IT Budget Policy

Version: 1.00Issue Date: 10/10/2015

1.0 Overview

This IT Budget Policy will help ensure that the Information Technology function is properly funded by employing an effective budget process and managing budgeting risks.

2.0 Purpose

This IT Budget Policy requires that roles and responsibilities are defined for budgeting, risks are identified, and the budget is monitored.

3.0 Scope

This IT Budget Policy applies to all who deal with budgeting including management and the finance department. This policy is effective as of the issue date and does not expire unless superceded by another policy.

4.0 IT Budget

  • The information technology function must have a formal operating budget which is created, reviewed, and approved by upper management at least annually. The budget must include money for operations and maintenance and development of new projects and/or software.
  • A budget process must be created for creating, reviewing, and approving an information technology budget. The people that have authority to approve the budget and the people accountable to create the budget must be identified by the process.
  • The budget process must define who will monitor the budget.
  • The budget process must require the approvers of the budget to be notified when the budget varies more than a specific amount from expected constraints. Reasons for budget variances must be identified and remedies or changes to the budget must be implemented in a timely manner.
  • Information technology upper management must provide justification for the information technology budget.
  • The IT budget must be justified using measurable returns on investment combined with organizational business process support, compliance requirements for laws or regulations, organizational goals met, useful IT investment, and demonstration of end user satisfaction.
  • The IT budget must be created at least annually and according to organizational policies.
  • The IT budget must consider and plan for information technology investment which would improve the efficiency of the IT department. The plan should consider funding sources, costs of internal hardware, software and labor, costs of contracts and external services, and costs of project development.
  • Principles must be established for determining when investment in information technology is justified. These should include security needs, IT efficiency, meeting legal or regulatory requirements, and compliance with organizational strategic direction.
  • Priority should be given to information technology costs which support critical business processes.

5.0 Funding Risks

  • Risks where loss of funding could occur which may impact the budget must be identified. Mitigating controls must be identified along with alternatives in case the risk event materializes.

6.0 Budget Monitoring

  • The effectiveness of the budget process must be monitored. Results of monitoring the budget process must be used to improve the budget process which should improve accuracy of the budget.
  • A foundation for creating a process to monitor costs and benefits for the information technology function must be established.
  • The foundation for creating cost and benefit monitoring processes should include or reference organizational policies and procedures which specify organizational requirements.
  • The foundation for creating cost and benefit monitoring processes should be reviewed and modified regularly to improve efficiency and effectiveness of cost related processes.
  • The cost and benefit monitoring process should define performance indicators for measuring cost benefit and the performance indicators should reflect the goals of the organization.
  • A member of upper management who is not associated with information technology costs (not managing or part of the organization whose costs are being monitored) should monitor the cost and benefit monitoring processes. The upper management member monitoring processes should report to the head of the organization or an immediate subordinate such as a vice president.
  • Cost and benefit monitoring should be done by a trained team which has appropriate resources to do the job. The team should understand the workings of the information technology department and should not be a part of the information technology department.
  • Time scales for the cost and benefit monitoring process must be defined by the foundation which is used to create cost and benefit monitoring processes. Cost and benefit reporting must occur at least annually.
  • The methods used by the cost and benefit monitoring team to collect data must be defined. The financial system of the organization should be used to collect cost information. Databases or systems that have records of IT assets should be used to collect information. The team should also interview information technology or business managers to determine the benefits gained by the expenses.
  • Benefit monitoring should be measured against performance indicators where it is applicable.
  • The actual costs should be compared to the IT budget.
  • The cost and benefit monitoring process should include a process for reporting results to upper management. The results of the cost and benefit analysis should be considered by upper level management when making decisions affecting the information technology function.

7.0 Budget Changes

  • A process for adjusting the information technology budget due to changes in funding or changes in requirements must be created.
  • A process for adjusting the information technology budget due to information provided by the cost and benefit monitoring process.

11.0 Enforcement

Since following the IT Budget Policy is important for the welfare of the organization, employees that purposely violate this policy may be subject to disciplinary action up to and including denial of access, legal penalties, and/or dismissal. Any employee aware of any violation of this policy is required to report it to their supervisor or other authorized representative.

12.0 Other Policies

  • IT Organizational Policy

13.0 Additional Requirements

  • A process must be created for creating, reviewing, and approving an information technology budget.
  • A process for monitoring the budget process effectiveness and making appropriate changes.
  • Budget change process.


Approved by:__________________________ Signature:_____________________ Date:_______________