Section II, Frameworks

How to measure technical debt.

There is no single correct way to quantify technical debt. The right framework depends on your tooling, your audience, and the precision required. Five frameworks compared, with formulas, worked examples, and a decision tree.

Decision flow

Which framework fits your situation?

Question 1

Do you have static analysis already deployed?

YESUse TDR or SQALE

NOContinue to next question

Question 2

Is your audience the board, not engineering?

YESUse Financial Impact

NOContinue to next question

Question 3

Do you run honest sprint retrospectives?

YESUse Time Based

NODefault to Financial Impact

Framework

Technical Debt Ratio

TDR

Formula

TDR = (remediation_cost / development_cost) x 100

When to use. Teams with SonarQube, Code Climate, or similar static analysis already deployed.

Strengths

+Simple formula, universally understood by engineering audiences
+Tool supported across SonarSource, CAST, Code Climate, Codacy
+Objective and repeatable across runs
+Trend-friendly, easy to chart quarter over quarter

Trade offs

-Only captures code-level debt, misses architectural and process debt
-Requires tool investment and regular scan cadence
-Remediation estimates vary by tool, comparison across vendors imprecise
-Less compelling for non-technical audiences than dollar figures

Bands

Below 5%	A	Healthy
5 to 10%	B	Manageable
10 to 20%	C	Concerning
20 to 50%	D	Critical
Above 50%	E	Severe

Worked example

A codebase needs 240 developer days to remediate all flagged issues, against 2,400 development days that produced it. TDR = 240 / 2400 x 100 = 10%. SQALE rating B, manageable. Action: Boy Scout rule plus quarterly debt sprints.

Framework

SQALE Method

SQALE

Formula

SQALE_index = sum(remediation_time_per_issue), Ratio = index / dev_cost

When to use. Teams using SonarQube or any tool that implements the SQALE plugin.

Strengths

+ISO 25010 aligned, the de-facto industry standard for code quality reporting
+Five-grade A to E rating maps directly to TDR percentage bands
+Comprehensive: covers maintainability, reliability, and security debt
+Strong audit trail, every grade traceable to specific issues

Trade offs

-Requires SonarQube or compatible infrastructure investment
-The grading thresholds are sometimes opaque to non-engineering audiences
-Issue-to-remediation-time mapping depends on rule configuration
-Less useful when most debt is architectural rather than code-level

Bands

0 to 5%	A	Required reconstruction effort under 5%
6 to 10%	B	Required reconstruction effort 6 to 10%
11 to 20%	C	Required reconstruction effort 11 to 20%
21 to 50%	D	Required reconstruction effort 21 to 50%
Above 50%	E	Required reconstruction effort above 50%

Worked example

SonarQube reports 480 hours of remediation time across 1,200 flagged issues. The codebase represents 8,000 development hours. SQALE Ratio = 480 / 8000 = 6%, rating B. Maintainability is solid. Focus on code-smell density rather than full debt sprints.

III

Framework

CAST Method

CAST

Formula

Principal = sum(violation_severity x remediation_dollar_cost)

When to use. Large enterprises with 50+ applications and a CAST Highlight or Imaging deployment.

Strengths

+Cross-technology, scans Java, .NET, COBOL, JavaScript, and 40+ stacks uniformly
+Outputs dollar principal directly, business-friendly metric
+Designed for portfolio-level aggregation across hundreds of systems
+Scoring tied to published research from CAST Research Labs

Trade offs

-Vendor-specific tooling, license cost meaningful for smaller orgs
-Setup overhead, typically a multi-week deployment project
-Less granular than SonarQube for deep code-quality coaching
-Best results require professional services engagement

Bands

Lower tier per LOC	Low	Sustainable principal
Mid tier per LOC	Moderate	Manageable principal
Higher tier per LOC	High	Active remediation required
Top tier per LOC	Severe	Restructure or retire candidate

Worked example

A 500K LOC enterprise application scores in the high band, with a per-line principal in the higher tier. Active remediation required. Decision: roadmap a 12 month reduction plan to bring the per-line principal back into the moderate band.

Framework

Financial Impact

FIM

Formula

annual_cost = team_size x loaded_salary x debt_time_fraction x age_multiplier

When to use. Building a board case, ROI models, or budget proposals without static-analysis data.

Strengths

+Speaks the same language as the audience receiving the result
+No tooling, no scanner, runs in 90 seconds
+Maps directly to engineering payroll line in the budget
+Easy to sensitivity-test by varying debt-time fraction

Trade offs

-Relies on debt-time estimation, the input most likely to be guessed
-Plus or minus 30% precision unless paired with retrospective data
-Does not identify which debt to remediate, only the total cost
-Less defensible without citing Stripe, McKinsey, or DORA bands

Bands

Below 15%	Healthy	Within best-in-class engineering orgs
15 to 25%	Average	Industry typical, monitor trend
25 to 40%	Elevated	Above McKinsey upper bound
Above 40%	Critical	Velocity loss likely impacting roadmap

Worked example

Twelve engineers at $145K loaded salary, 28% debt time, codebase age 5 years. Cost = 12 x $145,000 x 0.28 x 1.175 = $572,460 per year before incident costs.

Framework

Time Based

Formula

debt_fraction = debt_hours / sprint_hours

When to use. Agile teams with mature retrospective practice and velocity tracking.

Strengths

+Uses data the team is already collecting, no new instrumentation
+Grounded in lived team experience, defensible in engineering meetings
+Tracks weekly, the highest cadence of any framework
+Reveals trend before financial models do

Trade offs

-Subjective, two engineers can categorise the same hour differently
-Variance between teams limits portfolio-level aggregation
-Only as good as the retrospective discipline behind it
-Misses dormant debt that no current sprint touches

Bands

Below 15%	Healthy	Aligned with 20% rule headroom
15 to 30%	Typical	Industry median per Stripe
30 to 45%	Elevated	Above McKinsey upper bound
Above 45%	Critical	Velocity compounding decline likely

Worked example

A team logs 56 debt hours against a 200 hour sprint capacity. Debt fraction = 28%. Velocity has declined 12% over the last four quarters. Reading: typical band, but the trend signals compounding pressure.

Section VI

Comparison matrix.

All five frameworks side by side across the dimensions that matter when picking one.

Dimension	TDR	SQALE	CAST	Financial	Time
Inputs	Tool output	Tool output	Tool output	Salary, %	Sprint hours
Output type	Percentage	A to E + %	Dollar principal	Annual $	Capacity %
Precision	High	High	High	Plus or minus 30%	Subjective
Tool cost	Mid tier	Mid tier	Enterprise tier	Free	Free
Setup time	1 week	1 to 2 weeks	4 to 8 weeks	Hours	Already in place
Audience fit	Engineering	Engineering	Enterprise IT	Board	Team
Captures arch debt	No	Partial	Partial	Yes (indirect)	Yes (indirect)
Update cadence	Weekly	Weekly	Monthly	Quarterly	Sprintly

Section VII

Common questions.

01Which framework should I start with?+

If you have SonarQube or Code Climate already, start with TDR or SQALE. They are precise and require no extra effort. If you have neither and need a number for a board meeting next week, the Financial Impact model is faster. If your team runs honest retrospectives, the Time-Based approach gives the strongest internal credibility because the data comes from your own engineers.

02Can I combine frameworks?+

Yes, and the best practice is to use two or three together. The strongest combinations are TDR (precision) plus Financial Impact (audience translation), or Time-Based (internal credibility) plus SQALE (industry-standard rating). Triangulating reduces the risk that a single methodology bias drives the conclusion.

03What is the difference between SQALE and TDR?+

TDR is a single ratio (remediation cost over development cost). SQALE is a full lifecycle method that produces a TDR-like ratio plus an A to E rating. SQALE adds the ISO 25010 quality model, which tags each issue against maintainability, reliability, security, and other characteristics. SonarQube reports both: the SQALE rating is the headline grade, the TDR is the underlying number.

04Why does CAST quote a dollar principal directly?+

CAST was designed for enterprise audiences who think in capital terms, not percentages. Their formula assigns a remediation dollar cost per violation based on severity. Summing across the codebase produces a principal figure analogous to a loan balance. The trade-off: precision is highly sensitive to the cost-per-violation calibration, which is opinionated and vendor-set.

05How often should I measure?+

TDR and SQALE: weekly via continuous integration. The cost is near zero once the scanner is wired in. Financial Impact: quarterly, ahead of board meetings. Time-Based: every sprint, as part of retrospective. Avoid annual measurement, the data is too stale to drive decisions.