The audit: we learn how the work actually moves
3 weeks on site with the engineering team. Process owners get shadowed rather than surveyed, because the shadow spreadsheet and the approval that happens in a hallway never come up on a call.
A process and time map, a controls register, the exception taxonomy in your team's own wording, a volume baseline pulled from the systems rather than estimated, and a build plan signed by the people who run the work. $15–25k, credited in full against a build signed within 90 days.
12 sessions with 10 people. Every session transcribed and tagged against the workflow it describes.
| Role | Sessions | Minutes each | Focus |
|---|---|---|---|
| Engineers | 4 | 60 | Where time actually goes between picking up work and shipping it |
| Engineering managers | 3 | 60 | Review load distribution, triage rules, onboarding |
| Site reliability | 2 | 60 | Incident handling, alert quality, runbook currency |
| Product | 1 | 45 | Intake, prioritisation, what stalls |
| CTO | 2 | 45 | Delivery expectations, architecture guardrails, hiring plan |
29 sources ingested, indexed and made queryable. The working spreadsheets matter most, because they are where the real process lives when the SOP has drifted.
9 systems mapped, including the ones nobody lists on an architecture diagram.
- GitHub · Source
- Jira · Tracking
- Linear · Tracking
- PagerDuty · On-call
- Datadog · Observability
- Confluence · Documentation
- Slack · Coordination
- Buildkite · CI
- Snyk · Dependency scanning
In-scope process work, not total department labour
| Driver | Volume | Hours/yr |
|---|---|---|
| Pull request review | 3,400 PRs at 40 min of reviewer time | 2,267 |
| Codebase and context search | 22 engineers × 3.1 hrs/week × 46 weeks | 3,137 |
| Ticket triage | 5,600 tickets at 12 min | 1,120 |
| Onboarding support | 7 hires at 120 supported hours | 840 |
| Incident write-ups | 140 incidents at 3.5 hrs | 490 |
| Total in scope | 7,850 |
- Carried by agents4,867 hrs62%
- Stays with people2,983 hrs38%
2,983 hours a year remain manual, and should: judgement calls, genuine exceptions, and the relationships that need a person on the other end. The two shares are complements of one another, so they sum to 100 by construction.
Codebase context and search
The largest single driver. Engineers spend more time locating context than changing it.
Pull request review
First-pass review on the mechanical checks, with architecture judgement left to a person.
Ticket triage
Classification, duplicate detection and routing against the component owner map.
Onboarding support
Lowest automatable share here because pairing and mentorship are the point.
Incident summarising
Timeline assembly from logs and threads, so the write-up starts from evidence.
The five sum to $490k, the same modelled annual value shown in chapter 01. Bars are each workflow's value against the largest of the five.
- Audit · 3 weeks
- P1 Codebase context and search
- P2 Pull request review
- P3 Ticket triage
- P4 Onboarding support
- P5 Incident summarising
- Operate · ongoing
Audit 3 weeks, build 10–12 weeks, then continuous operation. Workflows overlap because the connector work for one is usually most of the connector work for the next.
Session counts, document counts and hours are modelled against the basis company, not recorded from an engagement. The method is real; the volumes are what a 22-person engineering function at that size would produce.