◇ OpenCyber Academy
Bachelor's · Chapter 32 · English

Chapter 32 — Business case

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 32 — Business case

Lesson map

Lesson 32 published. Map, example, EX094.

flowchart TD
  N0["Learning outcomes"]
  N1["32.1 Costs"]
  N2["32.2 Benefits"]
  N3["32.3 Assumptions"]
  N4["32.4 Presenting the case"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX094"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["32.1 Costs"]
  N2["32.2 Benefits"]
  N3["32.3 Assumptions"]
  N4["32.4 Presenting the case"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX094"]
[Learning outcomes]
    |
    v
[32.1 Costs]
    |
    v
[32.2 Benefits]
    |
    v
[32.3 Assumptions]
    |
    v
[32.4 Presenting the case]
    |
    v
[Worked example] --> [Exercise EX094]

Learning outcomes

You will (1) estimate costs and benefits of governance; (2) present a business case; (3) state assumptions honestly.

32.1 Costs

Amara prepares a business case for expanding governance at Harbourline. Costs include steward time, a catalogue tool, training and automation work. She estimates each using synthetic figures, such as hours per steward per month multiplied by salary costs. She lists costs for three years, distinguishing one-time costs from ongoing ones. She notes that governance costs are often underestimated because staff time is treated as free, which later leads to roles being neglected. Amara asks the finance team to check her cost estimates before the case is presented.

32.2 Benefits

Benefits are harder to estimate. Amara considers reduced time spent reconciling reports, fewer duplicate mailings, lower breach risk from deleted over-retained data, better stock orders from accurate codes and avoided regulatory penalties. For each she estimates a range using evidence from earlier work, such as the number of duplicate members and the cost of each mailing. She keeps benefits conservative, explaining that credible cases understate rather than overstate gains. She shows each benefit as a range with its source, so readers can see where the numbers came from.

32.3 Assumptions

Every estimate rests on assumptions. Amara lists them clearly: steward hours, mailing costs, the share of report reconciliation time that governance can remove and the probability of a breach. She shows how results change if key assumptions are wrong, such as if benefits are half of estimated. The case remains positive under most scenarios. She explains that showing sensitivity builds trust, because readers can see the case does not depend on optimistic numbers. Amara puts the sensitivity table on a single page for the directors.

32.4 Presenting the case

Amara presents to the operations director and finance director. She opens with the problems they recognise, then costs, benefits, assumptions and a recommendation. The finance director questions the breach risk estimate, and Amara agrees it is the most uncertain item, showing that the case remains positive without it. The case is approved with a review after one year. Dr. Lindqvist notes that conceding uncertainty openly made the case more persuasive. Amara records the questions asked and her answers in the case file for the review a year later.

Worked example

Amara estimates three-year costs including staff time, conservative benefit ranges, lists assumptions with sensitivity and presents a case that remains positive even without the uncertain breach estimate.

Synthetic case. Figures are synthetic.

Errors and limits

Treating staff time as free underestimates governance costs.

Exercises

Continue studying — lesson 32 (chapter 32 of 40)

← Chapter 31 · Course chapter index · Chapter 33 →

Continue to the next authored lesson.