The CFO IT Budget Evidence Worksheet
Put Evidence Beside Every IT Budget Line
Test each amount against your requirement, actual use, dated evidence, contract terms, and approval decision.
Unlock the full document
This document is free. Leave a work email so we can send corrections and updated versions, and the full sheet unlocks below.
Before you approve the next IT budget
Your spreadsheet has vendor names and annual amounts. It may still lack five answers: actual use, the requirement served, the contract terms, overlap with tools you already own, and who earns money when you renew.
Count the security tools in your spreadsheet. Put necessity and dated operating evidence beside each line.
Use this worksheet to put the five answers beside every amount. A CFO, controller, Executive Director, finance committee member, or Solo IT Director can then approve, reduce, replace, defer, or reject the line from the same record.
When a percentage does not belong beside your budget
You will not find a target for technology spend as a percentage of revenue here. That absence is deliberate, and the reason is worth two minutes.
Any external benchmark needs five things before it can carry weight in a decision: its source, its peer set, its date, its denominator, and its stated limits. Most quoted IT-spend percentages fail that test, and they fail it in predictable ways.
| Failure | What it looks like |
|---|---|
| The denominator is undefined | Percentage of revenue, of operating expense, or of total budget. Does it include IT salaries. Does it include telecom, cloud infrastructure, the ERP that finance owns, the practice management system, the copier contract. Two organizations spending identically report figures that differ by a factor of two depending on what they counted. |
| The peer set is undefined, or it is a customer list | A vendor’s benchmark is frequently drawn from its own customers, which is a sample of people who bought that category of product. |
| The date is stale | The capital-to-subscription shift moved spend between budget lines without changing what was bought. Figures from different years are measuring different accounting. |
| The response base is undisclosed | A median of self-reported figures from a survey with an unstated response rate and an unstated sampling method. |
| The range is concealed by the average | Within any published band, the spread across organizations of different size, sector, and regulatory exposure is routinely several-fold. The average describes nobody. |
And the largest problem sits underneath all five. A percentage tells you what other organizations spend. It cannot tell you whether your own spend buys anything. An organization at the median with four unproven controls is in worse shape than an organization at half the median with four tested ones.
So the benchmark in this worksheet is your own organization. Each line is measured against your requirement, your use, your evidence, your contract terms, and the alternatives you already own.
One practical use for all of this: when a vendor or an adviser quotes a percentage at you, ask for the five items. Source, peer set, date, denominator, limits. If they cannot produce them, the number is decoration and it should carry no weight in the decision.
Put every budget line in one of four decision queues
Before any decision, sort. This sort is the deliverable of the first pass, and it changes the conversation more than any individual finding.
1. Necessary and proven
A named requirement exists, and dated evidence exists showing the thing operates.
The requirement is a contract clause, a regulatory obligation, a carrier condition, a client security requirement, or an operating need you can describe in business terms. The evidence is an artifact produced by the product itself, dated within the last ninety days.
The move: keep it, record why, and stop re-litigating it every year. Set the next review at the contract decision date.
2. Necessary and unproven
The requirement is real. Evidence that the thing works does not exist.
This is the most dangerous category on the sheet, and it is the one a spending review handles worst. The line looks funded, so nobody worries about it. It may not be operating at all. A licensed product that was never fully deployed, a scanner that stopped running in 2024, a backup that has never been restored: all of these appear in a budget as healthy spend.
The move: test it. Do not cut it. Cutting an unproven necessary control replaces an unknown with a known gap. A test costs an afternoon and it moves the line into category 1 or into a genuine decision.
3. Vendor-driven
The requirement originated with a party who earns money when you buy it.
This does not make it wrong. Vendors and providers see real problems and frequently see them first. What it means is that the requirement has not been independently stated, so it cannot yet be evaluated on its merits.
The move: write the requirement yourself, in one sentence, sourced to an obligation or an operating need. If you can write it, the line moves to category 1 or 2 and proceeds normally. If you cannot write it without referring to the vendor’s material, that is your finding.
4. Unknown value
Nobody can state the requirement and nobody can produce evidence.
This category is not automatically waste. It is an unanswered question with a price attached. Sometimes the answer arrives in a week and the line turns out to be load-bearing.
The move: name an owner and a date. If the question cannot be answered by the contract decision date, the line gets retired by default, and that default should be written into the budget policy so it happens without a meeting.
Complete this sort before the budget meeting
| Category | Count of lines | Annual dollars | Percentage of technology budget |
|---|---|---|---|
| Necessary and proven | |||
| Necessary and unproven | |||
| Vendor-driven | |||
| Unknown value |
Present this table before presenting a single individual finding. In most first passes, categories 2 and 4 together hold a larger share of the budget than anyone in the room expected, and that fact reframes the entire discussion away from cutting and toward testing.
Complete the worksheet in this order
Pass one, about ninety minutes. Fill Sheet 1 from the ledger. No evaluation. You are establishing what is actually being paid.
Pass two, about three hours, with whoever administers the systems. Fill Sheet 2. This is where evidence gets requested and where most rows reveal themselves.
Pass three, about one hour. Fill Sheet 3 from the contracts, and ask the compensation question in writing.
Pass four, about an hour. Fill Sheet 4 and write the one-page memo.
Do not skip pass one’s completeness. The companion IT Renewal Teardown Worksheet sets out nine sources for finding recurring charges, including card statements, single sign-on app lists, DNS records, cloud marketplace billing, and expense reimbursements. A budget review conducted on the general ledger alone reviews the spend that was already visible.
Sheet 1: Your current invoices and annual spend
| # | Service or product | Vendor | Business need in one sentence | Control served | Owner (named human) | Annual cost | Billing path | Cost center | Category (1 to 4) |
|---|---|---|---|---|---|---|---|---|---|
What to enter beside each invoice
- Business need. One sentence, written by the owner, in language a board would follow. “Detects malicious activity on 196 laptops and servers” works. “Endpoint security” does not.
- Control served. The obligation or requirement it satisfies: a clause in a client contract, a question on a carrier form, an audit requirement, a regulatory duty, or a named operating dependency. Some lines have none, and that is a legitimate entry.
- Owner. A person. Departments do not renew contracts; people do. A blank here is one of the more reliable predictors of a line in category 4.
- Annual cost. Fully annualized, including platform fees, per-seat fees, support tiers, overages, and any implementation cost still amortizing.
- Billing path. Invoice, corporate card, personal card reimbursed, cloud marketplace, or bundled inside another vendor’s bill. This column tells you where to look next year and it exposes the spend that never reaches accounts payable.
Sheet 2: Who uses it and what proves it works
| # | Seats or units billed | Accounts existing | Accounts active in 90 days | Proof of operation (artifact) | Proof date | Who produced the proof | Overlaps with line # | Overlap resolved by |
|---|---|---|---|---|---|---|---|---|
The dated artifact each line needs
One question, and it is deliberately difficult to satisfy with a document: can somebody produce an artifact, generated by the product itself, dated inside the last ninety days, showing the product did something?
| Product type | Artifact that counts | Artifact that does not |
|---|---|---|
| Endpoint detection | Coverage report of enrolled devices against total known devices, with dated detections or policy changes | A license count |
| Backup | A restore test record: what, when, elapsed time, verified by whom | A green backup dashboard |
| Email security | A block or quarantine report for a named period, with volumes | The vendor’s published catch rate |
| Multi-factor authentication | The enforcement policy export, with scope and every exclusion | One user’s enrollment screen |
| Log management | Ingest volume by source, plus the date a human last opened it | Collection being enabled |
| Vulnerability scanning | The latest scan report with remediation status | A scanner that is licensed and scheduled |
| Awareness training | Completion records with a numerator and a denominator, dated | The purchase order |
| Compliance platform | The current evidence package, plus the last login date | The implementation plan |
Where no artifact exists, write no evidence on record. Then note who was asked and when. That row is category 2 or category 4, and the difference between them is whether anyone can state the requirement.
Record who produced the proof and who checked it
This column matters more than it looks. Evidence produced by the party that sells you the product answers a question about their own performance. Prefer evidence you can see yourself in a console, or evidence produced by a party with no financial exposure to the answer. This is not a claim that providers falsify reports. It is the ordinary practice of preferring the more independent of two available sources.
Put duplicate functions beside each other
Two products serving the same control at the same required level is duplicate spend. Two products serving the same category at different depths may be sound. The comparison is between the control sentences, never between the product categories.
Common pairs worth checking: platform-included mail filtering against a separate mail gateway; platform-included endpoint protection against a purchased detection product; identity provider MFA against a standalone MFA product; a SaaS backup included in a plan you already buy against a third-party SaaS backup; a VPN against the access product bought to replace it and never turned off.
That last one is the most common finding in this whole exercise. A migration reaches eighty percent, the last twenty percent is hard, and the organization pays for both systems indefinitely. Search for it by name.
Sheet 3: Renewal date, notice window, and seller income
| # | Term end date | Auto-renewal | Renewal term length | Notice period (days) | Notice method | Decision date | Exit cost, known | Exit cost, internal hours | Exit cost, unknown | Adviser compensation | Compensation confirmed in writing (date) |
|---|
Calculate your decision date from the notice term
Term end date, minus the notice period, minus fourteen days of working room. Diary the decision date, never the renewal date. A missed window converts a decision you own into a year you have already bought.
Sort the whole sheet by decision date. In a budget cycle, anything with a decision date inside the next sixty days outranks a larger line with a decision date in nine months, because the smaller line is the only one where waiting removes an option.
Separate cash, staff time, and operating risk in the exit cost
Known, internal hours, unknown. Same discipline a board memo uses.
Components to include: remaining committed term, early termination fee, data extraction and its format, retention obligations for records held in the product, integration teardown, the parallel-running period where you pay for both, migration labor, retraining hours, and the effect on bundle pricing for the products you are keeping. The control gap during migration has no dollar figure and belongs in the unknown column with a description.
An exit cost quoted as a single number with no breakdown is an opinion. Three columns make it a finding.
Put adviser compensation beside the recommendation
Finance already applies this principle everywhere else. You know who prepared a valuation and how they were paid. You know whether a broker earns commission. You disclose related-party transactions. Technology purchasing is one of the few remaining areas where a recommendation is routinely accepted without anyone recording the recommender’s economic interest in it.
Four reasons the column earns its place on the sheet.
It sets the burden of proof without an argument. A recommendation from a party paid on the purchase can be entirely correct. It requires an independently written requirement before it moves forward. A recommendation from a party paid the same either way does not carry that particular question. Recording the compensation applies the right standard to each without anyone having to impugn anyone’s motives.
It explains price spread. The same product frequently reaches you through three channels at three prices. Knowing who earns what on each channel explains the difference and gives you a negotiating position you otherwise would not have.
Rebates and tier credits are invisible unless asked for by name. Margin is the smallest and most visible component. Volume rebates, market development funds, and partner tier credits are frequently larger and never appear on an invoice you see. A question about “commission” alone can be answered truthfully with a no while a substantial tier rebate exists.
A firm with no vendor compensation loses nothing by saying so in writing. That is the whole test. A written no costs an independent adviser thirty seconds. A refusal to answer is itself information and it goes in the column.
Send this wording:
“For each product on the attached list, please state in writing whether your firm receives any margin, commission, rebate, market development funds, partner tier credit, referral fee, or other compensation tied to our purchase or renewal of that product, and the approximate amount or percentage.”
Record the answer, the date, and who gave it.
Sheet 4: The approval record
| # | Service | Category | Decision | Rationale in one sentence | Evidence relied on | Owner | Action date | Annualized effect |
|---|---|---|---|---|---|---|---|---|
Choose one of seven decisions for each line
| State | Use it when | The row must also contain |
|---|---|---|
| Keep | Requirement written, evidence current, use matches billing, no owned alternative serves it | The evidence artifact and its date, plus the next review date |
| Reduce | The line earns its place at a smaller quantity or a lower tier | Target quantity, the true-down rule from the contract, and the notice date |
| Renegotiate | The product earns its place; the terms do not | The specific terms sought, the decision date, and the walk-away position |
| Replace | The requirement stands and this product does not meet it, or something already owned does | The requirement that must be preserved and the parallel-run period |
| Retire | The requirement no longer exists, or it is met by something already paid for | The evidence of coverage, and who accepted any residual risk |
| Defer | The decision is real and it belongs to a later point in a sequence | The trigger: what condition returns it, when, and who watches for it |
| Evidence required | The decision cannot be made because the evidence does not exist yet | What evidence, who produces it, and by what date, which must precede the contract decision date |
Two rules govern the last two states, and they are the rules that make this worksheet work rather than merely look like work.
A defer with no trigger is a renewal. Write the condition that returns the item, the date, and the person who watches for it. “Revisit next cycle” is not a trigger.
An evidence required row whose evidence date falls after the contract decision date is not available to you. Either the evidence gets produced sooner, or the line must be decided on what you know today. Say this out loud in the meeting, because the alternative is a year of spend chosen by a calendar.
The one page for your finance committee
A budget review that ends in a spreadsheet ends nowhere. The output is a one-page memo per material decision, in the structure a board can act on.
| Memo section | Filled from |
|---|---|
| Decision requested | Sheet 4, one line, one decision |
| Risk | Sheet 1 business need and control served, restated as a business consequence rather than a technical one |
| Current evidence | Sheet 2 proof artifact and date, or the honest statement that none exists |
| Cost: known | Sheet 1 annual cost and Sheet 3 exit cost, known column, each with source and date |
| Cost: unknown | Sheet 3 exit cost, unknown column, with what it would take to size it |
| Cost: modeled | Any estimate you produced, labeled as an estimate, with its assumption stated |
| Options | At least one smaller option and one defer option with a trigger |
| Recommendation | One option, one or two sentences on why |
| Approval | Decision owner, approval date, implementation owner, due date, and the evidence that will prove completion |
Five rules carried over from board reporting, each of which survives contact with a finance committee.
Never blend known, unknown, and modeled cost. A board forgives an unknown. It does not forgive learning later that a number in the known column was invented.
Include the smaller option whenever a smaller option is credible. Frequently a fraction of a proposed spend addresses most of a named exposure, and saying so is the fastest way to be believed the next time you ask for the full amount.
Attach a trigger to every defer.
Name the evidence of completion. Approved and never verified is how the same item returns in two years with a larger number on it.
Do not put a headline industry statistic in a cost table. A published average across a global population has no relationship to your organization, and the moment a committee notices a borrowed number doing work in your analysis, everything else on the page becomes suspect.
Three lines that need separate evidence in your review
Put the dated lifecycle cost curve beside the line
Standard support for Windows 10 ended on October 14, 2025. Microsoft ended technical assistance, software updates, and security fixes on that date. Commercial Extended Security Updates start at US$61 per device for the first year and double in each consecutive year.
For a budget, the doubling is the useful part. It converts an open-ended “we should upgrade eventually” into a three-year cost curve with published values, directly comparable against replacement or repurposing cost. Model all three years side by side with the replacement option and the decision usually makes itself.
Attach the carrier question and renewal date to insurer-driven spend
Some technology lines exist because a carrier required them. In a Sophos survey of 5,000 IT and cyber leaders at organizations with 100 to 5,000 employees, 97% of insured respondents reported investing in defenses to improve their insurance position. That is a vendor-conducted survey of a selected respondent base, and carrier terms still vary by carrier, by policy, and by year.
The practical step is narrow and it is worth doing. Flag every line that is carrier-driven, then confirm against your own carrier’s actual current form rather than against a general statement that carriers require a category. Requirements change at renewal, and organizations frequently continue paying for something a prior carrier asked for and a current one does not.
Cite the award and evidence requirement for federally funded lines
If your organization expends federal awards, 2 CFR 200.303 requires recipients and subrecipients to establish, document, and maintain effective internal control, including reasonable cybersecurity and information safeguards. The general single-audit threshold is $1 million in annual federal award expenditures under 2 CFR 200.501. Both current as of August 2026.
For a nonprofit executive director this reframes part of the technology budget. Certain spend is a control obligation with a documentation requirement attached, which makes it reportable rather than merely defensible as overhead. Whether any specific requirement applies to your awards is a determination for your auditor and your counsel, and the applicable terms of each award agreement govern.
Six illustrative lines in one approval record
The organization below is fictional and every figure is illustrative. None of it is a benchmark. A 120-person organization, six technology lines from a longer sheet.
| Service | Annual | Requirement stated by | Evidence artifact | Category | Decision |
|---|---|---|---|---|---|
| Endpoint detection | $34,200 | Client contract clause and carrier form | Coverage report, 12 days old, with three dated detections | 1, necessary and proven | Keep |
| Backup subscription | $21,000 | Operating dependency, board minutes 2023 | None. No restore performed in 26 months of records. | 2, necessary and unproven | Evidence required, restore test by Sept 30 |
| Second mail gateway | $11,900 | Original 2021 purchase, no current requirement | Quarantine report shows 31 messages in 90 days, all also caught by the included platform tier | 1 requirement absent | Retire at term end after a 30-day parallel comparison |
| Password manager | $8,400 at 140 seats | Operating need, credential storage | Vault access log, active daily | 1, necessary and proven | Reduce to 95 seats, 84 accounts active in 90 days |
| Threat intelligence feed | $16,000 | Proposed by outsourced provider, 9% margin disclosed | Last console login 11 months ago | 3, vendor-driven | Evidence required, requirement to be written by the IT owner or retire |
| Compliance portal | $19,500 | Purchased 2024 for an audit, owner departed | Last login 14 months ago | 4, unknown value | Defer pending auditor confirmation, due Sept 5, ahead of the Sept 18 decision date |
The sort is the finding. Two of six lines are proven, one is necessary and untested, one is vendor-driven with no independent requirement, one has no current requirement at all, and one is an unanswered question carrying $19,500 a year. The proposals that follow are a restore test, three emails, and a thirty-day comparison. No purchase appears anywhere in the output.
Keep the worksheet with the approved budget
This worksheet is general guidance for reviewing technology spend, contract terms, and control evidence. It is not legal, accounting, audit, or insurance advice. Whether any regulation, award condition, contract clause, or carrier requirement applies to your organization is a determination for your counsel, your auditor, and your broker. Termination rights and auto-renewal terms vary by contract and by state, so have counsel review any non-renewal notice before it is sent.
Every external figure above carries its publisher, its date, and its limits, sourced through SBK’s register. The insurance figure comes from a vendor-conducted survey of a selected respondent base. The federal award provisions are current as of August 2026 and their applicability depends on your award agreements. There is no percentage-of-revenue benchmark anywhere in this document, and there will not be one in a later version, because no such figure survives a question about its source, peer set, date, denominator, and limits.
SBK Consulting is a family-run, vendor-neutral IT advisory firm serving the New York, Connecticut, and New Jersey metro area since 2010, with more than 125 years of combined experience and a fully US-based team. Zero vendor partnerships, zero reselling, zero commissions or referral fees, which means our answer to “do you need this” carries no financial consequence for us either way. We will review one budget category or one renewal independently if a second opinion is useful. If you work the sheets yourself and never call, that is the result this document was designed to produce.
(718) 407-4169