 240 is all of it.

Person-days a year this control consumes: 28.75
Person-days a month, averaged: 2.4
Person-days from the scheduled instances: 24.38
Person-days from joiner and leaver events: 4.38
Share of the effort that comes from churn rather than schedule: 0.152
Headcount at which this outgrows one owner: 0
Owners this already needs, at the declared person-days each: 3
Person-days a year one owner was taken to be able to give it: 10
The scheduled part alone already exceeds one owner: 1
The crossing lies past the largest headcount modelled: 0
Hours a year, before conversion to days: 230

Total person-days a year
From the scheduled occasions
From joiner and leaver records

A flat line a little above twenty-four person-days from the scheduled occasions at every size, with the churn line rising from zero and adding only a few days by the current headcount.
People in the organisation	Total person-days a year	From the scheduled occasions	From joiner and leaver records
1	24.41	24.38	0.036
10	24.74	24.38	0.365
25	25.29	24.38	0.911
50	26.2	24.38	1.82
100	28.02	24.38	3.65
120	28.75	24.38	4.38

Not there yet — keep moving the controls.

What the shape says

Twenty-nine person-days a year, and twenty-four of them do not care how big you are. Only about a sixth of the total comes from the churn part at this headcount — the part everybody assumes is the whole story.

That flat line is the uncomfortable finding. A sixty-person company and a four-hundred-person company pay almost the same number of hours for the occasions, which means the smaller one pays far more of its total capacity. The work of being asked things does not scale down.

The challenge finds the other half. For the scheduled occasions alone to fit inside one person, that person has to be able to give this twenty-five person-days a year — five working weeks. Even then the total still needs a second owner, and the model puts the crossing at eighteen people. Nobody has five weeks, so in practice this does not have one owner; it has a dozen part-owners who each believe they are contributing an afternoon.

The follow-up is the part that is never in the quote. Whatever is agreed in the room becomes a change somebody implements, re-evidences, and explains again later. In this model it is hiding inside the occasion count, and in most organisations it is hiding nowhere, because the people doing it have gone back to their actual jobs and nobody is counting.

Check

Your auditor offers to work from read-only access to your systems instead of from artefacts you send over. What does that do to the two numbers in this lesson?

It reduces your hours and may raise theirs, which is where the fee livesIt reduces both, since less work happens overallIt has no effect on your hours — you still have to answer the same questionsIt raises your hours, because granting and monitoring access is a new control

Pricing it against the fee, honestlyOptional

Take the person-days figure and multiply it by what a day of the people involved actually costs you — engineers, managers, the person who holds the identity provider. Then put it next to the quote.

For most organisations in this size range the two numbers are at least the same order of magnitude, and the hours figure is frequently the larger one. It is also the one that never appears in the business case, never appears in the renewal conversation, and never gets compared between two firms offering different working methods.

This lesson deliberately stops short of doing that multiplication for you. A day rate is a fact about your organisation, not a fact about auditing, and a model that invented one would be putting a precise-looking total next to a number somebody made up.

Worth remembering

The hours an audit takes from people who are not running it are a separate number from the fee, and they come out of a roadmap rather than a budget.
The cost splits into a scheduled part — walkthroughs, sample rounds, clarifications, follow-up — and a churn part that grows with headcount.
At ordinary numbers the scheduled part dominates and is nearly flat in headcount, so a small organisation pays far more of its total capacity than a large one.
At these numbers the control needs about five working weeks from a single owner before it stops needing a second, which is why it is always spread across a dozen part-owners instead.
The follow-up agreed in the room is the piece that appears in no quote and is counted by nobody once the week ends.
Working from read-only access moves retrieval hours from your side to the auditor's, which trades your hours against their fee and is worth asking about explicitly.