A sound IT budget is not a list of renewals with a contingency line at the bottom. It is a decision about which business risks to reduce, which systems to modernise and what the organisation can afford to keep running.
For a finance director preparing the 2027 budget, the year-end review offers a useful opportunity to connect those choices. Start with strategic advice: establish what the business depends on, what it needs to protect and where investment can make operations more effective. Then fund the technical work that delivers that plan.
David Evestaff leads with this consultancy-first approach, drawing on experience in IT project management, multinational onboarding and specialist systems administration. Support services and technology provision have their place, but should serve a considered IT strategy, not take its place.
Four areas deserve particular attention: Technology Expense Management as an audit of current spend; Disaster Recovery as risk provision; Dynamics 365 Business Central modernisation as planned investment; and IBM i Management as a managed alternative to relying on one person’s knowledge.
1. Audit current spend with Technology Expense Management
Before requesting new funding, establish what the organisation already pays for, and whether those costs still support business needs. Technology Expense Management (TEM) brings software licences, cloud services, mobile contracts, connectivity, hardware maintenance and support agreements into one review.
Start by reconciling invoices with actual users, devices, sites and usage. Look for unassigned licences, dormant accounts, duplicate tools, unused services and contracts approaching renewal. Record the contract owner, renewal date and notice period for every material agreement. These details turn budget review into a practical control, rather than a hunt for savings in the final weeks of the year.
The aim is not to cut indiscriminately. A redundant service may be an obvious saving; an apparently expensive service may be essential to recovery or customer operations. Use the review to understand what each cost enables, where the risks sit and whether a better arrangement is available.
When a reduction is verified, make its destination visible. Reallocating spend to recovery testing, security improvements or a well-scoped finance-system project can create more value than treating every saving as an end in itself.
2. Budget for Disaster Recovery as risk provision
A backup is not, by itself, a recovery plan. Disaster Recovery requires the people, processes and technical capability to restore important services after an incident. Business continuity also considers how staff can keep essential work moving while systems are unavailable.
For each critical service, agree two measures with business owners:
- Recovery Time Objective (RTO): how long the business can tolerate the service being unavailable.
- Recovery Point Objective (RPO): how much recent data the business can afford to lose.
These objectives help determine what recovery arrangements are appropriate. A finance system, payroll process and customer-facing service may not have the same tolerable outage or data-loss window. Nor should a plan assume that one supplier or technology team can resolve every failure.
Budget for the full recovery picture: protected backups, recovery infrastructure or supplier support, access to required credentials, dependencies such as identity and connectivity, and time to test the arrangements. A restore test can show whether selected data or a system can be recovered. A continuity exercise can reveal whether people understand their roles and can follow agreed workarounds. Both are useful evidence; neither should be replaced by a tick-box declaration that backups are running.
Recovery planning also supports wider assurance work. For UK SMEs, Cyber Essentials provides a defined baseline of technical controls, including firewalls, secure configuration, security updates, user access control and malware protection. The NCSC’s Cyber Essentials overview explains the scheme and its controls.
ISO/IEC 27001 is a broader, risk-based information security management system standard. Its scope and evidence requirements differ from Cyber Essentials; neither should be treated as a substitute for the other. The ISO overview of ISO/IEC 27001 is a useful starting point. In budget terms, allow for scoping, risk assessment, remediation, evidence, staff time and ongoing review, not simply an audit date.
3. Treat Business Central as planned investment
A Microsoft Dynamics 365 Business Central project is more than a licence decision. It changes processes, data, reporting and day-to-day work. The financial case should therefore include discovery, implementation support, migration, integrations, testing, training and post-launch stabilisation as well as any recurring costs.
A Dynamics 365 Jump Start can provide structured implementation support to clarify the requirements and risks before a full project is approved. It should help answer practical questions: which processes need to change, what data should move, what integrations are necessary, who owns decisions and how users will test the new workflows?
A sensible early-stage plan may include:
- Reviewing current finance and operational processes.
- Defining the intended scope, users and reporting needs.
- Assessing data quality, migration requirements and integrations.
- Identifying project dependencies, internal capacity and decision owners.
- Agreeing how the organisation will test, approve and support the new system.
Microsoft’s Business Central cloud migration guidance outlines technical planning considerations. The business still needs to decide what to migrate, how to validate the results and when it is ready to move.
For finance directors, the key is to separate the investment decision from the licence conversation. Set a project budget that reflects the work needed to reach an operational outcome, with decision gates for scope, migration readiness and user acceptance. This makes it easier to challenge costs early, before rushed decisions become expensive rework.
4. Manage specialist systems, not key-person dependency
Some organisations continue to rely on specialist IBM i Management for important business processes. A system may be stable, but stability does not remove the need for clear ownership, support arrangements and recovery planning.
Key-person dependency is a budget risk because knowledge can be difficult to replace at short notice. Document who understands the platform, its applications and integrations, what support is available, and how backups and recovery are managed. Review maintenance, capacity, security responsibilities and relevant supplier arrangements. Where specialist expertise is needed, plan for it rather than assuming it can be found during an incident.
Managed IBM i Management can form part of a deliberate operating model, whether the platform remains in place or is eventually modernised. If Business Central is also being considered, define how responsibilities and data flows will work across both environments. Coexistence may be a sensible phase; it still needs a named owner and a documented plan.
A practical year-end budget sequence
Use the remaining budget-planning period to turn these priorities into decisions:
October: Build the technology-cost inventory, check contracts and renewal dates, identify critical services and map key system dependencies.
November: Agree recovery objectives with business owners, review Disaster Recovery arrangements, and identify the work needed for Cyber Essentials or ISO 27001 readiness. Define the scope and discovery questions for a possible Business Central Jump Start.
December: Compare investment options, confirm accountable owners and internal capacity, and decide which actions should be funded in 2027. Record how proposed savings will be verified and where they will be reinvested.
For every proposed item, ask: what risk or business need does this address, who owns the outcome, what are the dependencies, and how will we know the work is complete? This applies just as much to a compliance project as to an ERP migration or a recovery exercise.
Strategic consultancy should set the priorities; execution services should support them. Cloud Solutions, Network Solutions, Voice and Connectivity, Helpdesk Support and broader Managed IT Services may all feature in the plan, but their role is to enable the agreed operating model.
A focused review can give the 2027 budget a clearer connection between spend, resilience and business priorities. For strategic IT consultancy and support, visit Evestaff IT Support and Consultancy. The wider group of services is available through evestaff.co.uk.
SEO tags: Cloud Solutions, Disaster Recovery, Dynamics 365 Jump Start, Helpdesk Support, IBM i Management, Managed IT Services, Network Solutions, Technology Expense Management, Voice and Connectivity, ISO 27001, Cyber Essentials, Microsoft Dynamics 365 Business Central, UK IT budget planning
Join The Discussion