in Blog

August 13, 2026

How to Audit LLM Spend: Tools and Techniques for Cost Control

Author:




Edwin Lisowski

CGO & Co-Founder


Reading time:




9 minutes


Most organizations cannot explain their largest LLM cost spike until the invoice arrives. By then, the expensive feature is already in production, and engineering teams are reacting to overspend rather than preventing it.

The reason is often a lack of cost attribution. Without it, teams cannot trace spending to the feature, team, prompt change, model upgrade, or deployment responsible for the increase.

This guide gives you a 30-minute audit methodology, a tool comparison, and a framework for turning that one-time audit into ongoing monitoring.

KEY TAKEAWAYS

Bills are driven by token volume and type mix, not just per-token rates — reasoning tokens bill at the same rate as standard output, but a model can generate several times more of them than the visible answer needs.
Output tokens cost several times more than input tokens, so verbose outputs dominate spend even when prompts are short.
Attribution depends on tagging every request with a trace ID, owner team, workflow ID, feature name, and tenant handle before it reaches the gateway.
A first audit takes about 30 minutes: gather, normalize, split by token type, attribute, rank drivers, calculate cost-per-task, set alerts.
Tool choice should scale with spend — vendor dashboards below $5k/month, a proxy or observability platform up to $50k/month, dedicated FinOps tooling above that.
Continuous monitoring — weekly, monthly, and quarterly review plus anomaly alerts — is what turns a one-time audit into an ongoing cost-control practice.

Understanding What You’re Paying For

LLM pricing has moved from flat per-token rates to layered models: usage tiers, committed-spend discounts, and provider-specific token types billed differently. Anthropic discounts cache reads by 90% but applies a 25% premium on the initial cache write — a detail often left out of savings estimates.

90%
Discount on Anthropic cache reads
+25%
Premium on the initial cache write

Reasoning tokens (o-series, GPT-5.x, Gemini “thinking,” Claude extended thinking) bill at the same rate as standard output — there’s no separate higher price tier. What drives up the bill is volume: a model can generate several times more reasoning tokens than the visible answer requires.

Your total spend is a function of model mix, caching behavior, retry patterns, and token-type distribution — not simply tokens × price. The main cost drivers:

  • API call volume and model tier — the combination of model, token count, and call frequency.
  • Output tokens — typically 4–8x the cost of input tokens depending on tier, so long-output features (reports, commented code, detailed explanations) dominate spend.
  • Context compounding — conversation history is re-sent as input on every turn, so long sessions and verbose tool outputs (file reads, logs, search results) get re-billed repeatedly; tool output alone can account for over half of a typical coding-agent bill.
  • Retry storms and runaway agent loops — transient errors or malformed tool results can trigger repeated billing across every retry or loop iteration.
  • Prompt and context bloat — larger system prompts and retrieved context raise the average cost per request, ahead of showing up as a total spend problem.

Bills are unpredictable because spend is unattributed and token usage stays opaque until the invoice arrives. Provider dashboards show totals, not attribution — without request-level tagging and trace-level ownership, you can’t trace a spend increase back to a customer, feature, prompt change, or agent run

Step 1: Establish Cost Attribution

What to track

  • Spend by project, team, model, and month-over-month, to see trends and concentration.
  • Input vs. output tokens, tracked and alerted on independently — the ratio between them is a leading indicator of anomalies.
  • Token types split into input, output, cached input, and reasoning buckets where the provider exposes them.
  • Cost per task or workflow, so you have unit economics you can track over time.

Data sources

  • Provider dashboards and APIs — OpenAI Usage API/CSV export, Anthropic Billing API, Google Cloud Billing, self-hosted inference logs.
  • Request logs — application logs or tracing platforms capturing token counts, model, and metadata per call.
  • Gateway or observability platforms — tools like Braintrust, Langfuse, and Helicone that normalize and tag usage across providers.

Attribution options

  • Separate API keys per team or project, tracked in provider dashboards or via a proxy such as LiteLLM.
  • Request tagging — attach feature, team, tenant, and prompt-version metadata using provider fields or SDK-level tracing.
  • Spreadsheet or BI aggregation — export raw data, normalize cost, and roll up by tag for a first pass.

The minimum useful contract on every request: trace_id, owner_team, workflow_id, feature, and a non-PII user or tenant handle. If a field will be needed for chargeback review, it has to exist before the first gateway hop — not be reconstructed afterward.

Cost forecast template

Forecast = Baseline spend × (1 + expected growth) × (1 − planned efficiency gains), where baseline is average daily or weekly spend by feature and model, growth is expected traffic or rollout impact, and efficiency covers planned optimizations like caching, model routing, or prompt compression. Update monthly against actuals.

Step 2: Choose Your Audit Tools

Tool categories

  • Vendor-native: OpenAI Usage API, Anthropic Admin/Billing API, Google Cloud Billing.
  • Platforms: Braintrust, Langfuse, Helicone, LiteLLM, OpenLLMetry, Pezzo, FinOps LLM.
  • DIY: custom scripts or spreadsheets that normalize provider CSVs against internal logs.

Tool comparison

Tool Token Compression Real-Time Dashboards Team-Level Attribution Best For
Lineman ✓ (vendor claims 40%+ reduction — unverified independently) Coding-agent workflows needing compression plus visibility
OpenLLMetry ✓ (via backends) Teams already standardized on OpenTelemetry
LiteLLM ✓ (via API keys) Multi-provider proxy with per-key budgets
Langfuse Application-level tracing and prompt versioning; self-hostable
Helicone ✗ (caching only) Request logging with caching for repeat prompts
Braintrust Cost, eval, and trace integration for release gates
Pezzo Open-source, self-hosted — verify current maintenance activity before adopting
FinOps LLM Dedicated LLM FinOps platform with cross-provider anomaly detection

Decision tree

  • 1–2 providers, under $5k/month: vendor-native dashboards plus spreadsheet attribution.
  • 3+ providers or $5k–$50k/month: a proxy (LiteLLM) or observability platform (Langfuse, Braintrust) for cross-provider normalization and tagging.
  • Over $50k/month or multi-team chargeback: an end-to-end trace and ownership contract with request-level tagging and automated alerts, potentially via a dedicated FinOps platform.
  • Coding-heavy workflows: add a token-compression layer alongside whichever platform you choose above.

Step 3: Run Your First Audit

Step Tool needed Time Output
1. Gather billing data Provider dashboards/APIs 5 min Raw CSV/JSON per provider
2. Normalize tokens Spreadsheet or script 5 min Cost-per-request table
3. Split token types Provider APIs with token breakdown 5 min Input/output/cache/reasoning split
4. Attribute to teams API key mapping or metadata 5 min Team-to-feature cost matrix
5. Identify top drivers Sort/spreadsheet 3 min Ranked list of cost patterns
6. Cost-per-task Task count from app logs 5 min Unit economics per workflow
7. Set up alerts Provider billing alerts + dashboard 2 min Anomaly detection active

Step 4: Set Up Continuous Monitoring

Cadence

  • Weekly: high-spend teams review top drivers, cost-per-task trends, and alert fires.
  • Monthly: all teams run the full audit; update the forecast and budget allocations.
  • Quarterly/annually: review pricing changes, provider contracts, and the optimization roadmap.

Key metrics

  • Total cost over time (daily/weekly/monthly).
  • Cost breakdown by agent, team, and model.
  • Average cost per task or user interaction.
  • Input-to-output token ratio per feature — a sudden shift signals a prompt or behavior change.
  • Cost per successful eval — spend divided by requests passing quality thresholds.
150%
of 7-day average
A simple alert rule: flag any day that exceeds 150% of the trailing 7-day average spend, or any feature whose hourly cost exceeds two standard deviations from its rolling average.

Common Audit Findings

  • Spend above the PoC estimate — usually context compounding, verbose outputs, or unbounded agent loops that weren’t present under controlled PoC conditions.
  • Unexplained “other” spend — shared API keys or missing request tags; fix by enforcing tagging at the gateway.
  • Month-over-month spikes — often correlate with prompt-version changes, feature rollouts, or retry storms during provider outages.
  • API key sprawl — multiple untracked keys per team fragment visibility; consolidate under a proxy or observability platform.

From Audit to Action

Running this audit gives you cost visibility, spend attributed to teams and features, and alerts that catch anomalies early — the prerequisites for optimization you can’t do without measurement first.

Once cost is integrated into system design from day one rather than discovered after launch, AI stops being a runaway corporate expense and starts behaving like any other mature component in the tech stack — exceptionally powerful where it fits, ruinously expensive where misapplied, and valuable when governed with discipline.

Marcin Marczyk

Delivery Director, Addepto

Who Owns This

Optimizing LLM spend is often treated as a model-layer problem — pick a cheaper model, tune a prompt, enable caching. But the cost drivers in this audit sit at the boundary between the model call and the surrounding application: context compounding, retry storms, and tool-output bloat are architectural issues, not prompting issues.

Practitioners increasingly frame this as a three-function problem, and warn that assigning it to a single function is a primary reason cost-optimization efforts fail:

  • Engineering owns the actual cost-per-task levers — model selection, routing, caching, and retry/circuit-breaker design — because these require commit access to the request pipeline, not just dashboard visibility.
  • Platform/infrastructure owns the tagging standards, gateway configuration, and allocation rules that make attribution possible in the first place; without this, teams build incompatible tracking schemes independently.
  • Finance/FinOps owns budgets, thresholds, and review cadence, but can’t own the fix — cost targets set without engineering-level implementation authority tend to produce reporting theater rather than actual savings.

Whether “LLM-specific expertise” deserves recognition as a fourth, distinct skill is contested, not settled. Some practitioners treat prompt and context design — tool contracts, output schemas, eval design — as a specialized skill alongside software engineering; others argue it’s an extension of requirements engineering, fully absorbed into existing roles. What’s not contested: someone on the team needs deep familiarity with token pricing tiers, cache mechanics, and provider-specific behavior — without that, a technically correct architecture can still misdiagnose where the money is going.

LLM cost optimization fails when it’s treated as one person’s part-time responsibility. The actual levers — routing and retry logic, tagging and attribution infrastructure, and budget governance — sit in different functions with different access and incentives.


FAQ


How long does an LLM cost audit take?

plus-icon minus-icon

A first-pass audit takes about 30 minutes: gather billing data, normalize token counts, split by token type, attribute spend to teams and features, rank the top cost drivers, calculate cost-per-task, and set alerts.


Why are LLM bills so unpredictable?

plus-icon minus-icon

Because spend is unattributed and token usage stays opaque until the invoice arrives. Provider dashboards show totals, not attribution — without request-level tagging and trace-level ownership, you can’t trace a spend increase back to a customer, feature, prompt change, or agent run.


What data should every LLM request be tagged with?

plus-icon minus-icon

At minimum: a trace ID, owner team, workflow ID, feature name, and a non-PII user or tenant handle. These fields need to exist before the first gateway hop, not be reconstructed afterward during a chargeback review.


What's the biggest hidden cost driver in LLM spend?

plus-icon minus-icon

Output tokens and reasoning tokens. Output tokens typically cost 4–8x more than input tokens, and reasoning-mode calls can generate several times more hidden tokens than the visible answer requires — at the same per-token rate as standard output.




Category:


Generative AI


Share this article:

Share on LinkedIn


LinkedIn

Share on X


X

Share on Facebook


Facebook