{
 "slug": "attestation-budget-model",
 "topic_id": "TOPIC-221",
 "cluster": "Enterprise IGA, Access Certification & Identity Lifecycle",
 "tier": "Tier B",
 "title": "The economics of review: how much attestation can an organisation afford?",
 "summary": "Organisations run certification campaigns against everything they can connect, allocating scarce human review uniformly across entitlements whose risk differs by orders of magnitude. Nobody has computed the total.",
 "lede": "Reviewer time is treated as free because it does not appear on the identity programme's budget. It appears on everyone else's, distributed across hundreds of managers, and it is the single largest cost of running access certification.",
 "date": "2023-12-31",
 "category": "Compliance",
 "author_id": "nadia-ferreira-strand",
 "tags": [
  "access certification",
  "IGA economics",
  "reviewer burden",
  "risk based certification",
  "SOX",
  "programme management"
 ],
 "image_title": "Attestation Budget Model",
 "schema": "Article",
 "key_takeaways": [
  "Campaign scope is driven by connector coverage and audit scope, not by risk-weighted value of review. Because reviewer time is uncosted, the programme expands until quality collapses.",
  "The total annual attestation cost is computable from data you already have, and it is usually larger than the identity programme's entire budget.",
  "There is a crossover point where a cryptographic per-action gate on a narrow high-risk set outperforms broad periodic review."
 ],
 "body": [
  {
   "type": "h2",
   "text": "Prerequisites"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "A fixed attention budget, spread evenly",
   "caption": "The total review time is roughly constant. Only its distribution is a choice.",
   "nodes": [
    {
     "label": "10,000 items in the campaign",
     "note": "uniform treatment"
    },
    {
     "label": "Reviewer has ~2 hours",
     "note": "realistically"
    },
    {
     "label": "Under a second per item",
     "note": "arithmetic",
     "bad": true
    },
    {
     "label": "High-risk items get the same second",
     "note": "as a mailing list",
     "bad": true
    }
   ]
  },
  {
   "type": "ul",
   "items": [
    "Campaign data for the last twelve months: items per reviewer, reviewers per campaign, campaigns per year.",
    "Reviewer session timestamps, which every IGA platform records.",
    "A fully loaded hourly cost for the reviewer population — mostly managers, so use a management rate."
   ]
  },
  {
   "type": "h2",
   "text": "Step 1 — Compute the annual bill"
  },
  {
   "type": "p",
   "html": "Straightforward arithmetic that nobody runs."
  },
  {
   "type": "code",
   "text": "annual_cost = campaigns_per_year\n            × reviewers_per_campaign\n            × median_minutes_per_reviewer\n            ÷ 60\n            × loaded_hourly_rate"
  },
  {
   "type": "p",
   "html": "Worked example at three organisation sizes, using a loaded management rate of $95 per hour:"
  },
  {
   "type": "table",
   "caption": "Illustrative. Substitute your own campaign data; the magnitude is the point.",
   "head": [
    "Organisation",
    "Reviewers",
    "Campaigns/yr",
    "Median min/reviewer",
    "Annual cost"
   ],
   "rows": [
    [
     "3,000 employees",
     "220",
     "4",
     "35",
     "$48,800"
    ],
    [
     "15,000 employees",
     "1,150",
     "4",
     "48",
     "$349,600"
    ],
    [
     "60,000 employees",
     "4,400",
     "4",
     "55",
     "$1,532,000"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Two observations. The largest figure exceeds most identity programme budgets outright. And none of these organisations has this number in any document."
  },
  {
   "type": "h2",
   "text": "Step 2 — Compute what it buys"
  },
  {
   "type": "p",
   "html": "Now weight the spend by risk. Classify entitlements into three tiers by the consequence of inappropriate access, and compute what share of the review minutes each tier consumes."
  },
  {
   "type": "p",
   "html": "In every estate this has been measured, the distribution is inverted: the low-risk tier holds the overwhelming majority of items and therefore consumes the overwhelming majority of review time, while the high-risk tier — privileged access, financially significant transactions, sensitive data — is a small minority of items and receives a proportionate minority of attention."
  },
  {
   "type": "p",
   "html": "That is not a failure of the reviewers. It is what uniform allocation produces."
  },
  {
   "type": "h2",
   "text": "Step 3 — Find the crossover"
  },
  {
   "type": "p",
   "html": "For a given entitlement class, compare two approaches."
  },
  {
   "type": "table",
   "head": [
    "",
    "Periodic certification",
    "Per-action gate"
   ],
   "rows": [
    [
     "Cost driver",
     "Items × reviewers × frequency",
     "Actions × gesture time"
    ],
    [
     "Cost timing",
     "Fixed, quarterly",
     "Variable, per use"
    ],
    [
     "Evidence produced",
     "A decision about standing access",
     "A record of each use"
    ],
    [
     "Better when",
     "Access is broad and rarely exercised",
     "Access is narrow and consequentially exercised"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The crossover is where action frequency is low relative to the population holding the entitlement. A privileged entitlement held by 40 people and exercised 12 times a month is cheaper and better governed by a per-action gate than by quarterly certification of 40 items."
  },
  {
   "type": "h2",
   "text": "Step 4 — Reallocate rather than reduce"
  },
  {
   "type": "p",
   "html": "The output of this analysis should not be a smaller programme. It should be the same budget spent differently:"
  },
  {
   "type": "ol",
   "items": [
    "Remove low-risk entitlements from certification scope entirely, where audit scope permits. Document the risk rationale.",
    "Increase depth on the high-risk tier — fewer items, better descriptions, longer review windows.",
    "Move the narrow, high-consequence, low-frequency set to per-action gating.",
    "Reinvest a portion of the freed time in entitlement description quality, which raises the value of everything else."
   ]
  },
  {
   "type": "h2",
   "text": "The constraint that limits this"
  },
  {
   "type": "p",
   "html": "Audit scope may mandate certification of entitlements your risk model would deprioritise. That is a real constraint and it should be negotiated with the external auditor rather than ignored."
  },
  {
   "type": "p",
   "html": "The negotiation is more likely to succeed when you arrive with a costed risk-weighted allocation than with a request to do less. Auditors respond to a documented rationale; they do not respond to programme fatigue."
  },
  {
   "type": "h2",
   "text": "Doing the arithmetic"
  },
  {
   "type": "table",
   "caption": "Where the budget actually goes",
   "head": [
    "Scenario",
    "Seconds per item",
    "Quality"
   ],
   "rows": [
    [
     "10,000 items, 2 hours, uniform",
     "0.7",
     "None"
    ],
    [
     "1,000 items, 2 hours, uniform",
     "7",
     "Low"
    ],
    [
     "<strong style=\"font-weight:600\">200 high-risk items, 2 hours</strong>",
     "<strong style=\"font-weight:600\">36</strong>",
     "<strong style=\"font-weight:600\">Meaningful</strong>"
    ],
    [
     "9,800 low-risk items",
     "Automated rules",
     "Appropriate"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The arithmetic is not subtle and it is rarely done. A programme that reduces campaign scope by 95% and reviews the remainder properly produces more assurance than one that certifies everything."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Auditors expect full-scope campaigns.”</strong> They expect a control that operates. A risk-tiered programme with documented criteria and demonstrable review on the high tier is a stronger story than a full-scope campaign with a zero revocation rate."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Risk tiering is subjective.”</strong> Blast radius, usage and data sensitivity are computable. The tiering can be derived rather than debated, and the criteria become the auditable artefact."
  }
 ],
 "faq": [
  {
   "q": "Is reviewer time really a cost?",
   "a": "It is the largest cost of the programme and the only one not carried on the programme's budget. That accounting artefact is why campaigns expand without resistance."
  },
  {
   "q": "Will auditors accept reduced scope?",
   "a": "Sometimes, with a documented risk rationale and evidence that depth increased where risk concentrates. Arrive with the analysis rather than the request."
  },
  {
   "q": "Does this mean certification is a waste?",
   "a": "No. It means uniform allocation of a scarce resource across items of wildly differing risk produces poor value, which is fixable without abandoning the control."
  },
  {
   "q": "What if we cannot measure reviewer minutes?",
   "a": "Your platform records session timestamps. If it genuinely does not, sample twenty reviewers with a timer for one campaign."
  },
  {
   "q": "Do auditors require full-scope campaigns?",
   "a": "They require an operating control. A risk-tiered programme with demonstrable review on the top tier is a stronger story than full scope with no revocations."
  },
  {
   "q": "Is risk tiering subjective?",
   "a": "Blast radius, data sensitivity and usage are computable, so the tiering can be derived and the criteria audited."
  },
  {
   "q": "What is the first thing to measure?",
   "a": "Seconds per item — campaign size divided by realistic reviewer time. The number is usually under one."
  }
 ],
 "sources": [
  {
   "t": "FTC — business guidance on marketplaces and consumer protection",
   "u": "https://www.ftc.gov/business-guidance"
  },
  {
   "t": "PCAOB AS 2201 — An Audit of Internal Control Over Financial Reporting",
   "u": "https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201"
  },
  {
   "t": "ISACA — identity and access management audit resources",
   "u": "https://www.isaca.org/resources"
  },
  {
   "t": "Labour cost benchmarking for management populations."
  },
  {
   "t": "NIST SP 800-53 Rev. 5 — access enforcement",
   "u": "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final"
  }
 ],
 "related": [
  {
   "slug": "certification-evidence-standard",
   "title": "The rubber stamp is the product",
   "category": "Developer"
  },
  {
   "slug": "decidability-score",
   "title": "Entitlement strings are not English",
   "category": "Compliance"
  },
  {
   "slug": "value-thresholded-authorization",
   "title": "Computing the gating threshold",
   "category": "Vertical"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Attestation%20Budget%20Model/1500_900/blog.jpg",
 "wordcount": 827,
 "url": "/blog/attestation-budget-model.html",
 "reading_time": "4 min read",
 "seo_title": "The economics of review: how much attestation?",
 "meta_description": "Certification campaigns spread scarce human review uniformly across entitlements whose risk differs by orders of magnitude. Attention is the budget.",
 "hub": {
  "slug": "topics/access-governance",
  "title": "Access governance and certification"
 },
 "answer": "Far less than it currently spends, and it spends it uniformly. Certification campaigns allocate scarce human review evenly across entitlements whose risk differs by orders of magnitude. Attention is the budget, and spreading it flat guarantees the high-risk items get the same seconds as the trivial ones.",
 "answer_q": "How much attestation can an organisation afford?",
 "glossary": [
  {
   "term": "Attestation budget",
   "def": "The total human review attention available, which is fixed regardless of campaign scope."
  },
  {
   "term": "Risk tiering",
   "def": "Sorting entitlements by computable risk so review effort follows consequence."
  },
  {
   "term": "Campaign scope",
   "def": "How many items are certified, which in most programmes is everything."
  }
 ],
 "checklist": {
  "title": "Reallocating the attention budget",
  "id": "budget",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Measure the current seconds-per-item.",
    "text": "Campaign size divided by realistic reviewer time."
   },
   {
    "name": "Tier by computable risk.",
    "text": "Blast radius, data sensitivity, usage."
   },
   {
    "name": "Automate the bottom tiers.",
    "text": "Rules, not reviewers."
   },
   {
    "name": "Spend the freed budget on the top tier.",
    "text": "And require a signature there."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav turns an access decision into an artefact: what the reviewer was shown, who they were, what authority they held, signed and verifiable by an auditor without your systems.",
  "href": "../docs.html",
  "label": "See review receipts"
 }
}