Most IT budgets are built by taking last year's number and adding a bit. That works until a server reaches end of life, a licence renewal arrives higher than expected, or a cyber insurer asks for controls you do not have. Then IT becomes the line that always goes over.
I spent years in financial planning and analysis before I worked in IT, and in my experience the problem is rarely the size of the budget. It is the structure. A good IT budget separates what you know from what you are guessing, plans replacements before they become emergencies, and is presented in terms leadership can make decisions about. Here is how I approach it with clients.
Start with an inventory, not a spreadsheet
You cannot budget for what you have not listed. Before any numbers, gather:
- Every device: laptops, desktops, phones, servers, firewalls, switches, wireless access points and printers, with purchase dates and warranty end dates.
- Every subscription and licence: productivity software, security tools, line-of-business applications, cloud hosting, domain names and certificates, with renewal dates and user counts.
- Every service contract: managed services, internet, phones, printer leases and support agreements.
- Every known change: planned hires, office moves, new systems and projects already promised.
If you work with an IT provider, they should be able to produce most of this from their asset and licence records. If they cannot, that is a conversation worth having on its own.
Separate recurring costs from one-off costs
The most useful thing you can do is split the budget into two parts.
Recurring costs
These are what you pay every month or year to keep running: managed services, software subscriptions, internet, phones, cloud hosting, security tools and support agreements. They should be predictable. Budget them from the actual contracts, adjusted for expected headcount, because most of them scale per user.
One-off costs
These are projects and purchases: new laptops, a firewall replacement, a migration, a new office. They are lumpy by nature. Budget each one with a short description and expected timing, so leadership can approve, defer or cancel it on its own merits.
Keeping the two apart does two things. It shows leadership how much of IT is simply the cost of staying in business, and it makes the discretionary decisions visible instead of buried.
Plan device refresh as a cycle, not an event
Devices age on a schedule, so plan them that way. Pick a refresh cycle that suits your organization. Many organizations replace laptops somewhere in the three to five year range, with heavier users at the shorter end. Network equipment and servers often last longer, but their security updates end on the manufacturer's timeline, not yours.
Then spread replacements out. If you bought most of your laptops in one year, you do not want to replace them all in one year again. Replacing a share of the fleet every year smooths the spend and avoids a cliff.
Remember the costs around a new device as well: setup time, moving data, accessories, and secure disposal of the old one.
Put every licence renewal on a calendar
Licence renewals are among the most predictable costs in IT and among the most often missed. List each renewal with its date, term and current cost. Then, before each one comes due:
- Check the user count. Pay for active users, not people who left last spring.
- Check the tier. Some users may need more features, and some may need fewer.
- Expect price changes. Vendors adjust prices from time to time, and exchange rates affect anything billed in a foreign currency. Build in a reasonable increase rather than assuming flat pricing.
- Ask whether it is still used. Overlapping tools are common after a few years of growth.
Give security its own line
Security spending used to hide inside the general IT number. It deserves its own line, for two reasons. First, the pressure comes from outside: cyber insurers, clients and regulators increasingly expect specific controls, such as multi-factor authentication, endpoint detection and response, tested backups and staff awareness training. Second, security is a risk decision, and leadership should make it consciously.
Separate what is already in place and recurring from what needs to be added this year. If an insurer or a major client has asked for a control you do not have, that belongs at the top of the list.
Find end-of-life software and hardware early
End of life is the date a vendor stops releasing security updates. After that date the product keeps working, but every newly discovered vulnerability stays open for good. Operating systems, server software, firewalls and line-of-business applications all have these dates, and vendors publish them well in advance.
Check your inventory against those dates for the coming year and the one after. Anything reaching end of life needs a plan: replace it, upgrade it, or isolate it and accept the risk in writing. Replacing on your own timeline is almost always cheaper than replacing in the middle of an incident.
Include a contingency
Something will happen that you did not plan for: a device failing out of warranty, an unplanned hire, a vendor price increase, a project that grows. A contingency line, set as a modest share of the total, lets you absorb it without a mid-year budget conversation. Name it honestly. A contingency hidden inside other lines tends to get spent by accident.
Present it to leadership in business terms
Leadership does not need to understand every product. They need to understand what they are buying and what happens if they do not. Structure the presentation to support decisions:
- Summary. The total, the change from last year, and the two or three reasons for the change.
- Keeping the lights on. Recurring costs, with the main drivers such as headcount.
- Required changes. End-of-life replacements and security requirements, each with the risk of not doing it.
- Recommended investments. Projects that improve productivity or reduce risk, each one approvable on its own.
- Contingency. Shown openly, with how it will be released.
For each one-off item, one sentence on the risk or benefit is enough. "This firewall stops receiving security updates in June" persuades more than a page of specifications.
Finally, show how the budget will be tracked. A quarterly check of actual spending against the plan keeps surprises small and builds trust for next year's conversation.
Frequently asked questions
What percentage of revenue should we spend on IT?
There is no reliable universal number. It varies widely by industry, by how digital your operations are, and by how much you have invested in the past. Build the budget from your own inventory and plans first, and compare with peers in your sector afterwards if you can.
Should we lease or buy devices?
Both can work. Leasing smooths cash flow and enforces a refresh cycle. Buying is often cheaper over a device's life if you actually replace on schedule. Your accountant can advise on how each is treated in your books.
How far ahead should an IT budget look?
Budget one year in detail, and keep a lighter three-year view for major replacements and end-of-life dates. That longer view is what prevents the cliff years.
When should we start building next year's IT budget?
Two to three months before your fiscal year begins. That leaves time to gather the inventory, get quotes and have a real conversation with leadership instead of a rushed approval.
How Ceifa helps with IT budgeting
Budgeting is part of the client relationship I own personally at Ceifa. Our flat monthly fee per user makes the support line of your budget predictable, and our monthly reporting and business reviews keep device ages, licence counts and end-of-life dates in front of you before they turn into surprises.
If you want help building a budget and roadmap your leadership can approve with confidence, our IT consulting and strategy work is the place to start, or simply contact us.