Technology cost audit
Prepared by Troopod for Andromeda · Version 1.0 · 4 November 2026
Confidential
1 · Executive summary
Technology cost audit: a structured review of Andromeda’s technology expenditure
Proposal prepared by Troopod for the Chief Financial Officer and the Board of Andromeda.
₹12 Cr
Annual technology cost (management estimate)
₹1.5 Cr
Minimum potential savings a year (illustrative)
9 weeks
Kickoff to final readout
₹20L
Fixed fee, excluding GST and travel
Context
Andromeda’s annual technology cost is about ₹12 crore (₹1 crore a month, per management), across in-house teams and third-party vendors and shared across group entities. Management has identified nine areas for review.
Proposal
A nine-week audit of ten areas: the nine management identified, plus the in-house engineering function. It delivers a validated spend baseline, a market benchmark with a justified or not justified verdict on each cost, and a ranked savings roadmap with ₹ impact, risk and effort.
Role of Troopod
Troopod delivers technology services. Where it can provide a service in the areas under review, it is listed among the recommended providers, marked as Troopod’s own, and shortlisted alongside other providers, wherever possible, on the same criteria. Andromeda decides. Troopod takes no commission from any third-party vendor.
Investment
₹20,00,000 plus GST, fixed, in three milestones. No part of the fee depends on savings. Travel and accommodation are additional, billed at actuals.
Indicative return
At a minimum target of 25% on addressable third-party spend, the fee is returned many times over. The illustration assumes the share of the ₹12 crore that is third-party; the actual share is confirmed at week 3. The 25% applies to third-party spend only: no saving is stated for the in-house team until it has been reviewed (area 10).
Assumed third-party share
Annual savings as a multiple of the fee (minimum target)
Annual savings at run-rate (minimum target)
Months of run-rate savings to equal the fee
Illustrative. The minimum target of 25% is confirmed or revised at the week 3 baseline. Savings are estimates, not guarantees. Detail on the Investment and return page.
Approval requested
- Engagement of Troopod at the fee and milestones on the Investment and return page.
- Nomination of the CFO as sponsor, and of a single point of contact.
- Read-only system access and priority documents by the end of week 2.
- Kickoff on signing, on the date Andromeda approves.
DetailContext and objectives
Our understanding
- Annual technology cost is about ₹12 crore; the in-house and third-party split is not yet established.
- Spend is shared across Andromeda’s group entities.
- Cloud hosting relates mainly to the OneAndro platform on AWS.
- Rule engine support is third-party today; management is considering bringing it in-house.
- Lending partners impose data and vendor requirements that constrain some cost options.
To be confirmed at kickoff
- The split of the ₹12 crore between in-house and third-party cost.
- The group entities in scope and the cost allocation basis.
- Whether AWS spend extends beyond the OneAndro platform.
- The system and vendor referred to as the rule engine.
- Lending-partner obligations that restrict vendor or hosting choices.
Every area answers three questions: what is spent, whether it is needed and used, and what the market would charge.
Measures of success at the final readout
- 95% or more of technology spend mapped to a vendor, contract and owner.
- A savings register: each item sized in ₹ (low and high), with risk, effort and owner.
- A prioritised list of quick wins that can be actioned within 90 days.
2 · Scope and approach
Ten areas, nine weeks and three governance gates
The audit covers the nine areas management identified, plus the in-house engineering function (area 10).
01
Information security
VAPT, VDI, ISO and audits
02
Web maintenance
AMC scope, work delivered, SLA
03
Cloud hosting (AWS)
Usage, right-sizing, commitments
04
Desktops and laptops
Buy, lease or central procurement
05
Customer engagement tools
SMS, WhatsApp, IVR, email, CRM
06
Rule engine support
Renegotiate, replace or in-house
07
CISO function
Delivery against remit, operating model
08
PR activities
Technology and tool spend only
09
Other software development
Vendor rates, delivery, code ownership
10
In-house engineering team
Cost against output, team level only
Out of scopeERP; compliance audits; hands-on security testing; PR agency fees; individual performance ratings and salary benchmarking.
Timeline and governance gates
W1
W2
W3
W4
W5
W6
W7
W8
W9
Mobilisekickoff, access
Discoverybaseline, register
Assessment10 areas
Market benchmarkingrates, shortlist
Recommendations₹ low and high
Report and readoutreport, deck
Sign-off gates
Sign-off gateRuns alongside assessment
End of week 3
Baseline sign-off
CFO and finance controller confirm the spend baseline (45 minutes).
End of week 5
Interim readout
CFO and IT head review first findings and quick wins (60 minutes).
End of week 9
Final readout
CFO and leadership receive the report, deck and savings register (90 minutes).
DetailKey questions and analyses by area
| # | Area | Central question | Principal analyses | Market comparator |
|---|---|---|---|---|
| 1 | Information security (VAPT, VDI, ISO, audits) | Is security spend proportionate to risk, and are VAPT, ISO and VDI priced at market? | VAPT scope against internet-facing assets; ISO scope and 3-year cycle cost; VDI active users against licences; tool overlap. | Market rate benchmarks; CERT-In empanelled providers for any VAPT recommendation. |
| 2 | Web maintenance | Does the AMC deliver the scope and service levels being paid for? | 12 months of tickets and hours against contract scope and SLA; technical health check. | Market AMC rate benchmarks on a standard scope. |
| 3 | Cloud hosting (AWS) | Is consumption efficient and appropriately committed? | Spend by service and environment; idle and oversized resources; Savings Plan and Reserved Instance coverage; data transfer; backup and disaster recovery. | AWS pricing and FinOps practice. |
| 4 | Desktop and laptop sourcing | What sourcing model gives the lowest 3 to 4 year cost? | 24 months of purchases, unit prices and approvals; buy, central procurement and lease or device-as-a-service compared; device security baseline. | Market price benchmarks for purchase and leasing. |
| 5 | Customer engagement tools | Are channels duplicated, and are unit rates competitive? | Tools by channel (SMS, WhatsApp, IVR, email, push, CRM); effective unit rate; paid seats against active users. | Market benchmarks per message, conversation or minute. |
| 6 | Rule engine support | Which option minimises 3-year cost at acceptable control: renegotiate, replace or bring in-house? | Contract and support terms; 12 months of changes and tickets; change control, version control and audit trail. | Alternative platforms; costed in-house option. |
| 7 | CISO function | Is the function delivering against its remit at a competitive cost? | Contract deliverables against 12 months of output; full-time, virtual and managed-service models compared. | Market benchmarks for each operating model. |
| 8 | PR activities | Is technology and tool spend duplicated by marketing tools? | Subscriptions and overlap. Technology and tool spend only. | None. |
| 9 | Other software development | Are rates, delivery and IP terms favourable? | Rate cards, billing and delivery record; code ownership, IP and exit clauses; code quality and engineering practice. | Market benchmarks per role-day. |
| 10 | In-house engineering team (added by Troopod) | Does what the in-house team costs make sense against what it delivers, and what is the right in-house and outsourced balance? | Overall activity by team and product; cost by role band against output; deployment frequency, lead time, change failure rate and recovery time from Jira and git; split of new work, maintenance and support; overlap with vendors. Team level only, with no individual assessment. | None. No salary benchmarking. |
DetailActivities by stage
| Stage | Weeks | Activities |
|---|---|---|
| Mobilise | 1 | Kickoff meeting; data request issued; read-only access established; interviews scheduled. |
| Discovery | 1 to 3 | Baseline built from 24 months of invoices and the general ledger; contract register; application, vendor and engineering team inventories; 12 to 16 stakeholder interviews. |
| Assessment | 3 to 6 | Each area reviewed against benchmarks, usage data and contract terms. |
| Market benchmarking | 4 to 7 | Standard scope per service; market rate benchmarking; justified or not justified verdict for each cost; indicative provider shortlist where a change is warranted. |
| Recommendations | 7 to 8 | Each opportunity sized in ₹ (low and high), rated for risk and effort and placed on a roadmap; draft report review in week 7. |
| Report and readout | 8 to 9 | Final report, executive deck and working files; readout to the CFO and leadership. |
DetailMarket benchmarking method
Standard scopeOne scope per service, so costs and providers are compared on the same basis.
Market ratesCurrent cost compared with market rate ranges from trusted and verified sources.
VerdictEach cost judged justified or not justified, with a recommended action: keep, renegotiate, replace or stop.
Provider shortlistQualified providers recommended where a change is warranted. Indicative only.
Shortlisting criteriaCapability, credentials, service levels, exit risk, stability and indicative price.
Negotiation briefA brief per existing vendor, using the benchmark, for renewal and renegotiation.
Services benchmarked, and the basis of comparison
| Service | Basis of comparison |
|---|---|
| VAPT | Price per application or IP, retests included |
| ISO 27001 certification and consultancy | 3-year cycle cost |
| VDI or alternatives | Cost per active user per month |
| CISO (virtual, managed or full-time) | Annual cost and days of cover |
| SMS, WhatsApp and IVR providers | Price per message, conversation or minute |
| Laptops and desktops | Cost per device per month over the lifecycle |
| Rule engine support | 3-year total cost per option |
| Software development vendors | Rate per role-day |
DetailDeliverables
| Deliverable | Timing |
|---|---|
| Kickoff pack and data request list | Week 1 |
| Weekly status note | Weekly |
| Validated technology spend baseline | Week 3 |
| Contract and renewal register, with notice dates | Week 3 |
| Interim findings | Week 5 |
| Market benchmark and provider shortlist pack | Week 7 |
| Final audit report | Week 9 |
| Executive deck for the CFO and leadership | Week 9 |
| Savings register and negotiation briefs | Week 9 |
Every figure traces to an invoice, usage record, contract term or benchmark source. The final report includes the baseline by area, vendor and entity; findings for each area (benchmark, recommendation, ₹ impact, risk, effort); market benchmarks and indicative provider recommendations; engineering findings; a prioritised roadmap (quick wins under 3 months, medium term, strategic); and recommended controls.
DetailRegulatory and lender considerations
- Borrower data remains in India.
- No recommendation transfers data to a vendor unable to accept lender and regulator audit and inspection clauses.
- Backup, disaster recovery, security monitoring, logging and VAPT cadence are optimised on price, not reduced, where lenders require them.
- Any VAPT provider recommended is CERT-In empanelled.
- The contract register identifies every contract carrying lender-mandated clauses.
- Technology cost is shared across group entities; the entities in scope are confirmed at kickoff.
The audit does not provide regulatory assurance. Compliance audits are outside scope.
3 · Investment and return
A fixed fee of ₹20 lakh, with no element contingent on savings
The audit fee does not vary with the findings or the savings identified.
₹20,00,000plus GST
Technology cost audit, nine weeks. Fixed fee: about 1.7% of annual technology cost.
Payment schedule
₹8,00,000On kickoff
₹6,00,000On the week 5 interim readout
₹6,00,000On final delivery, week 9
Not included in the feeGST, and travel, accommodation and other on-site expenses for work in Mumbai. These are additional to the ₹20 lakh and billed at actuals: Troopod presents the bills and Andromeda reimburses them.
Invoices are payable within 15 days. This proposal is valid for 30 days from 4 November 2026.
What the fee could return: an illustration
Assumed third-party share of ₹12 Cr
You pay, once
₹20L
EVERY YEAR
You save each year (minimum target)
Each block is ₹20L. The amber block is the fee; the purple blocks are the savings in one year. Savings at full run-rate equal the fee after about .
UpsideIf the audit finds larger opportunities in specific areas (for example the CISO model, rule engine or software vendors), savings could reach 50% of addressable spend, about a year. This is not part of the minimum target.
Scope of the 25%The minimum target applies to third-party spend only. No saving is stated for the in-house team until Troopod has reviewed it (area 10); any right-sizing opportunity is sized in the final report. The third-party share is confirmed at the week 3 baseline.
Multiples and payback are calculated on the ₹20L fee only.
DetailBasis of each savings case
| Case | Rate | Basis |
|---|---|---|
| Minimum target | 25% | Troopod’s minimum target for Andromeda’s addressable third-party spend, within the 20 to 30% that Bain & Company reports for replacing costly infrastructure with lower-cost alternatives. Confirmed or revised at the week 3 baseline. |
| Upside | 50%+ | Specific lines only, for example the CISO operating model, rule engine ownership and software development vendors, with supporting logic shown for each. Bain reports 30 to 40% from fundamental re-engineering; cases above that range rest on named lines only. |
Source for ranges: Bain & Company, “Reduce, Replace, Rethink: Transforming Technology Costs” (2021). Bain’s percentages relate to total technology costs and are used as indicative comparators. Savings are estimates, not guarantees. In-house salaries are excluded from the base; engineering right-sizing is reported separately.
DetailSavings classification
| Class | Definition | Treatment |
|---|---|---|
| Validated | Supported by an invoice, contract term or a written vendor quotation obtained by Andromeda. | Reported as confirmed saving. |
| Negotiable | Requires vendor agreement and is supported by a benchmark. | Reported separately, low and high. |
| Dependent | Requires engineering or organisational change. | Reported separately, with effort and risk. |
| Realised | Confirmed on a subsequent invoice. | Tracked in the savings register. |
DetailOptional extension: technology spend governance
Offered at Andromeda’s option, priced separately from the audit, as a fixed monthly retainer terminable on 30 days’ notice. No fee is linked to savings.
- Monthly: AWS cost review and update of the savings register.
- Quarterly: report to the CFO and re-benchmarking of one category approaching renewal.
- Continuous: renewal calendar with 90-day alerts and a negotiation brief before each renewal.
4 · Team and safeguards
Three named leads, two relevant cases and a disclosed approach to conflicts
Troopod delivers technology services. This page sets out who leads the audit and how any conflict is managed.
Why Troopod
Built it, then cut it
We cut our own AWS bill by 80% and consolidated a client’s three servers into one.
Fixed fee, fixed timeline
A fixed ₹20 lakh and nine weeks. No part of the fee depends on the savings found.
Trusted by 100+ leading brandsReference call on request
Relevant experience
Cloud hosting
Troopod’s own AWS environment
Cost optimisation of Troopod’s own cloud environment, with no change in functionality.
80% lower
- Optimised the application layer: leaner queries, lower compute per request, instances right-sized to actual load.
- Moved key services from higher-cost AWS offerings to more cost-efficient vendors.
- No reduction in functionality or uptime.
Infrastructure
Twin Health
AI digital-twin platform for reversing metabolic conditions such as type 2 diabetes.
3 servers to 1
- Profiled and optimised the application to remove CPU and memory bottlenecks.
- Consolidated services onto a single server without loss of performance.
- Approximately 66% less compute and fewer components to operate.
How conflicts are managed
Disclosure
Where Troopod can provide a service, it is listed among the recommended providers and clearly marked as Troopod’s own.
Same basis for every provider
Where Troopod is listed, other providers are shortlisted for the same service wherever possible, on the same criteria. Andromeda decides.
Non-binding recommendations
Provider recommendations are indicative. Andromeda obtains any quotation itself, from Troopod or any other provider.
CommissionsTroopod receives no commission or referral fee from any third-party vendor.
DetailGovernance forums
| Forum | Andromeda attendees | Timing | Duration |
|---|---|---|---|
| Kickoff | CFO, IT head, CISO, marketing and operations leads | Week 1 | 90 min |
| Stakeholder interviews (12 to 16) | One stakeholder each | Weeks 1 to 3 | 45 min each |
| Engineering team deep-dives | Engineering manager or tech lead per team | Weeks 2 to 4 | 60 min each |
| System walkthroughs: AWS, rule engine, VDI, engagement tools | IT head or system owner | Weeks 2 to 4 | 60 min each |
| Weekly status | CFO or single point of contact | Weekly | 30 min |
| Baseline sign-off | CFO, finance controller | End of week 3 | 45 min |
| Interim readout | CFO, IT head | End of week 5 | 60 min |
| Draft report review | IT head | Week 7 | 60 min |
| Final readout | CFO and leadership | End of week 9 | 90 min |
EscalationWhere priority data is more than 3 working days late, Troopod raises the matter with the CFO the same day.
DetailInformation required from Andromeda
Week 1
Read-only access
- AWS Cost Explorer and billing access
- Jira and git access, or exports of tickets and deployments
- Admin consoles for VDI, engagement tools and the rule engine
By end of week 2
Documents
- 24 months of ledger entries and vendor invoices
- All technology contracts, SOWs, AMCs and renewals
- Org chart with cost by role band, VAPT and ISO reports
Weeks 1 to 3
People and data handling
- 12 to 16 interviews across finance, IT, security and business heads
- One point of contact for data and access
- No customer personal data; mask before sharing
5 · Terms and next steps
Four steps to start, with the main risks managed
The nine-week plan is compact by design. The principal risks and their mitigations are below.
- Confirm the scope, fee and assumptions within the 30-day validity period.
- Execute the mutual NDA and the engagement letter.
- Nominate a single point of contact at Andromeda.
- Commence on signing: the first invoice (40%) is raised and the data request is issued.
Contactnj@troopod.io
Principal risks
| Risk | Mitigation |
|---|---|
| Late provision of data | Priority list issued in week 1. The timeline assumes data by the end of week 2; each week of delay moves the final readout by about one week. |
| Limited benchmark data for a service | Ranges from more than one trusted and verified source; marked “indicative” until validated. |
| Internal teams feel audited | CFO-sponsored kickoff; teams and processes only; findings shared with owners first. |
| Lock-in or lender clauses block a switch | The register flags notice dates and lender clauses; recommendations are ranked by feasibility. |
| Perceived conflict of interest | Troopod’s own services are marked as such and assessed on the same criteria; Andromeda decides. |
DetailAssumptions and terms
- Cloud spend relates mainly to the OneAndro platform; other AWS accounts are confirmed at kickoff.
- The engineering review is at team level, using anonymised cost data by role band. Where Jira or git data is unusable, deployment data is used and metrics are labelled directional.
- Troopod performs no hands-on security testing; any intrusive testing is by a CERT-In empanelled provider.
- Troopod does not obtain quotations. Provider recommendations are indicative and non-binding, and are not a commitment to procure, contract or guarantee any provider’s price or performance.
- Confidentiality: mutual NDA before any data is shared; access limited to named Troopod staff, in encrypted storage; all data deleted at the end, with written confirmation.
- Acceptance: Andromeda comments on the final report within 5 working days of delivery. If there are no comments, the report is accepted and the final milestone falls due.
- Troopod will complete Andromeda’s vendor due-diligence and information security questionnaire on request.
- Ownership: Andromeda owns all deliverables; Troopod keeps its methods and templates.
- Liability: limited to fees paid. Recommendations are advice, not guarantees.
- The fee covers the scope on the Scope and approach page. Changes in scope are agreed in writing before work begins.
- Implementation support after the report is optional and scoped separately.
DetailAppendix A: savings register format
| Field | Description |
|---|---|
| Reference and area | Item number and the area of expenditure (1 to 10). |
| Vendor and contract | Counterparty, contract reference and entity charged. |
| Current annual cost (₹) | As validated in the baseline. |
| Proposed action | Renegotiate, consolidate, right-size, replace or bring in-house. |
| Savings, low and high (₹) | Annual impact, with the supporting invoice, contract term or benchmark source. |
| Class | Validated, Negotiable or Dependent. |
| Risk and effort | Rated low, medium or high. |
| Owner and timing | Andromeda owner, notice date and target date. |
| Status | Identified, contracted or realised on invoice. |
DetailAppendix B: glossary
| Term | Meaning |
|---|---|
| AMC | Annual maintenance contract. |
| CERT-In | Indian Computer Emergency Response Team; publishes the list of empanelled information security auditors. |
| FinOps | The practice of managing and optimising cloud cost. |
| ISO 27001 | International standard for information security management systems. |
| IVR | Interactive voice response. |
| Savings Plan, Reserved Instance | AWS commitment-based discounts in exchange for a committed level of usage. |
| SLA | Service level agreement. |
| VAPT | Vulnerability assessment and penetration testing. |
| VDI | Virtual desktop infrastructure. |
Confidential. Prepared by Troopod for Andromeda. Version 1.0.