What Is the Failure Risk Multiplier
What is the failure risk multiplier?
The expected cost of incidents that have not happened yet is the number of changes about to ship, times the likelihood that one change causes an incident, times the average cost of an incident in that class. Likelihood is priced from the architecture when the change ships: coverage or mutation score on the module, a base rate for the module's class, and a break factor for each interface the change drags across a module boundary. Incident history does not set that likelihood, so a tangled module with a clean log still prices high. The multiplier is one plus that expected failure cost divided by the cost of complexity for the same exposure, which is what you pay to build and maintain if nothing ever broke. The true cost is that cost of complexity plus the expected failure cost. When the cost of complexity is zero, use the additive form, because there is nothing to divide by.
How is the cost of an incident priced, and who owns it?
For each past incident, the cost is the hours to detect, fix, and validate, times the blended hourly rate of the engineers involved, plus revenue lost, churn, and SLA penalties. The hours engineers spend fighting the fire are already in that engineering cost, so the value of the features they did not build is not added on top. The expected severity is the mean of those costs, kept per incident class. The CTO brings the likelihood and the engineering portion. The CEO brings the business loss and the cost of complexity. One customer-facing outage is one incident, even when several breaks share it. A company with no incident records yet estimates severity from the fix hours a typical break would need plus the business loss of a degraded day, then replaces the estimate with the first real incidents.
Related reading
Get notified when new content drops