It compliance audit

This is an IT control-testing sheet, the arithmetic behind an it compliance audit's testing programme before it is planned or priced. Controls in the framework times tests per control per year is the tests; times minutes per test over 60 is the testing hours; tests times your failure rate per hundred is the failures expected; failures times remediation hours per failure is the remediation hours; and testing plus remediation hours times the hourly cost is the annual cost. Every figure is yours, including the failure rate; the sheet publishes no control list and no benchmark. Free, on the page, no account; the paid plan keeps every control with its tests and results.

Tests and hours

120 controls tested four times a year is 480 tests and 160 hours at 20 minutes each on the worked example. The frequency is yours; the sheet works what it costs in hours.

Failures and remediation

5% of 480 tests is 24 failures and 72 remediation hours at three each. The rate is yours from the last cycle; the sheet publishes no benchmark and shows what any rate costs.

The annual cost

160 testing hours plus 72 remediation hours at $85 is $19,720 for the year. The figure is the testing programme's budget with the failures already in it, which is how it should be presented.