The argument
You Are Already Paying the Wack Tax
Every unnecessary dependency, duplicate control, unclear handoff, and permanent exception adds operating and assessment cost long before it produces a formal finding.
The field pattern
A single quarterly evidence request needs security, networking, cloud operations, the application team, a vendor contact, and the person who maintains the master spreadsheet. Nobody is doing anything unreasonable. The control simply has too many undocumented joins.
Why it matters
Wack Tax is paid in cognitive load. Staff spend time rebuilding context instead of improving controls. Assessors spend time reconciling artifacts instead of testing implementation. Leaders see compliance cost but not the architectural choices creating it.
The tax compounds. Every undocumented dependency increases the number of people, records, and variants needed to produce representative evidence. The bill returns next quarter because nothing about the system of work changed.
Questions that expose the Wack
- How many people are required to answer one control question?
- How much evidence is collected twice under different names?
- Which recurring explanations could become durable metadata?
- Which exception costs more to preserve than to remove?