...
Definition: IAM Program Cost is the total cost of a program designated as IAM that has a defined scope. That scope may be distinct from the organization’s overall IAM scope, that is some activities traditionally linked to IAM may be out-scoped and other activities traditionally not linked to IAM may be in-scoped.
Accounting Periods
For the sake of simplicity, we skip the complexities linked to accounting periods.
Direct versus Indirect Cost
...
Definition: IAM Direct Cost is defined as expenditures that are fully dedicated to IAM (e.g. IAM dedicated personnel, IAM software licenses, etc.).
Measuring direct costs is straightforward: it is the sum of all the individual costs.
Definition: IAM Indirect Cost is defined as expenditures that are not fully dedicated to IAM (e.g. general administration, general IT infrastructure costs required to support IAM systems, etc.).
Cost Categories
From this definition, we immediately see how important it is to define what the “set of all IAM activities” is. This concept will be analysed in greater details in the § Listing IAM Activities section below.
Measuring the IAM Total Direct Cost
The direct cost of an activity is straightforward to measure: it is the sum of all the corresponding expenditures. This gives us the following trivial equation:
Where:
is the IAM Total Direct Cost
is the function that returns the direct cost of an activity
is the set of expenditures linked to activity
is an expenditure
For the sake of simplicity, we skip the complexities linked to accounting periods and foreign exchange.
...
Indirect
...
Indirect costs are more complex to measure and methods may vary between organizations. For instance, some organizations will rely on roughly estimated allocation keys while others will use fine-grained accounting schemes. It is presumably outside the scope of IAM cost measurement to redefine the accounting methods used by organizations, hence we should accept a level of inconsistency when comparing these costs between organizations and keep this in mind when interpreting measurements. To enable proper interpretation of results , between organizations engaging in benchmarking activities, organizations should transparently disclose their high-level accounting methods.
It should be noted that the measurement of indirect costs may also vary between activities. For instance, some activities may have varying costs and may thus be charged (e.g.: the consumption of a workload in an IT infrastructure or cloud) while others may have fixed costs (e.g.: general administration).
This gives us the following equation:
Where:
...
IAM
...
is the function that returns the indirect cost of an activity
...
is the function that uses the organization’s specific (and possibly unique) method to estimate the indirect costs of the activity
A similar equation may be used to measure the IAM Program Indirect Cost.
...
Investments and Depreciation
The implementation of Enterprise IAM is known as a complex, demanding and expensive undertaking (e.g.: Royer, 2013, p. 4). Hence, measuring the cost of IAM must not only factor in operating costs but also capital expenses such as IAM projects (deployment of IAM processes and/or systems).
...
In conclusion, for the sake of simplicity, we suggest that when possible and for the sake of making IAM cost measures comparable between organizations, we recommend that for the sake of performance measurement (that is distinct from tax issues), IAM investments be factored in IAM cost measurement using depreciation over a period of 5 years with the straight line approach. This looks like an acceptable average.
When this is not feasible, we recommend that organizations engaged in IAM benchmarking disclose their high-level depreciation methods to facilitate the interpretation of their measures by peer organizations.
Listing IAM
...
Cost Components
Inventorying IAM cost components is key to make measurement comparable between organizations. FOr instance, if PAM is considered an element of IAM by organization A but not by organization B, the cost of IAM will be higher for organization A because their scopes are distinct.
...