Compliance incident management

An incident log sheet: the arithmetic behind compliance incident management before the log is a system. Give it incidents per month, triage minutes, investigation hours, the share that escalate and the extra hours each escalation takes, with your hourly cost; it returns the month's triage, investigation and escalation hours, the total, the cost and the cost per incident. Every figure is yours; the sheet publishes no benchmark.

Triage and investigation

20 incidents at 30 minutes' triage is ten hours, and at three hours' investigation is 60 hours, on the worked example. The two are separated because triage is a rota and investigation is a workload.

Escalations

15% of 20 incidents is three escalations and 18 extra hours at six each. The escalation share is yours from the log; the sheet works what it costs.

The month's cost

88 hours at $75 is $6,600, $330 per incident. The per-incident figure is the one to put beside a control that would prevent a class of incident; the sheet returns it.

A software incident report template, and the fields the log actually needs

Eight fields carry a compliance incident: when it was detected and by whom, what happened in one sentence, which systems and whose data were touched, the severity on a stated scale, who is handling it, what was done, whether a notification obligation was triggered and when it closed. Everything else a commercial template adds is reporting furniture. The field programs leave out is the notification question, which is the one with a clock on it.