Most small business IT budgets are built by taking last year's figure and adding a bit. This works until something significant fails, at which point the spending becomes reactive, urgent and considerably more expensive than it needed to be.
A better structure separates IT spending into four categories, each behaving differently, and forecasts each on its own logic.
The four categories
1. Run — keeping things working
Managed services or internal salaries, licensing, connectivity, hosting, backup, security tooling. Predictable, recurring, and scaling with headcount. This is usually 60 to 70 per cent of total IT spend and is the easiest to forecast.
2. Refresh — replacing what wears out
Hardware has a service life and a predictable failure curve. Laptops and desktops run three to five years; servers four to six; firewalls and switches five to seven, though support and security updates often expire earlier than the hardware fails.
The right approach is a rolling replacement — budgeting a fixed share of the estate every year rather than replacing everything at once. With a four-year cycle, replace a quarter of your devices annually. This converts a lumpy capital shock into a predictable line, and avoids the situation where an entire fleet ages out simultaneously.
3. Grow — capacity for what is coming
New hires need equipment and licences. New locations need infrastructure. New systems need implementation. This is driven by your business plan rather than by IT, which means it requires a conversation with whoever owns that plan.
A useful rule: know your per-seat cost of onboarding a new employee — device, licences, setup labour — as a single figure. It makes hiring decisions more honest and this line trivial to forecast.
4. Change — projects and improvement
Migrations, security improvements, automation, replacing systems that no longer fit. This is the category that gets cut first and produces the most compounding cost when it is deferred repeatedly.
Benchmarks, used carefully
IT spending commonly falls between 3 and 7 per cent of revenue for small and mid-sized businesses, with wide variation by sector — professional services and financial firms sit higher, businesses with low technology dependence lower.
Treat these as a sanity check rather than a target. A business at 2 per cent may be efficient or may be accumulating risk it has not measured. One at 9 per cent may be overspending or may be mid-migration. The number tells you to ask a question, not what the answer is.
A more useful internal benchmark is cost per employee per month, all-in. It is easier to track, it makes growth planning straightforward, and it exposes creeping licence sprawl faster than a revenue percentage will.
What always gets forgotten
- Licence true-ups. Seats added through the year that nobody removed when people left. Auditing assigned licences annually reliably finds savings.
- The overlap during any migration, where you pay for the old and new environments simultaneously.
- Backup storage growth. Data grows continuously and storage costs follow.
- Security tooling that was a project cost last year and is now a recurring subscription.
- Cyber insurance premium increases, and the cost of the controls required to renew.
- Training, both security awareness and for any new system being introduced.
- Disposal — secure data destruction and responsible recycling of retired equipment.
- The contingency. Something will fail unexpectedly. A line of 5 to 10 per cent of the total makes that manageable rather than disruptive.
Building the number
- Inventory what you have, including every recurring subscription. Most businesses find services nobody uses.
- Age the hardware and identify what reaches end of life within the horizon you are budgeting.
- Forecast headcount with whoever owns hiring, and multiply by your per-seat onboarding cost.
- List known projects with rough costs and preferred timing.
- Apply the contingency.
- Compare the total against last year and against your revenue percentage, and investigate any large movement.
If you have a managed provider, most of this should come from them — they hold the asset inventory and the age profile. A provider who cannot produce a hardware replacement forecast is not managing lifecycle, which is one of the things you are paying for.
Making the case for the deferred items
Security and resilience spending competes badly against revenue-generating investment because its return is an absence of events. Two framings help.
The first is downtime cost. Calculate what an hour of outage costs your business, then express prevention spending against the outages it avoids. That converts an abstract risk into a comparable number.
The second is insurance and contracts. Increasingly, security controls are not optional — cyber insurers require them to bind coverage, and enterprise clients require them in security questionnaires. Framed that way, the spending is a condition of doing business rather than a discretionary improvement, which is a considerably easier conversation.