The second year costs less in fees and the same in hours

The renewal quote arrives and it is well under half of last year's. Somebody forwards it with a one-line comment about economies of scale.

They are reading the only number anybody ever reads, and it is the smallest number in the exercise. The fee tracks the auditor's days. Your hours track your own control cadences, and nothing about a second year makes a quarterly control happen three times instead of four.

Predict

The second-year fee comes in at well under half the first year's. Which is the best reading of that?

Choose one answer

The work has roughly halved tooThe fee was always the small number, and it has got smallerThe examination is less thorough this timeSomebody negotiated well

Lock in answer

The first-year bill, taken apart

A composite sixty-person company, with the work sorted into what came back and what did not.

Did not come back. The readiness exercise against both frameworks. Writing and approving eleven policies. The engineering to make two controls produce an artefact at all. Selecting and configuring the evidence tool. The consultant's retainer. All of it real, all of it one-off, all of it the part that got discussed.

Came back. Operating eleven controls for a full window. Answering sample requests. The internal examination and the leadership review, which did not exist before certification and now happen every year. The quarterly instances, four times, for ever.

What follows prices one control out of the eleven: a quarterly review of who still has access to what, with the one-off work stripped out. Six hours an instance rather than the day and a half it took when the list was being built for the first time. Three people in the room, because the person who knows what a role grants is not the person who knows what the holder does.

Control cost

≈ Hypothetical model, not a forecast

The recurring effort one control consumes in a year, in person-days, and the headcount at which it outgrows a single owner.

It assumes

• A person-day is eight hours and a working year is 240 of them.
• Six hours an instance is the re-priced figure, with the first-time work removed.
• Twenty-four joiner and leaver events a year at sixty people, which is ordinary churn.
• Every instance costs the same, with nobody getting faster or slower.
• Twelve person-days a year is a day a month, which is what the owner was given.
• Build cost, tooling, licences and the audit fee are all outside this entirely.

It ignores

• Expected loss, and any comparison of this cost to the risk the control reduces. That division is where a model like this rots: the avoided-loss figure is invented, it is always large enough to justify whatever was already decided, and putting it next to a real cost lends it a precision it has not got. This model costs the control and stops
• Whether the control is worth running, which is a judgement and not an output
• Build cost, tooling, licences and the one-off effort of standing the control up
• Evidence collection, review, and the effort of explaining the control to a reviewer
• Failure cost: an instance that goes wrong costs several times an instance that does not
• The opportunity cost of the owner, usually the most senior person in the arithmetic
• Context switching, which makes twelve one-hour tasks cost far more than twelve hours

The owner of this control was given a day a month for it — twelve person-days a year — and at sixty people that is not enough. Hold everything else and find the smallest number of person-days a year one owner would have to be able to give this single control for it to stay one person's job.

Person-days one owner can give this12

Where one person's share of this control stops. 24 is a tenth of a working year; 240 is all of it.

Person-days a year this control consumes

13.5

Person-days a month, averaged

1.13

Person-days from the scheduled instances

9

Person-days from joiner and leaver events

4.5

Share of the effort that comes from churn rather than schedule

0.333

Headcount at which this outgrows one owner

40

Owners this already needs, at the declared person-days each

2

Person-days a year one owner was taken to be able to give it

12

The scheduled part alone already exceeds one owner

0

The crossing lies past the largest headcount modelled

0

Hours a year, before conversion to days

108

• What this one control costs a year
• The scheduled part, which does not grow
• The per-event part, which does

◷ Not there yet — keep moving the controls.

What the arithmetic says

Thirteen and a half person-days a year, for one control, at sixty people. Nine of those come from the four scheduled reviews and four and a half come from joiners and leavers, and only the second half grows when the company does.

Two things fall out of that, and the second one is the finding.

One. A day a month is not enough. The owner needs fourteen person-days a year to hold this control alone, and the person who agreed to own it agreed to a day a month because that is what the invite looked like.

Two. The chart has a crossing on it. At a twelve-day budget this control outgrows a single owner at around forty people — which is a size most companies reading this have already passed, and passed without anybody re-reading the owner field.

Now the uncomfortable part, which this page will not do for you: run the same arithmetic for the other ten. Not all of them are this expensive and none of them is free, and the sum is the number that should have been on the first page of the first proposal. Nobody computed it in year one, because in year one there was a fee on the page and the fee looked like the price.

›Why the recurring number is the one to quoteOptional

A build cost is paid out of a project budget, by a sponsor, once. Everybody in that conversation knows what they are agreeing to.

A run cost is paid out of individual weeks, by people who were not in the conversation, every year. It is never approved, because it never appears as a line item — it appears as three people being slightly less available than they used to be.

That is the mechanism by which an organisation acquires a programme it cannot sustain while every individual decision looked affordable. The protection is unglamorous: price run separately, name the owners, and tell each of them the number of days rather than the name of the control.

It also changes which controls you choose. Of two designs that address the same risk, the one with fewer instances and fewer people per instance is cheaper in a way that compounds annually, and that comparison is invisible if the only figure anybody holds is the build cost.

Check

During the year the company went from sixty people to a hundred and forty, and opened a second region. What does that do to the recurring number you just computed?

Choose one answer

It scales with headcount, so move the slider and read the new figureNothing, because the control is the same controlThe recurring number is no longer the right question, because the boundary has to be re-counted firstIt roughly doubles, since headcount roughly doubled

Check answer

Worth remembering

• The audit fee tracks the auditor's days; your hours track your own control cadences.
• Build cost is paid once by a sponsor; run cost is paid every year out of individual weeks.
• Year one quotes build and run together, which is how run becomes invisible.
• One quarterly control with three people in the room ran to thirteen and a half person-days a year at sixty people.
• Only the per-event half of a control's cost grows with headcount; the scheduled half is fixed.
• A control can outgrow one owner at a headcount the company passed without anybody re-reading the owner field.
• When the boundary has grown, re-count before re-pricing, because cost per control assumes a fixed population.