How to Build an IT Budget That Survives the Year

Most small business IT budgets are built the same way. Take what was spent last year, add a bit for price rises, and put the number in the spreadsheet. It takes twenty minutes and it survives until roughly October, when a server fails or a licence renewal comes in forty per cent higher than expected.

The problem is not the number. It is that a single line called "IT" cannot tell you anything useful. You cannot see what is keeping the lights on versus what is buying you something new. You cannot tell whether a cost increase is a supplier problem or a growth problem. And when you need to cut, you have no basis for choosing.

A better budget separates spending into four categories that behave differently and answer different questions. It takes a few hours rather than twenty minutes, and it survives contact with the year.

Category one: run

This is what it costs to keep the business operating exactly as it does today. Nothing new, nothing improved.

It includes user licensing, support arrangements, connectivity, hosting and cloud infrastructure, security tooling, backup, domains and certificates, and the hardware replacement cycle for equipment reaching end of life.

Two things make this category behave badly if you do not watch them.

It scales with headcount, and usually not linearly. Per-user licensing means every new hire adds a recurring cost. Budget this explicitly against your hiring plan rather than assuming the current total holds. If you plan to grow from forty to fifty staff, that is a twenty-five per cent increase on every per-seat line, and it starts the month they begin, not at renewal.

It quietly ratchets upward. Subscription prices rise, trials convert to paid, and tools accumulate. A tool nobody has used for eight months still bills monthly. This is the category where an annual review reliably finds money.

The useful question for this category is: what would we still be paying if we made no changes at all next year? That number is your floor.

Category two: replace

Equipment and systems have finite lives. Pretending otherwise converts a predictable expense into an emergency.

Laptops and desktops run three to four years in normal use. Servers, where you still have them, run four to five. Network equipment runs five to seven. Mobile devices run two to three. Anything running an operating system that has reached end of support is already overdue regardless of its age, because it stops receiving security updates.

The right way to handle this is to keep an asset list with purchase dates and to budget the replacement of one cohort each year rather than replacing everything at once. Businesses that buy all their laptops in a single year face a large, unavoidable bill every three years, and typically defer it, which means staff spend a year on failing equipment.

The honest version of this category includes the things people leave out: the labour to build and deploy the new equipment, the licence transfers, and the disposal, which for anything holding data means certified destruction rather than a trip to the tip.

The question here is: what reaches end of life in the next twelve months, and what does replacing it cost including the work to do it?

Category three: improve

This is spending intended to change something: reduce a risk, remove a manual process, enable something the business cannot currently do.

This is the category that gets cut first and should not be. Run and replace keep you where you are. Improve is the only category that changes your position, and businesses that zero it for two years running find themselves with an accumulated backlog that is far more expensive to clear than it would have been to address incrementally.

Keep it modest and keep it specific. Two or three named projects with a stated outcome beats a general allowance. For each one, write down what it costs, what changes as a result, and what happens if it does not get done this year. That last question is what makes the trade-off decision possible when something has to give.

Typical items for an Australian SMB right now: closing specific Essential Eight gaps, moving off an end-of-support system, consolidating overlapping tools, an authentication upgrade, or a first structured AI deployment.

Category four: contingency

Something will happen. It always does.

Ten per cent of the run and replace total is a reasonable contingency for most businesses. Fifteen if you are running any system past its supported life, because the probability of an unplanned failure is materially higher.

The discipline that matters is not the number, it is treating contingency as a real reserve rather than a line to be raided. If it gets spent on a nice-to-have in March, it is not available in July when the failure occurs.

Do not confuse contingency with the improve category. Contingency covers the unplanned. Improve covers the planned. Merging them means the first surprise consumes your entire improvement programme.

The costs that get missed

Almost every budget we review omits some of the following. They are not exotic; they are just easy to forget because they are irregular.

Cyber insurance premiums, and the work to meet the conditions. Premiums have risen every year for several years running, and renewal increasingly requires specific technical controls. Budget the premium and budget the remediation work the renewal will require. We wrote about the direction of travel in our post on what Australian cyber insurers will require in 2027.

Onboarding and offboarding. Each new starter needs equipment, licences, and setup time. Each departure needs access revocation and equipment recovery. With meaningful staff turnover this is a real recurring cost that appears nowhere in most budgets.

Compliance and audit work. Client security questionnaires, tender responses, and formal audits consume real time. If you are pursuing certification, that is a project with a cost, not an administrative task.

Training. Both security awareness and tool-specific. Deploying a capability that nobody is trained on delivers a fraction of its value.

Data egress and storage growth. Cloud storage grows continuously and is rarely reviewed. Egress charges surprise people during migrations specifically.

The renewal cliff. Multi-year deals and introductory pricing end. Know which of your agreements have a step-up coming and when.

Sanity-checking the total

Two checks are worth running once you have a number.

As a share of revenue. Australian SMBs outside technology sectors typically land somewhere between two and five per cent of revenue on IT, with professional services and anything regulated at the higher end. This is a rough band, not a target, and a business mid-modernisation will legitimately sit above it. But if you are well outside it in either direction, understand why. Substantially below usually means deferred replacement and accumulated risk rather than efficiency.

Per user per month. Divide the run category by headcount and by twelve. This is the number that makes supplier conversations concrete and makes the cost of growth visible.

Reviewing it during the year

An annual budget reviewed annually is a forecast, not a management tool. Quarterly is enough.

At each review, ask three questions. Is actual run spending tracking to plan, and if not, what was added? Has anything moved forward in the replacement schedule, for example equipment failing early? Are the improve projects progressing, or have they quietly stalled while the money remains allocated?

The third question is the one that catches the common failure, which is not overspending but underspending on improvement while the backlog grows.

Where to start

The hardest part is the inventory: knowing what you have, what it costs, when it was bought, and when it needs replacing. Most businesses do not have this in one place, and building it is the majority of the work. Once it exists, the budget largely writes itself and next year takes an hour.

Our free IT health check includes an asset and spend review: what you are running, what you are paying for, what is approaching end of life, and what you are paying for and not using. It is the input the budget needs. No obligation, no sales pitch.

Learn more about our IT strategy services