What are the four cost-of-quality categories, and how does spending move between them?

## The four buckets The cost-of-quality model comes from mid-twentieth-century manufacturing quality management and transfers to software with surprisingly little damage. Its purpose is not bookkeeping precision; it is to make visible that **you are already paying for quality**, and that the only open question is which bucket the money lands in. **Prevention cost** — spending that reduces the chance a defect is created at all. In software: working an example set through with the people who understand the domain before code exists, agreeing on a shared model and vocabulary, design standards, checklists, training, and tooling that makes a whole class of mistake unrepresentable. Prevention spending is paid up front, in full, whether or not defects would have occurred. **Appraisal cost** — spending on finding defects that already exist. Reviews, inspections, running the regression pack, exploratory sessions, audits, and the human time spent reading results rather than just executing them. Appraisal does not make the product better by itself; it converts unknown defects into known ones. **Internal failure cost** — rework on defects found before release. Re-opened work, re-testing, a story bounced back, a batch re-run in a test environment, a design revisited. This is the bucket people forget exists, and it is a useful counter to anyone who thinks catching things early is free: it still costs, it is simply the cheapest bucket in which to find a defect. **External failure cost** — everything spent after a defect has reached its users. Diagnosis under time pressure, out-of-band release, correcting data that the faulty code wrote, support handling, manual workarounds, compensation, regulatory exposure, and reputational damage. This bucket contains the largest per-defect amounts and the ones you can least reliably put a figure on. Prevention plus appraisal is often called the **cost of conformance** — what you spend to get it right. Internal plus external failure is the **cost of non-conformance** — what you spend because it was wrong. The ratio between these two is usually a more honest health indicator than any single bucket. ### How spending moves The classical claim is that failure cost falls as conformance spending rises, and falls faster than the conformance spending grows — up to a point. The oldest formulation of the model draws a total-cost curve with a minimum somewhere short of perfection, on the grounds that eliminating the last defects costs more than the failures they would cause. A later school argues that the minimum is an artefact of poor measurement, that prevention is far cheaper than the model assumed, and that the total keeps falling as prevention improves. **This disagreement is genuine and unresolved**; a candidate who states one position as settled fact is overreaching. What both camps agree on is the direction of the first moves: teams that spend almost nothing on prevention and pay heavily in external failure can nearly always improve total cost by shifting some spending leftward. A second, subtler movement matters more in practice. Adding appraisal without adding prevention converts external failure into internal failure — good, but it raises total cost, because you are now paying to find every defect you are still creating. Adding prevention reduces the defects that need finding at all, which is the only move that reduces appraisal and both failure buckets together. ### A worked tally Take a team maintaining a warehouse stock ledger, tallying one quarter in engineer-hours. Prevention: 34 hours of domain sessions and shared examples. Appraisal: 212 hours across reviews and reading check results. Internal failure: 96 hours of rework on things caught before release. External failure: one stale-cache read that reached production — 41 engineer-hours of diagnosis and fix, nineteen re-runs of a 6-hour nightly reconciliation, 2,847 hand-corrected ledger lines, and 63 support-hours. Two readings jump out. First, that single escaped defect rivals an entire quarter of internal-failure rework, which is the argument for earlier detection made in the team's own numbers rather than a borrowed multiplier. Second, prevention at 34 hours is barely funded against 212 hours of appraisal: the team is paying handsomely to find defects and almost nothing to avoid creating them. ### Honest limits The categories overlap. Time spent reading a review comment prevents the next defect and appraises this one; splitting it is arbitrary. Some items — the trust of a warehouse team that has stopped believing the on-hand numbers — resist measurement entirely, and the temptation is to score them zero, which quietly biases every comparison against quality spending. Tracking to the hour also costs real effort and can become theatre. Use the model as a **classification for reasoning and for arguing**, at coarse granularity, on real recent numbers; do not present it as an audited ledger.