The Cost and Payback of Deflection and Prevention

Wednesday, 11:30, at Redbrook Engineering. Sam, on the four-person desk, has a proposal and a whiteboard. The desk should write twenty knowledge base articles and build a disk-space sweep that warns before the file server fills. It should also script a one-click fix for the printer queue that jams every week. "All of it saves time," Sam says, and he is right. Priya, who runs the desk, asks the question that stops the meeting: "What does it cost?" Sam has the savings worked out to the hour. He has not written down a single hour of what the twenty articles, the sweep and the button would take to build, test, and keep working. The desk works it out together on the same whiteboard. The twenty articles become six, the sweep stays, and the button goes to the bottom of the list. It sits below a new-starter account template nobody had mentioned.

Deflection is a ticket that never needed raising because the answer reached the person first. Prevention is a ticket that never needed raising because the fault was fixed before anyone hit it. The scripted fix, the button, is a ticket that still arrives but is resolved in a minute rather than forty. All three are investments: hours spent now so that fewer hours are spent later. The return side of each has its own series, Measuring Self-Service ROI for deflection and Proactive Remediation for prevention. And this article does not repeat their arithmetic. It is about the other side of the ledger, the one that is nearly always left blank. It covers what each investment costs, how the payback period is worked out, which to do first, and when to stop. This article is part of our The Economics of Support series, where every number is a worked example from a fictional desk, in hours.

It covers the three investments and the ledger they share. Then come what it costs to write the article, what it costs to run the sweep, and what it costs to build the button. It covers the payback period as the deciding figure, then choosing among investments as a portfolio. Next come when to stop and where the return side lives. It ends with a short war story and the payback sheet to copy, in that order.

Three Investments, One Ledger

Every one of these investments has a cost side and a return side, and desks fill in the return side with enthusiasm and the cost side with nothing. The return is the hours the desk will get back, which is the pleasant half. The cost is the hours the desk must spend first, which is the half that comes out of this month's queue. Both are technician hours, both are real, and an investment case that shows one without the other is not a case. It is a wish with a spreadsheet.

The cost side has two parts, and both get forgotten in different ways. The one-off cost is everything it takes to get the thing working: writing, building, testing, reviewing, placing, announcing. People forget the testing and the review, which together are usually as large as the writing. The recurring cost is everything it takes to keep the thing true. It includes the quarterly check that the article still matches the screens and the monthly review of the sweep's findings. It includes the afternoon when the button stops working because something underneath it changed. People forget the recurring cost entirely, because it has not happened yet. Then they wonder in a year why the knowledge base is full of articles nobody trusts.

Hours are the unit for both sides, which is what makes the ledger balance. A manager who wants currency can multiply the final line by a rate. The desk's job is to show that the hours going out are smaller than the hours coming back, and by when. That last part, by when, is the payback period, and it is the single figure this article is building toward. Everything before it is counting the cost side honestly enough for the figure to mean something.

What It Costs to Write the Article

A knowledge base article costs more than the writing, and the writing is the part people estimate. The full one-off cost starts with finding the question worth answering, which means reading a month of tickets of that type. It includes writing the steps, then testing them on two real users who are not technicians. An article that only works for its author deflects nothing. The cost includes the review by whoever approves articles, the screenshots, and the placement. Placement means linking it from the portal, from the error message where possible, and from the reply template the desk uses for that ticket type. And the cost includes the announcement. At Redbrook, the mapped-drive article came to about four hours all in. It took ninety minutes writing, an hour testing with two people in the drawing office, half an hour of Priya's review, and an hour on screenshots and placement. The writing was a third of it.

The recurring cost is the upkeep, and it is small for a good article and large for a bad one. Redbrook budgets an hour a quarter per article for the check that the steps still match the screens. That is a third of an hour a month, and that held for most articles. It did not hold for the article about the office software's sharing dialogue, which the software changed twice in a year. That article cost three hours of rewriting each time. An article about a thing that changes often has a recurring cost that can swallow its return. And the time to notice that is before writing it, by asking how often the thing has changed in the past two years.

Articles written for the desk rather than for users have a different return and the same cost. A runbook that technicians follow saves hands-on minutes on tickets that still arrive; a user-facing article stops tickets arriving. The cost to write them is similar. The return is counted differently, as technician time for the first and deflection for the second, and the two must not be mixed. In QuerySolv, as in most tools, a knowledge base article can be visible to everyone or to the desk alone. That one setting decides which column the article's return goes in. On the payback sheet, each article says which it is.

What It Costs to Run the Sweep

A sweep is a scheduled check that looks for a fault before anyone reports it. That might be disks nearing full, certificates nearing expiry, a service that has stopped, or a laptop that has not checked in for a month. Its one-off cost is building the check, deciding the thresholds, and deciding who gets told and how. It also includes the first few runs, which are mostly spent discovering that the thresholds were wrong. Redbrook's disk-space sweep took about ten hours. It took four to write and schedule the check, two to decide thresholds with the people who ran the servers, and four across the first month adjusting it. The adjustments stopped it warning about a drive that was always nearly full by design.

The recurring cost of a sweep is the part nobody budgets, and it has three pieces. Running and reading it: someone looks at the findings each week or month, which at Redbrook was about an hour a month. Then there are the false positives. Every finding that turns out not to matter costs the time to check it. It also costs the small erosion of trust that makes the next finding easier to ignore. And a sweep whose findings are ignored has a recurring cost and no return. And the brought-forward fix: a sweep that finds a disk at ninety percent has not removed the work of clearing the disk. It has moved the work from a frantic Tuesday to a calm Thursday, and the calm Thursday still costs an hour. Redbrook's sweep costs about three hours a month in brought-forward fixes, on top of the hour of reading. The return is the eight to fifteen hours a month of outage handling that no longer happens. And the difference between them is the net.

Wire the sweep's findings into the ticket system rather than into a mailbox, because a finding that becomes a ticket gets owned. A finding in a mailbox gets read on Friday by whoever is least busy. The method, with its own costs and its own rules about floods, belongs to the monitoring-to-ticket series. For the payback sheet, the point is that wiring it in is part of the one-off cost and saves recurring hours thereafter. A sweep that costs ten hours to build and four a month to run, and returns eight to fifteen, pays back in two to three months. It then returns four to eleven hours a month net. That is a good investment. It is also one that looks, on the cost side, considerably less free than "we just run a script".

What It Costs to Build the Button

The button, a scripted fix a technician can run with one click on a known fault, has the most seductive return and the most underestimated cost of the three. The return is easy to picture: forty minutes becomes one. The cost starts with the script, which is the quick part. Testing it on a machine you can afford to break is longer. The guardrails are longer again. Those are the checks that stop it running on the wrong machine or at the wrong time. The cost includes the logging, so that a ticket says what the button did. It includes teaching the team when to use it and when not to. And it includes the maintenance when the operating system, the application or the network changes something the script assumed. Redbrook's printer-queue reset came to about fourteen hours. That was three for the script, four for testing, five for guardrails and logging, two for the team. Sam had estimated an afternoon.

The recurring cost is the breakage, and it arrives unannounced. A button that worked for eight months and then silently does nothing after an update costs an hour to notice, two to diagnose and one to fix. And it costs the desk's trust in every other button for a month afterwards. Budget an hour a month per button for this and be pleased when it is less. The safe way to build buttons, and the measurement of whether they pay, belong to the scripted fixes series. The measurement article, Measuring Whether the Buttons Pay, is where the return side of this paragraph lives. The cost side is here, and it is fourteen hours plus an hour a month. That is for a fault that at Redbrook arrived about eight times a month at forty minutes each.

The button that nobody presses is the costliest of all, because it has the full one-off cost and the full recurring cost and no return. Buttons go unpressed when the fault stops happening, when the team does not trust the button, or when the technician who built it was the only one who knew it existed. Before building one, check that the fault is still arriving at the rate it did and that two people besides the builder will use it. Also check that it is written up where a stranger would find it. Those three checks are an hour, and they are the cheapest hour on the whole sheet.

The Payback Period Is the Deciding Figure

The payback period is how long it takes for the hours coming back to equal the hours spent getting there. It is one division: the one-off cost in hours, divided by the net hours freed per month. Net means the gross monthly return minus the recurring monthly cost. The mapped-drive article at Redbrook cost four hours once and returns four to twelve hours a month on the deflection count. It costs a third of an hour a month to keep: net three and two thirds to eleven and two thirds a month. So the payback is between a week and a half and a month. The disk sweep cost ten hours, returns eight to fifteen, and costs four a month. That is net four to eleven, so payback is between one and two and a half months. The printer button cost fourteen and returns about five hours a month on eight faults at forty minutes each becoming one. It costs an hour a month: net about four, so payback is about three and a half months.

Payback is a better deciding figure for a small desk than any ratio, because it answers the question a desk lead is actually asking. That is "how long until this stops costing me queue time". A ratio of return to investment over a year tells you that the article is worth it eventually. A payback period tells you that the article pays for itself before the end of the month and the button pays for itself after the summer. That is the information that decides what to do this week. The payback period is also a range, because the return is a range, and the honest sheet quotes both ends. "Pays back in one to two and a half months" is a sentence a manager can plan around. "Returns three hundred percent" is a sentence a manager has heard before.

Sort investments into bands by payback and the plan writes itself. Anything that pays back within a month is done now, in the gaps, without a meeting. Anything that pays back within a quarter is scheduled this quarter and announced. Anything that pays back within a year is done only when nothing in the first two bands is waiting, and the sheet says so. Anything beyond a year is not done for the hours. If it is done at all, it is done for a reason the sheet names, such as a safety or compliance need. That way nobody later mistakes it for a saving. Redbrook's twenty proposed articles sorted into six in the first band, four in the second, and ten that would never pay back. That was because those ticket types arrived twice a month. The ten were not written. The six were written in a fortnight.

Choosing Among Investments: The Portfolio

A desk never has one investment to consider; it has a list. And the list should be chosen as a portfolio with the payback band as the sort key and two further rules. The first rule is to do the cheapest payback first, regardless of how interesting the alternative is. The hours freed by the first investment are what pay for the second. The second rule is never to have more than two investments in progress at once on a desk of this size. Each one in progress is hours out of the queue with nothing yet coming back. Three at once is how a desk spends a quarter building things while the backlog grows. The table below is Redbrook's portfolio after the whiteboard afternoon, and the column that reordered it is the last one.

Notice what the sort did to Sam's list. The button, which was the most exciting thing on the whiteboard, is fourth, because fourteen hours against four a month is a long wait. The new-starter template, which nobody had proposed because it was dull, is second. Its line carries a note that its real return is on the requester side, where a two-day blocked process for every starter becomes none. That saving is counted separately, by the method in The Cost of Waiting, and never added to the desk hours in the table. The six articles are first because they are cheap, quick and aimed at the ticket types that actually arrive. Excitement is not a column. It should have been a row, with its own cost.

Revisit the portfolio each quarter with the actual figures written over the estimates. An investment whose actual return came in at the bottom of its range moves down a band. One whose recurring cost came in higher than budgeted may move to the stop list. The estimates on the first sheet will be wrong. And the point of writing them down is to find out by how much, so that next quarter's estimates are better. A desk that has done this for a year estimates payback within a band nearly every time, and can say so. That is a sentence worth more in a budget meeting than any single result.

When to Stop

Stop an investment when its recurring cost exceeds its cautious return, and write the stop down as a result rather than hiding it as a failure. The sharing-dialogue article at Redbrook, rewritten twice at three hours a time, was costing about half an hour a month to keep true. It was returning, on the cautious count, about the same. Priya retired it, with a note in the knowledge base pointing to the vendor's own help page, and reported the retirement in the same quarterly summary as the successes. A desk that reports two stopped investments beside eight working ones has demonstrated that the eight are honest. A desk that reports only successes has demonstrated that it does not count.

Sunk hours are not a reason to continue. The fourteen hours in the printer button are spent whether or not the button is kept. And the only question each quarter is whether the next month's hour of upkeep buys more than an hour back. If the printer is replaced and the fault stops arriving, the button's return falls to nothing. In that case, the right move is to retire it the same week, however much it cost to build. This is harder than it sounds, because the person who built it is in the room. Decide it from the sheet, by the rule, and let the sheet take the blame.

The signs that an investment should stop are the same for all three kinds. One sign is that the ticket type it addresses has fallen away for a reason that is not the investment. Another is that the recurring cost has risen past the budget twice. Other signs are that nobody used it last month or the thing it fixes has been replaced. The last of the ROI series, When Self-Service Does Not Pay, is about the article version of this decision in detail. The payback sheet below has a line for the stop review, because an investment that is never reviewed is never stopped. In that case, the knowledge base fills with articles that cost an hour a quarter to not be read.

Where the Return Side Lives

This article has quoted return figures without showing how they were counted, and that is deliberate. The counting has its own articles and its own rules, and repeating them badly here would be worse than pointing. For deflection, the count of avoided tickets, against a baseline and a control type, carried as a low and a high, is in Deflection Math Without Fooling Yourself. For the technician time saved by runbooks and buttons, the before-and-after hands-on sample is in the same series. For prevention, the tickets that never arrived, measured against the type's own history, are in the proactive remediation series linked above. The payback sheet takes its return figures from those methods and does not invent its own.

The one thing to carry from the return side into the cost side is the range. Every return figure arrives as a low and a high. And the payback period must be worked out with both, giving a short payback and a long one. The honest sheet quotes the long one first. An investment that pays back in a month on the hopeful count and in four on the cautious one is a four-month investment that might be pleasant. Anyone who plans on the month will be explaining themselves in the spring.

A Short War Story: The Thirty-Hour Button at Bellweather Logistics

At Bellweather Logistics, a technician called Ravi spent about thirty hours across a month building a one-click fix for the label printer in the loading bay. It was complete with guardrails, logging and a short training session. He built it because the fault was irritating and the fix was satisfying to script. Nobody had counted how often the fault arrived. When the desk lead, Mei, counted afterwards, it was twice a month at about fifteen minutes each. So the button saved half an hour a month and would pay back its thirty hours in about five years, if the printer lasted that long. In the same month, new drivers were waiting an average of two days for their handheld accounts. That blocked process cost the depot roughly twenty hours of waiting per starter, with four starters a month. No runbook or template existed for it because it was dull. The template, when Ravi built it the following quarter, took eight hours and paid back inside a fortnight. The cost side of an investment is counted before the work starts, or it is not counted at all. Afterwards it is only admired.

The Payback Sheet

The sheet below is one line per candidate investment, filled in before any work starts and revisited with actual figures each quarter. Sections A to C are the cost side, which is the part this article exists to make people fill in. The forgotten items are named so they cannot be skipped. Section D is the return, taken from the methods linked above and never estimated here. Section E is the payback and the band. Section F is the stop review, which is filled in at each quarter's revisit. One sheet per investment keeps the portfolio honest. A summary table of the bands, like the one above, is what goes in front of anyone else.

THE PAYBACK SHEET — ONE INVESTMENT
Investment: ______________________________   Kind: article / sweep / button / template
Ticket type it addresses: ______________________   Tickets of that type a month: ____
Proposed by: ______________   Date: ____________   Sheet revisited on: ____________

A. ONE-OFF COST (hours, before any work starts)
   A1 Find the question / fault worth addressing (read a month of tickets) .. ____
   A2 Write or build ............................................................ ____
   A3 Test with real users or on a machine you can break ....................... ____
   A4 Review and approval ...................................................... ____
   A5 Guardrails and logging (buttons and sweeps) ............................. ____
   A6 Place, link, announce, teach the team .................................... ____
   A7 One-off total ............................................................ ____ h

B. RECURRING COST (hours a month)
   B1 Upkeep: check it still matches reality (per quarter ____, so per month) . ____
   B2 Reading findings and checking false positives (sweeps) ................... ____
   B3 Brought-forward fixes the sweep now creates (sweeps) ..................... ____
   B4 Breakage budget (buttons) ................................................ ____
   B5 Recurring total .......................................................... ____ h

C. BEFORE BUILDING
   [ ] The ticket type is still arriving at the rate in the header
   [ ] At least two people besides the builder will use it
   [ ] The thing it addresses has not changed more than twice in two years
   [ ] It is counted as deflection / technician time / prevention (circle one)

D. RETURN (from the linked method, never estimated here)
   D1 Gross hours freed a month, low ........................................... ____
   D2 Gross hours freed a month, high .......................................... ____
   D3 Requester waiting saved, if any (separate line, never added) ............. ____ to ____

E. PAYBACK
   E1 Net hours a month, low (D1 minus B5) ..................................... ____
   E2 Net hours a month, high (D2 minus B5) .................................... ____
   E3 Payback, long (A7 over E1) ............................................... ____ months
   E4 Payback, short (A7 over E2) .............................................. ____ months
   E5 Band: now (under 1 month) / this quarter / this year / not for the hours

F. STOP REVIEW (each quarter)
   F1 Actual hours freed last quarter, per month ............................... ____
   F2 Actual recurring cost last quarter, per month ............................ ____
   F3 Used last month? ____   Fault still arriving? ____   Thing replaced? ____
   F4 Decision: keep / move band / retire, and why ............................. ______________

Sam filled in six sheets that afternoon, one for each article in the first band, and a seventh for the button. He kept the button because the arithmetic was his own and he wanted to see whether the printer would last the three and a half months. It did, and the button paid back in the autumn, a little later than the sheet said. By then the six articles and the new-starter template had returned several times what all of them had cost. The twenty-article plan was never mentioned again. The whiteboard was wiped, which is the correct end for most whiteboards.

Frequently Asked Questions