Most small businesses don’t have an IT budget — they have IT spending, discovered afterward, scattered across a dozen line items and punctuated by emergencies. The difference between the two is a few hours of structure, and the payoff is the thing owners actually want from technology: no surprises. Here’s the framework.
Start by finding what you already spend
You can’t budget forward until you’ve reconstructed backward, and the reconstruction is always revealing. Pull twelve months of spending and hunt it down across its hiding places: the IT support line, sure — but also software subscriptions (on three different credit cards), internet and phones, hardware purchases coded to “office expense,” the domain renewal on the owner’s personal card, and the SaaS tools departments signed up for on their own. The total is reliably 30–50% higher than anyone guessed, and that honest number is your starting point.
The four buckets
Structure every technology dollar into four buckets — the sorting is the budget:
1. Run — the recurring cost of operating. Managed IT or internal staff, software licenses, internet, phones, cloud services, backup, security tooling. Predictable, monthly, and the bulk of the total. This bucket should be boring; if support costs here are volatile, you’re on a break/fix model and paying for the volatility twice.
2. Refresh — the lifecycle bucket, where surprises go to die. Hardware ages on schedules you already know: workstations ~4–5 years, servers and network gear ~5–7, firewalls and Wi-Fi included. So the math is arithmetic, not forecasting: (machines ÷ lifespan) × unit cost = this year’s refresh number. Twenty workstations on a five-year cycle means four replacements a year, every year, on purpose — instead of a cluster of dying machines in one ugly quarter. The moment this bucket exists, “the server died unexpectedly” stops being a budget event, because nothing with a published lifespan is truly unexpected.
3. Projects — the deliberate improvements. The migration, the office move, the new phone system — scoped and decided in the annual planning pass, each with its own number. Rule: projects get budgeted as projects, never smuggled into the run rate where they make every month look like an anomaly.
4. Reserve — the honesty bucket. Ten to fifteen percent of the total, for the one genuine surprise a year that even good planning permits. If it goes unspent, it seeds next year’s refresh. If you skip it, the surprise funds itself from whichever bucket was nearest — and the whole budget’s credibility goes with it.
Benchmarks, with the right amount of salt
Small businesses commonly land somewhere around 3–7% of revenue on technology all-in — toward the lower end for simple office environments, higher for regulated, multi-site, or technology-dependent operations. Use the range only as a sanity check, not a target: the meaningful comparisons are against your own prior year and against what downtime costs you. A business losing $10k per down-day and spending $2k a month on IT isn’t frugal — it’s mispriced.
Two spending patterns worth auditing while you’re in there: security as a real line, not an assumption — MFA, EDR/MDR, training, tested backups are now table stakes and insurers price their absence; and subscription creep, the quiet 8% annual growth of licenses nobody re-justified — the licensing review and a keep/consolidate/kill pass typically claw back real money on day one.
When the number looks high
The finished budget is sometimes uncomfortable, and the response matters. Three legitimate levers: stretch, don’t skip, lifecycles — moving workstations from four years to five is a decision; moving them to “whenever they die” is just the emergency plan with extra steps; cut redundancy in software, which is usually where the genuine fat lives, not in the security column; and re-examine the run model — at certain sizes, flat-fee managed support beats the internal-hire-plus-emergencies math decisively, and at others, co-managed splits it. The illegitimate lever is the popular one: deferring the refresh bucket indefinitely, which doesn’t reduce the cost — it just converts it to downtime, paid at emergency rates, on a date of the hardware’s choosing.
The bottom line
Reconstruct the real spend, sort it into run / refresh / projects / reserve, let lifecycle arithmetic pre-pay the surprises, and review it once a year in an afternoon. That’s the whole practice. The businesses that do it don’t spend dramatically less on technology than the ones that don’t — they just know the number in January instead of learning it in December, and never meet it in the form of an emergency.