An IT budget becomes difficult to defend when it combines “keeping things running,” new projects, overdue replacements, and emergency remediation in one unprioritized total. Give each dollar a category and a reason.
Use four budget buckets
| Bucket | Includes | CFO question |
|---|---|---|
| Operate | Support, subscriptions, connectivity, monitoring, routine security | What is the stable run-rate? |
| Refresh | Hardware, software versions, network, backup and recovery lifecycle | What becomes risky or expensive if deferred? |
| Change | ERP, integrations, automation, acquisitions, plant or site changes | What must be true before this project starts? |
| Reduce exposure | Recovery tests, access controls, segmentation, incident readiness | Which investment reduces the largest business interruption risk? |
Questions to resolve before approval
- What is contractually committed in the next 12 and 24 months?
- Which assets or systems are past their supported life, and what business process depends on them?
- Is this project solving a proven business problem, or compensating for unclear ownership and poor process?
- Who will operate the result after implementation, and what is the recurring cost?
- What recovery or security assumption is the budget relying on, and when was it last tested?
A board-ready output
For every major line item, show the business dependency, owner, timing, total cost, recurring cost, deferral consequence, and validation evidence. That creates a decision record without requiring the board to evaluate technical tools.
Make the owners build the estimate
Ask IT and operations to submit line items with the business process served, accountable owner, one-time cost, recurring cost, implementation effort, and consequence of deferral. Finance reconciles these to contracts, invoices, depreciation schedules, and approved projects. The CFO challenges assumptions and approves tradeoffs; the CFO does not select firewalls or write a backup plan.
The four buckets are decision labels, not accounting treatment. A recovery project may span several buckets. Assign each cost once, then separately tag its purpose and whether finance expects capital or operating treatment under company policy.
| Example request | Evidence before approval | Decision test |
|---|---|---|
| Replace an unsupported production server | Support end date, process dependency, migration quote, downtime plan | What risk changes if the replacement waits two quarters? |
| Expand managed support | Current service record, scope, service levels, exit terms | Which outcomes and reporting will the fee buy? |
| ERP integration | Manual rework baseline, data owner, acceptance test, run cost | When will the measured benefit exceed total cost? |
Put insurance beside resilience spending
Show cyber premiums and retention in the budget, but do not treat policy limits as a substitute for prevention or recovery. Ask the broker which incident costs, business interruption, dependent provider outages, and operational technology events the proposed terms may cover; wording and exclusions control. Ask IT to price the controls and testing needed to support accurate application answers.
Board summary: baseline run rate, committed renewals, proposed projects, exposure being reduced, evidence still missing, and the decision required this quarter. Use ranges where estimates are uncertain.