From invoice to invoice: the KeeFinops method
Quantification starts from your actual invoice, and a saving only counts once it shows in your invoice. Nine phases, from audit to execution, drawn from engagements run in read-only mode on public cloud, virtualized on-premise, licensing, contracts and AI; three engagement models that combine.
Nine principles that are not negotiable
They apply to every engagement, whatever the trigger, and can be checked in every deliverable.
Read-only, without exception
We ask for no write access to your resources, billing objects included, and install no agent on your machines. Your teams or your managed service provider make the changes, within your own processes.
The figure starts from your invoice
Savings are computed on the amortized cost actually observed and on the discount you already obtain, never on a list price. The analysis is reconciled with your financial reporting before any readout.
Measurement proves the recommendation
The provider's native recommendation is never enough: a saving only counts if your metrics confirm it, usually over 30 days at the 95th percentile (CPU, memory, IOPS). Every line carries its rationale, written in plain language.
Reduce before committing
Waste is removed, sizes and schedules are adjusted before any purchase of reservations or savings plans. Purchases then cover quantities that are already optimized.
Every amount has a status
One chain, from estimate to invoice: identified, validated by its owner, planned, realized, verified in the invoice. A saving is declared realized only with an implementation date, and verified only with evidence in the invoice, on a constant scope.
The owner decides
We bring the data, your teams bring the judgment. A reasoned refusal is a legitimate decision: the line leaves the gains and is never proposed again.
Start from what works
What you already do well is acknowledged first and is not rebuilt. The method fits into your committees, your tools and your pace.
Ranges, not false precision
Every estimate states its confidence level, its assumptions, its limitations and the data that would confirm it. What is not counted is written down.
One dataset, in your name
Workbook, summary, plans, tracking and indicators come from the same collection, with no figure typed in again. Your teams replay the collection, checks and workbooks on their own, documented step by step; running the engine's calculation chain again requires a license.
The nine phases of an engagement
Each phase has an objective, deliverables and a written exit criterion. Durations apply to a full engagement; they are orders of magnitude, set at scoping. The short format of the tooled audit covers the first phases in a few days: see the two formats.
Scoping and read-only access
You get written and validated rules, named contact persons and read access in place.
Phase 1 in detailTooled collection and completeness check
You get dated archives, a replayable repository and a completeness report.
Phase 2 in detailDiagnosis on observed cost
You get an analysis workbook reconciled with your financial reporting.
Phase 3 in detailLever qualification
You get a lever register, one line per resource and per lever, each with its evidence.
Phase 4 in detailReadout and management decisions
You get an executive summary, the list of expected decisions and a sequential execution plan.
Phase 5 in detailValidation by the owners
You get a dated decision on every line and an owner for every validated action.
Phase 6 in detailGuided execution
You get change requests ready to run, in the right order, with their checks.
Phase 7 in detailSavings verification and continuous steering
You get tracking of the savings verified in the invoice and a one-page monthly report.
Phase 8 in detailHandover and autonomy
You get a self-service procedure, formula workbooks and a documented handover.
Phase 9 in detailEmbedded, fixed scope, product: three models that combine
The model follows your need; the method, the rules and the statuses do not change.
Embedded: a FinOps practitioner inside your teams
A KeeFinops consultant forms the FinOps pair with your contact person, in your rituals and with your tools, at a cadence and for a duration set at scoping. A report at every review, handover as you go.
Fixed scope: one deliverable, one deadline
Scope, deliverables, deadline and price set before starting: audit, business case, VMware exit, renewal preparation, governance package, monthly review.
The product alongside: continuous measurement
Our app recomputes costs, variances and levers at every collection, between two engagements; running the calculation chain again requires a license.
A variable fee on negotiation savings exists as an option, in pilot only, with a baseline written at scoping. Depending on your organization: a lighter format for SMEs and scale-ups (short audit, then a one-hour monthly review), reinforced governance for large enterprises, co-delivery for IT service providers.
Same first days, different validation
The tooled FinOps audit covers phases 1 to 5 in the short format, on one scope, and adds validation by entity (phase 6) in the extended format, for a multi-entity group.
| Step | Short format (one scope) | Extended format (multi-entity group) |
|---|---|---|
| Scoping | One hour with your contact person | One hour, plus maturity by entity |
| Collection | Half a day | Half a day |
| First figures | Day 2 after access is opened on Azure; on Google Cloud and AWS, as soon as the billing export covers 30 days | Same |
| Readout | Two hours with management, on Day 2 on Azure | Two hours with management, then validation by entity |
| Validation | With the contact person, at the readout | One workbook per entity and the feedback register; about six weeks in total |
| Execution and tracking | As an option: one day a week for three months, then half a day a month | As an option: wave plans for the managed service provider, campaigns per owner, operating model and handover |
Sizing is expressed as a cadence and set at scoping, according to the number of clouds, subscriptions or accounts and scopes to validate. Execution follows the cadence of execution and continuous steering. For SMEs and scale-ups, the short format continues with a one-hour monthly review.
Scoping and read-only access
Objective. Set the scope, the ground rules and the access, so that you can act without risk from the first week.
Key activities
- Name the sponsor, the FinOps pair (our consultant and your internal FinOps lead) and one contact person per entity, subscription, account or application.
- Write down the scope, what is out of scope and the base rules: production not resized in the base plan, applications whose sizes are certified by the software vendor excluded from scheduled shutdowns, commitment policy. The engagement guarantees no amount and carries out no action.
- Obtain a reader role at the highest level of the cloud hierarchy and draw up the access matrix: what is read, what is missing, how it is compensated. A dedicated FinOps role, if needed, is described function by function for your security team, with no write access.
- Start right away, with the sole agreement of their owner, the risk-free actions: orphaned disks, non-production backups, idle resources.
Deliverables
- Scoping minutes, with the rules written and validated
- List of contact persons and their roles
- Access matrix and numbered list of prerequisites, reviewed every week
- For GreenOps: read access to emissions requested from scoping (method)
Your teams. The sponsor arbitrates the rules; the cloud lead, the security team and the cloud contract administrator open the access. Usually allow half a day of meetings, one hour in the short audit format.
Typical duration. Usually 2 to 5 working days if access follows, 1 to 3 weeks if your security validation cycle requires it.
Exit criterion. Rules validated in writing, contact persons named, read access effective, first collection successful.
Tooled collection and completeness check
Objective. Build a complete, dated and replayable base of costs and usage, with no agent on your machines.
Key activities
- Run the collector in your already authenticated session (portal console, workstation or dedicated role): it only calls read APIs and stores no secret.
- Collect in short, restartable phases: billing at amortized cost (at least 30 days, plus the billing lag), inventories, native recommendations and commitments; then metrics (CPU, memory, IOPS, hourly profiles); finally managed services, storage, network and logs.
- Load each archive into a cumulative repository: an archive read twice creates no duplicate, and any window can be recomputed without querying the cloud again.
- Check completeness: days present against days expected, coverage per resource. A missing metric is shown as not measured, never counted as zero.
Deliverables
- Dated archives, one per collection phase
- Cumulative and replayable data repository, completeness report
- Step-by-step collection procedure, written for a non-developer
Your teams. An operator from your team opens the read-only session: you keep control of authentication, and we receive no password.
Typical duration. Half a day in the short audit format. On a wider scope, usually 1 to 2 weeks of setup the first time, then a few hours on a new scope.
Exit criterion. End-of-collection report in the green (a failed archive is never loaded) and completeness check without alert.
Diagnosis on observed cost
Objective. Know where the money goes, what already works and where the potential lies, with figures reconciled with your invoice.
Key activities
- Produce the analysis workbook: one line per resource (amortized cost, on-demand share, share covered by commitments, licenses, disks, backup), with metrics over 30 days, native recommendations and a parameters tab that can be changed during a meeting.
- Reconcile the workbook, item by item, with your financial reporting, and read the actual discount of your commitments in the billing lines.
- Attach each cost to an entity, a team or an application through an ordered chain of rules (tags, parent resource, explicit rules, majority group or account, otherwise unallocated), then measure tag quality.
- Explain the anomalies (month-to-month jump, credit note, billing lag) before any optimization, and read maturity capability by capability.
Deliverables
- Analysis workbook with live formulas, with its parameters and checks tabs
- Tag quality report and share of cost by allocation source
- Maturity reading by capability: what works, what is missing
Your teams. IT financial control or the FinOps team carries out the reconciliation; the cloud team provides the tagging policy.
Typical duration. Short format of the tooled audit on Azure: first figures on Day 2 after access is opened; on Google Cloud and AWS, as soon as the billing export covers 30 days. Complete workbook, reconciled with your reporting: usually 5 to 10 working days after the first collection, 2 to 5 weeks for multi-cloud or multi-entity.
Exit criterion. No cell in error, checks in the green, reconciliation gap below the tolerance set at scoping (usually 1% at most), anomalies explained.
Lever qualification
Objective. Turn findings into a list of levers that are proven, quantified and assigned, which an operations team can read and accept.
Key activities
- Apply to each lever a written eligibility rule and measured evidence: the native recommendation and 30 days of metrics must stay below the chosen threshold (thresholds and safeguards).
- Write the explicit exclusions (applications whose sizes are certified by the software vendor, domain controllers, license servers) and investigate the largest cost item with its team.
- Remove duplicates: compute the overlaps between levers and show gross and net; shared purchase recommendations remain informational.
- Classify each line by the decision it requires (central policy, owner decision, commitment purchase) and give it a range, a confidence level and the data that would confirm it.
Deliverables
- Lever register: evidence, plain-language rationale, saving, effort, risk, prerequisites, effect on commitments, owner and identified status
- Detection rules documented in the parameters tab
- Prioritized list of additional data and access
Your teams. Technical management validates the rules; the backup lead, application contacts and the CISO are consulted, usually in one or two workshops of 1 to 2 hours.
Typical duration. Usually 1 to 3 weeks, partly in parallel with the diagnosis.
Exit criterion. Every line has its evidence, its owner (or a fallback dimension), its risk, its effect on commitments and a status; no amount is counted twice.
Readout and management decisions
Objective. Obtain decisions, not just present a potential.
Key activities
- Produce the summary from the workbook, with no figure typed in again: what is already well optimized, where the money goes, the potential per lever, gross and net.
- Separate three horizons on the prioritization matrix: quick wins (0 to 6 weeks), medium term (1 to 6 months) and options outside your current policy, quantified separately.
- Write the sequential execution plan: for each action, why it pays, how to carry it out step by step, how to check it, its pitfalls and its prerequisites.
- Propose a commitment doctrine: coverage capped on stable production only, standard families, term aligned with planned migrations, purchases in tranches.
Deliverables
- Executive summary, with one section per entity if needed
- List of expected decisions, with owner and due date
- Sequential execution plan and commitment purchase plan
Your teams. Technical management or the CIO office, finance, procurement, the FinOps lead and entity contacts, for a session that usually lasts 1.5 to 2 hours, reviewed beforehand with the IT team.
Typical duration. Short format of the tooled audit on Azure: readout on Day 2 after access is opened. Otherwise, the first summary usually comes 1 to 2 weeks after the start on a simple scope, 3 to 5 weeks for multi-cloud; decisions on the commitment doctrine usually take 1 to 3 weeks.
Exit criterion. Rules and doctrine recorded in writing, execution plan validated, an owner named for each action or family of actions.
Validation by the owners
Objective. Convert the identified potential into dated commitments, made by the teams that operate the resources.
Key activities
- Launch each entity or owner with a short message, in the sponsor's name, with the amount identified, the main actions and the line-by-line validation workbook.
- Hold a short launch meeting to validate actions, owners and priorities together, and list the constraints: critical applications, maintenance windows, business calendar.
- Handle large volumes through bulk rules agreed once, and follow up according to steps agreed at scoping, up to a management decision with the quantified impact.
- Reapply the feedback register at each new analysis: a discarded action never comes back.
Deliverables
- Launch messages and follow-up kit
- Validation workbooks, per entity and consolidated
- Versioned feedback register and commitment minutes
Your teams. The technical and application leads of each entity: a short launch meeting, then a response time set at scoping.
Typical duration. Short format: with the contact person, at the readout. Extended audit format: about six weeks in total, mostly validation by entity. In a long engagement, a full campaign usually spans 1 to 2 months, in waves.
Exit criterion. Every line has a dated decision: validated, discarded with a reason, to investigate or not applicable. Every validated line has an owner and an effective date.
Guided execution
Objective. Move the validated actions through your change processes, in the right order and with checks.
Key activities
- Turn the validated lines into change requests in the format of your ITSM tool: one line per change without downtime, one change per machine for actions with downtime.
- Respect the order reduce before reserving: resizing and shutdowns, then a check of existing commitments, then purchases in tranches; disks, backups and simple services move forward from the first week (dependencies).
- Have the policies that depend on no owner approved in committee, each with an effective date: non-production backup retention, storage lifecycle, log retention.
- Run scheduled shutdowns with commitments in mind, after a pilot on a small non-production batch, with safety nets: snapshot before deletion, a possible return to the original size.
Deliverables
- Change files ready to run, without downtime and per machine
- Tracked action plan: owner, status, completion rate, date
- Scheduled shutdown waves and pilot plan
Your teams. Operations or the managed service provider executes; contact persons set the maintenance windows; procurement buys the commitments.
Typical duration. First changes usually 3 to 4 weeks after the start; full execution usually takes 3 to 6 months, at the cadence of execution and continuous steering.
Exit criterion. Each action has a written verification criterion, and it is met: for example, after a resize, peak CPU below 70% and available memory above 20% over a window set at scoping, otherwise a return to the original size.
Savings verification and continuous steering
Objective. Prove every saving in the invoice and keep the setup alive. The engine computes the secured run-rate and the variance bridge; the before and after check, resource by resource, is done today in our tracking workbooks.
Key activities
- Track the value chain in euros per month (identified, validated, planned, realized, verified in the invoice), the amount generated to date and the year-end projection, by entity and by action family.
- Verify each realized action in billing, resource by resource, by comparing a before window and an after window: the observed value replaces the estimate.
- Spot what falls outside the plan (optimizations with no plan line, new costs, sharp increases on an item that was marginal until then) and keep the list of what is not counted: credit notes, credits, billing corrections, contractual discounts.
- Regenerate workbook, summary and tracking at each collection, with a what changed page and a log that dates every decision.
Deliverables
- Tracking of verified savings: summary, checks, commitments, log
- One-page monthly report to the sponsor
- Green IT indicators measured on a fixed date, as an option (GreenOps)
Your teams. Your FinOps lead runs it, IT financial control cross-checks: usually 30 minutes to 1 hour per week, and 1 to 2 hours per month.
Typical duration. Setup usually takes 2 to 3 days, then it is ongoing: weekly review and full monthly collection.
Exit criterion. A saving is declared verified only with an implementation date and evidence in the invoice; the figures presented in committee are frozen at a date and checked again against the invoice.
Handover and autonomy
Objective. Enable your team to replay the cycle: collection, checks and workbooks without us, the engine's calculation chain under license.
Key activities
- Write a step-by-step procedure for a non-developer: prerequisites, collection by phases, completeness check and a troubleshooting table of symptom, cause and action.
- Replace manual handling with formula-driven workbooks, checked against the values of the last cycle.
- Write the checks to redo at each cycle: rebuilt total equal to the invoice, no uncategorized cost, official exchange rate, computed cells protected.
- Have your operator run a full cycle, first with us present, then alone.
Deliverables
- Versioned self-service procedure and summary runbook
- Collection procedure and formula workbooks, in your name; running the engine's calculation chain again requires a license or our support
- Handover documentation and refresh checklist
Your teams. Your internal FinOps operator (no developer profile required) and the cloud lead.
Typical duration. Prepared throughout the engagement: usually 1 to 2 days of writing for a simple chain, 2 to 4 weeks of handover at the end of a long engagement.
Exit criterion. Your operator has run a full cycle alone (collection, workbook recalculation or regeneration by the licensed engine, checks in the green), and the procedure has been corrected after that first run.
The rules that make every figure checkable
Prioritization, sequencing, evidence thresholds, indicators and reviews are gathered on a separate page, for readers who want to check the detail.
Prioritization
A gain, effort and risk matrix, three horizons and options outside policy quantified separately.
Prioritization in detailDependencies and sequencing
Reduce before reserving, existing commitments first, a single window per resource.
Dependencies in detailEvidence from measurement
For each lever: what is measured, over which window, with which threshold and which safeguard.
Evidence in detailExecution indicators
The target, the trajectory and the proof, and the dashboard that explains the gap between the three.
Indicators in detailDeviations and reviews
Feedback register, escalation agreed at scoping, a review pace aligned with your committees.
Reviews in detailPractices by context
What we check before submitting a recommendation, and what the method adds depending on the context.
Practices in detailSame framework, other sources, another calendar
The nine phases apply everywhere; what changes with the domain is the data, the model and the pace. The detail: method by domain and method for infrastructure decisions.
Public cloud: Azure, AWS, Google Cloud
The full path described above. Where data is less detailed, each lever carries a confidence level and we list the read rights that would refine it; if your allocation already works, we industrialize it. Prerequisites and access by cloud: method by domain.
Tooled FinOps auditProcurement, vendors and contracts
A register of contracts and renewal dates, a renewal prepared in four stages (actual usage, scenarios, negotiation position, check after signature) and invoiced prices checked against the price grid. The detail.
Procurement, vendors and contractsLicensing, SAM and SaaS
Licenses are valued at full cost; a hybrid benefit is only activated after checking the entitlements available; priorities follow renewal dates, and a saving only counts if the invoice drops. The detail, SPLA included.
Licensing, SAM and SaaSOn-premise, VMware and migration
The full internal cost is computed on the same scope as the cloud, hosting and energy included. Stay or migrate: two trajectories compared over five years, with an optimized status quo always computed and one week of scoping for a VMware exit. The method for decisions.
VMware exit and business caseAI
New AI cost items are governed, not cut, and are never presented as savings: owner, budget and alerts first, commitment only if usage settles. Levers: the right model for each task, caching, caps. The detail.
AI FinOpsGreenOps
The emissions published by your provider, monthly and attached to the same dimensions as costs, next to two Green IT indicators; no avoided emission is announced before it is confirmed. The detail.
GreenOpsExecution and continuous steering
One review a week, prepared actions, commitments bought after reduction, a budget reforecast every month. Dependencies and sequencing.
Execution and continuous steeringLarge enterprises: reinforced governance
A common allocation framework, committees, roles, adoption KPIs per entity, contracts tracked, a reforecast budget. Reinforced governance, package by package.
Large enterprisesYour tools first, light tooling for the rest
- Read-only collection: in your session, with no agent and no stored secret, or through a dedicated read-only FinOps role. Azure: Cost Management exports at amortized cost, Resource Graph, Azure Monitor, Advisor. AWS: CUR 2.0 and Data Exports read from S3, Cost Explorer, Cost Optimization Hub, Compute Optimizer. Google Cloud: billing export to BigQuery, inventory at organization level, native recommendations. Outside the cloud: virtualization exports, monitoring, application repository, managed service invoices, license declarations.
- Processing and outputs: an ingestion chain feeds a cumulative repository; replaying a day rewrites that day, with no duplicate. Calculation rules are written, versioned and tested on synthetic data; workbooks have live formulas and summaries are produced without retyping.
- Tooled by the engine today: collection, FOCUS normalization, rules, workbooks, per-scope plans, feedback register, purchase plan, secured run-rate, variance bridge, Green IT KPIs, brief and summary. Azure: complete chain, replayed on an anonymized pilot engagement within a 1% tolerance. Google Cloud: workbook, per-scope plans, Green IT KPIs, summary. AWS: CUR 2.0 and first rules, to be recalibrated on a first real export. The weekly run does not produce the per-scope workbooks yet.
- Consulting, outside the engine: reading and arbitration, operating model, business case, VMware exit, licensing, SaaS and SPLA, procurement and contracts, emissions published by providers, before and after savings verification, in our tracking workbooks. Planned: AI cost module, emissions import and agentic assistant.
Three collection modes, the same archive. The script pasted in the portal console needs no installation, and the token never leaves the browser. A workstation can collect with a read-only account. In scheduled mode, your teams deploy a job in your subscription or account, under a read-only identity. No agent is installed on your machines.
Your data. The collector runs on your side. If the analysis runs at KeeFinops, the collection archive (billing, inventory, metrics, resource names and tags; no application content) is sent to us and processed in a container without network access; you can also host this container in your own environment. See the privacy policy.
Frequently asked questions
Do you need write access to our environments?
No. We work in read-only mode only (reader role, billing read access). Your teams or your managed service provider make the changes, within your processes. We never enter a credential and receive no password: you open the session in which the collection runs yourself. For AI cost APIs that require an admin key, extraction runs on your side and the key is not passed to us.
Do we need to buy or install a tool?
No, not during the engagement. Collection relies on your provider's native read APIs and runs in your session, with no agent on your machines; if you already have a FinOps tool or a BI platform, we build on it. After the engagement, the collection, checks and workbooks remain yours; running the engine's calculation chain again requires a license.
How do you compute the savings?
On your observed amortized cost and on the discount you already obtain, never on a list price. Overlaps between levers are deducted, and both gross and net are shown. Gains are given as a range with a confidence level, and what is not counted is written down: credit notes, credits, contractual discounts, billing error corrections.
Do you guarantee an amount of savings?
No, and we write it down from scoping. We guarantee instead that every figure can be traced back to your invoice, is proven by measurements and comes with its limitations.
How much time will your teams need to spend?
Your FinOps lead usually spends 30 minutes to 1 hour per week, and 1 to 2 hours per month. Each entity or team has a short launch meeting, then a delay set at scoping to validate its lines. Operations handle the validated changes in cycles, at a pace set at scoping.
What happens if a team refuses a recommendation?
A reasoned refusal is a legitimate decision. The line leaves the gains and the reason is recorded in the feedback register. The recommendation is never proposed again in later analyses.
Should we buy reservations or savings plans right away?
No. We reduce first (sizes, schedules, unnecessary resources), then check the utilization of your existing commitments, and only then buy, in tranches. Everything that does not depend on commitments starts in parallel from the first week.
Our tags are incomplete: is that a blocker?
No. We quantify from the first collection: each cost is attached through a documented chain of rules (tag, parent resource, explicit rules, majority group or account), and a report lists the errors to fix at the source. The rules bridge the gap in the meantime; the real fix remains the tag.
What happens to the approach after you leave?
It carries on without a consultant. Collection and checks are documented step by step for a non-developer, the workbooks recompute on their own, and your operator runs a full cycle alone before the end of the engagement. You keep the deliverables and your configured policy; running the engine's calculation chain again requires a license.
How do you protect our data?
Access is read-only and no secret travels in files or messages. Data and deliverables stay in the spaces you authorize, and a data processing agreement governs the engagement. The deliverables carry your name, and no information that could identify you is reused outside your engagement. See the privacy policy.
Which scopes do you cover?
All IT spend: procurement, vendors and contracts, licensing and SaaS, virtualized on-premise, Azure, AWS and Google Cloud, AI costs and the cloud footprint. The method is the same everywhere, with a common allocation key that makes it possible to compare full costs. The level of evidence for each domain: Expertise.
Let's see how this methodology applies to your scope
Thirty minutes to choose the entry point, the format and the calendar.