IT budget evidence worksheet

Before you approve the next IT budget

Your spreadsheet lists vendors and yearly amounts. It may still lack five answers. They are actual use, the requirement served, the contract terms, overlap with tools you own, and who profits from renewal.

This worksheet puts those five answers beside every amount. A CFO, controller, executive director, finance committee member or solo IT director can then decide each line from one record. They can approve, reduce, replace, defer or reject it.

Why there is no percentage target here

You will not find a target for IT spend as a share of revenue. That is deliberate.

An outside benchmark needs five things before it can carry weight: its source, peer set, date, denominator and limits. Most quoted IT-spend percentages fail that test.

Failure	What it looks like
No stated denominator	Revenue, operating expense or total budget, with or without IT salaries, telecom, cloud or the ERP. The same spending can differ twofold by what is counted
No stated peer set, or a customer list	A vendor’s benchmark often comes from its own customers, who already bought the category
A stale date	The shift from capital to subscriptions moved spending between lines, so different years measure different accounting
An undisclosed response base	A median of self-reported figures, with no stated response rate or sampling method
An average hiding the range	Within any band, spending varies several times over by size, sector and regulation, so the average describes nobody

Beneath all five sits a larger problem. A percentage says what others spend, not whether your spending buys anything. A median spender with four unproven controls is worse off than one at half the median with four tested ones.

So your own organisation is the benchmark. Each line is measured against your requirement, use, evidence, contract terms and the alternatives you own. When a vendor quotes a percentage, ask for its source, peer set, date, denominator and limits. Without them, it is decoration.

Sort every line into four groups

Sort before any decision. This sort is the first pass’s main result, and it changes the conversation more than any single finding.

1. Necessary and proven

A named requirement exists, and dated evidence shows the thing works. The requirement is a contract clause, a regulation, an insurer’s condition, a client’s security demand or a stated business need. The evidence is an artefact from the product itself, dated within ninety days.

What to do. Keep it, record why, and stop arguing about it every year. Review it at the contract decision date.

2. Necessary and unproven

The requirement is real, but nothing shows the thing works. This is the most dangerous group, and spending reviews handle it worst. The line looks funded, so nobody worries.

It may not run at all. Examples include a product licensed but never fully deployed, a scanner that stopped in 2024, or a backup never restored. All appear in a budget as healthy spending.

What to do. Test it, and do not cut it. Cutting it swaps an unknown for a known gap. A test takes an afternoon and moves the line into group 1 or into a real decision.

3. Vendor-driven

The requirement came from someone who earns money when you buy. That does not make it wrong, since vendors often see real problems first. It means nobody has stated the requirement independently.

What to do. Write the requirement yourself in one sentence, tied to an obligation or business need. If you can, the line joins group 1 or 2. If you cannot without the vendor’s material, that is your finding.

4. Unknown value

Nobody can state the requirement or show evidence. This is not automatically waste. It is an open question with a price, and sometimes the line turns out to carry real work.

What to do. Name an owner and a date. If the question is unanswered by the contract decision date, retire the line by default. Write that default into budget policy, so it happens without a meeting.

Fill this in before the budget meeting

Group	Lines	Yearly dollars	Share of IT budget
Necessary and proven
Necessary and unproven
Vendor-driven
Unknown value

Show this table before any single finding. In most first passes, groups 2 and 4 hold more of the budget than anyone expected. That moves the talk from cutting to testing.

Fill the worksheet in four passes

1. Ninety minutes. Fill Sheet 1 from the ledger without judging anything, to learn what is really paid.
2. Three hours, with the systems administrator. Fill Sheet 2, where evidence is requested and most rows reveal themselves.
3. One hour. Fill Sheet 3 from the contracts, and ask the payment question in writing.
4. One hour. Fill Sheet 4 and write the one-page memo.

Make the first pass complete.

The IT renewal teardown worksheet lists nine places to find recurring charges. They run from card statements and SSO app lists to DNS records, marketplace bills and expense claims. A review of the general ledger alone only covers spending already visible.

Sheet 1: Invoices and yearly spend

#	Service	Vendor	Business need in one sentence	Control served	Owner, a person	Yearly cost	How it is billed	Cost centre	Group, 1 to 4

• Business need. The owner writes one sentence a board would follow. “Detects malicious activity on 196 laptops and servers” works, and “endpoint security” does not.
• Control served. Name the client contract clause, insurance form question, audit requirement, regulation or business dependency it meets. “None” is a valid entry.
• Owner. Name a person, since departments do not renew contracts. A blank owner often predicts a group 4 line.
• Yearly cost. Annualise everything, including platform fees, seats, support tiers, overages and setup still being paid off.
• How it is billed. Record whether it comes by invoice, company card, reimbursed personal card, cloud marketplace or inside another bill. This shows where to look next year and catches spending that never reaches payables.

Sheet 2: Use and proof

#	Seats billed	Accounts that exist	Accounts active in 90 days	Proof it works	Proof date	Who produced the proof	Overlaps with line	How overlap was resolved

The proof each line needs

Ask one question that a document cannot easily satisfy. Can someone show an artefact from the product itself, dated within ninety days, showing it did something?

Product	Proof that counts	Proof that does not
Endpoint detection	Enrolled devices against all known devices, with dated detections or policy changes	A licence count
Backup	A restore test showing what, when, how long and who checked	A green dashboard
Email security	A block or quarantine report for a named period, with volumes	The vendor’s published catch rate
MFA	The enforcement policy export, with scope and every exclusion	One user’s sign-in screen
Log management	Volume by source, and the date a person last looked	Collection switched on
Vulnerability scanning	The latest scan with fix status	A scheduled, licensed scanner
Awareness training	Dated completion records with a numerator and denominator	The purchase order
Compliance platform	The current evidence package and the last login date	The rollout plan

Where no proof exists, write “no evidence on record”, with who was asked and when. That row belongs to group 2 or 4, depending on whether anyone can state the requirement.

Who produced the proof

Proof from the seller answers a question about its own performance. Prefer proof you see in a console yourself, or proof from someone with no financial stake.

This does not suggest providers falsify reports. It simply prefers the more independent source.

Duplicate functions

Two products meeting the same control at the same level are duplicate spending. Two in the same category at different depths may be sound. Compare the control sentences, never the product categories.

Common pairs include these.

• Mail filtering in your platform against a separate mail gateway.
• Endpoint protection in your platform against a purchased detection product.
• MFA in your identity provider against a standalone MFA product.
• SaaS backup in a plan you already buy against a third-party SaaS backup.
• A VPN against the access product bought to replace it and never switched off.

The last pair is the most common finding of all. A migration reaches eighty percent, the rest is hard and the organisation pays for both indefinitely. Search for it by name.

Sheet 3: Renewal, notice and seller income

#	Term end	Auto-renews	Renewal length	Notice days	Notice method	Decision date	Exit cost, known	Exit cost, staff hours	Exit cost, unknown	What the adviser earns	Confirmed in writing on

The decision date

Take the term end, subtract the notice period, then subtract fourteen days of working room. Diary the decision date, never the renewal date. A missed window turns your decision into a year already bought.

Sort the sheet by decision date. A small line due in sixty days outranks a large one due in nine months. Only the small one loses options by waiting.

Exit cost in three columns

Split exit cost into known dollars, staff hours and unknowns, as a board memo does.

Include the rest of the committed term and any early exit fee. Add data extraction and its format, record retention duties, integration teardown and the period paying for both. Count migration labour, retraining and any change to bundle prices for what you keep.

The control gap during a migration has no dollar figure. Describe it in the unknown column. A single exit number with no breakdown is an opinion, and three columns make it a finding.

What the adviser earns

Finance applies this principle everywhere else.

You know who prepared a valuation and how they were paid. You know whether a broker earns commission and which deals involve related parties. Technology buying is among the last places where nobody records what the recommender earns.

• It sets the burden of proof without argument. Advice from someone paid on the purchase can be right, but it needs an independently written requirement first. Recording the payment applies that standard without questioning anyone’s motives.
• It explains price gaps. One product often reaches you through three channels at three prices. Knowing who earns what on each gives you leverage.
• Rebates and tier credits stay hidden unless named. Margin is the smallest and most visible part. Volume rebates, marketing funds and partner credits are often larger and never appear on your invoice. Someone can truthfully deny “commission” while earning a large tier rebate.
• An independent firm loses nothing by answering. A written no costs an independent adviser thirty seconds. A refusal is itself information, and it goes in the column.

Send this wording, then record the answer, the date and who gave it.

For each product on the attached list, please state in writing what your firm earns from our purchase or renewal. Please cover margin, commission, rebates, market development funds, partner tier credit, referral fees and any other compensation. Please give the approximate amount or percentage.

Sheet 4: The decision record

#	Service	Group	Decision	Reason in one sentence	Evidence relied on	Owner	Action date	Yearly effect

Seven decisions

Decision	Use it when	The row must also hold
Keep	The requirement is written, evidence is current, use matches billing, and nothing you own does the job	The evidence and its date, and the next review date
Reduce	The line earns its place at a lower quantity or tier	The target quantity, the contract’s true-down rule and the notice date
Renegotiate	The product earns its place, but the terms do not	The terms sought, the decision date and the walk-away point
Replace	The requirement stands, but this product fails it or something owned meets it	The requirement to preserve and the overlap period
Retire	The requirement is gone, or something already paid for meets it	Proof of coverage, and who accepted any remaining risk
Defer	The decision belongs later in a sequence	The trigger: what brings it back, when, and who watches
Evidence required	The evidence needed does not exist yet	What evidence, who produces it and by when, before the decision date

Two rules make the last two decisions work.

A defer with no trigger is a renewal. Write the condition, the date and who watches, since “revisit next cycle” is not a trigger.

Evidence due after the decision date is not available to you. Either produce it sooner or decide on what you know today. Say so in the meeting, or the calendar chooses a year of spending.

The one page for the finance committee

A review that ends in a spreadsheet ends nowhere. Write one page for each material decision, in a form a board can act on.

Memo section	Taken from
Decision requested	Sheet 4, one decision
Risk	Sheet 1’s need and control, restated as a business consequence
Current evidence	Sheet 2’s proof and date, or a plain statement that none exists
Known cost	Sheet 1’s yearly cost and Sheet 3’s known exit cost, each with source and date
Unknown cost	Sheet 3’s unknown exit cost, and what sizing it would take
Modelled cost	Any estimate, labelled as one, with its assumption
Options	At least one smaller option and one defer with a trigger
Recommendation	One option, and why in one or two sentences
Approval	Decision owner, approval date, implementation owner, due date and proof of completion

Five rules from board reporting hold here too.

• Never blend known, unknown and modelled costs. A board forgives an unknown, but not a known figure later found invented.
• Include the smaller option when it is credible. A fraction of a proposal often covers most of the exposure, and saying so earns trust.
• Give every defer a trigger.
• Name the proof of completion. Approved but never checked is how an item returns two years later, bigger.
• Keep headline industry statistics out of cost tables. A global average has no bearing on your organisation, and once spotted it taints the page.

Three lines needing their own evidence

End of support

Windows 10 support ended on 14 October 2025, with no more help, updates or security fixes. Commercial Extended Security Updates start at US$61 per device in year one and double each year.

The doubling is what helps a budget. It turns “upgrade eventually” into a three-year cost curve with published prices. Set it beside the cost of replacing or repurposing devices, and the decision usually makes itself.

Spending your insurer asked for

Some lines exist because an insurer required them.

Sophos surveyed 5,000 IT and cyber leaders at organisations of 100 to 5,000 employees in 2024. Of the insured respondents, 97% had invested in defences to improve their insurance position. A vendor ran the survey on a selected group, and insurers’ terms vary by insurer, policy and year.

Flag every line an insurer drove, then check your own insurer’s current form. Requirements change at renewal. Organisations often keep paying for something a past insurer wanted and the current one does not.

Federally funded lines

If you spend federal awards, 2 CFR 200.303 requires effective, documented internal control, including reasonable cybersecurity and information safeguards. The single audit threshold is $1 million a year in federal award spending under 2 CFR 200.501. Both were current in August 2026.

For an executive director, some IT spending is then a control duty with documents attached. That makes it reportable, not merely defensible overhead. Your auditor and counsel decide whether a requirement applies, and each award agreement governs.

A worked example

This example is fictional. Every figure is illustrative, not a benchmark. The organisation has 120 people, and these are six lines from a longer sheet.

Service	Yearly	Requirement from	Evidence	Group	Decision
Endpoint detection	$34,200	A client contract clause and the insurance form	A coverage report 12 days old, with three dated detections	1, necessary and proven	Keep
Backup subscription	$21,000	A business dependency in 2023 board minutes	None, with no restore in 26 months of records	2, necessary and unproven	Evidence required, with a restore test by 30 September
Second mail gateway	$11,900	The 2021 purchase, with no current requirement	31 messages quarantined in 90 days, all also caught by the included tier	No current requirement	Retire at term end, after a 30-day side-by-side check
Password manager	$8,400 for 140 seats	Credential storage	Vault access log, used daily	1, necessary and proven	Reduce to 95 seats, since 84 accounts were active in 90 days
Threat intelligence feed	$16,000	Proposed by the outsourced provider, with 9% margin disclosed	Last console login 11 months ago	3, vendor-driven	Evidence required, or retire unless the IT owner writes the requirement
Compliance portal	$19,500	Bought in 2024 for an audit, with the owner since gone	Last login 14 months ago	4, unknown value	Defer for the auditor’s answer, due 5 September, before the 18 September decision date

The sort is the finding.

Two lines are proven, and one is necessary but untested. One is vendor-driven with no independent requirement, and one has no current requirement. The last is an open question costing $19,500 a year.

The actions are a restore test, three emails and a thirty-day comparison. No purchase appears anywhere.

Keep the worksheet with the approved budget

This worksheet is general guidance on reviewing IT spending, contract terms and control evidence. It is not legal, accounting, audit or insurance advice. Your counsel, auditor and broker decide whether a regulation, award condition, contract clause or insurance requirement applies.

Termination rights and auto-renewal terms vary by contract and state. Have counsel review any non-renewal notice before you send it.

SBK will review one budget category or one renewal independently if a second opinion helps. Call (718) 407-4169.