Skip to content
IT Audit Platform

Where Does the IT Budget Go, and What Does It Deliver?

Every year, during budget planning, a familiar story unfolds in many ministries, holding companies, and large organizations.

The companies and organizations under their supervision submit their requests.

One requests funding to modernize its network infrastructure. Another needs security equipment. One organization requests the development of information systems, while another company seeks additional funding for digital transformation projects.

Almost every request has a justification.

But imagine that, during the budget review meeting, the CEO or finance director asks a simple question:

“How much did we spend on information technology last year, and what exactly improved?”

Can we give a clear answer?

Not how many servers we bought, how many contracts we signed, or how many projects we completed.

But what actually changed?

Did security risks decrease? Did services become more reliable? Did systems become more effective? Did user satisfaction improve? Did the companies that received more funding also experience greater improvement?

And perhaps most importantly:

If we have only half of the requested budget this year, do we know which expenditures to protect and which can be deferred?

This is where IT budgeting moves beyond a straightforward financial matter and becomes a serious management challenge.

Spending Is Easier Than Demonstrating the Value It Creates

In many organizations, IT financial reports are prepared carefully.

They show how much was paid for equipment, how much was spent on support contracts, and how much funding was allocated to software development.

Yet one fundamental question often remains unanswered:

What impact have these expenditures had on the organization's actual IT condition?

Suppose a company receives substantial funding to modernize its infrastructure over the course of a year.

By the end of the year, all the equipment has been purchased, the contracts have been settled, and the project has been completed from an implementation perspective.

From a financial perspective, the budget has been spent.

From a project perspective, the work is finished.

But from senior management's perspective, one question remains:

Has the infrastructure actually improved?

If the next assessment shows that service reliability remains inadequate, major risks have not been addressed, or users' problems persist, the effectiveness of the investment needs to be examined.

Spending the entire budget is not evidence of a successful investment.

Do We Allocate Budgets According to Need or Bargaining Power?

This may be one of the most important questions that managers in ministries and holding companies should ask themselves.

When dozens of organizations, institutions, banks, and companies compete for funding, how is the budget distributed?

According to headcount? Company size? Last year's budget? Managers' requests? Their ability to defend projects in meetings?

Or according to actual need, the level of risk, and the impact an investment could create?

Suppose two companies request similar budgets.

The first requests funding to expand infrastructure that is already in reasonably good condition.

The second faces serious problems with data recovery, security, and the continuity of critical services.

If only the financial requests are examined, the two may appear to have equal priority.

But when IT assessment results are considered alongside the budget requests, the picture changes.

The question is no longer simply, “Who requested how much funding?”

Instead, it becomes:

“Which investment addresses the most important problem at the most appropriate cost?”

This is the difference between request-based budgeting and evidence-based budgeting.

The Greatest IT Cost Is Not Always Visible in the Financial Statements

Sometimes the main cost is not the amount an organization has paid, but the loss it suffers because a necessary investment was not made.

Aging infrastructure may operate for years without a major incident, yet a few hours of downtime at a critical point in production could cost far more than preventive modernization.

The absence of an adequate backup plan may not appear as a direct expense in financial reports, but losing critical information can disrupt an organization's operations.

An ineffective system may remain operational while wasting thousands of hours of employees' time over the course of a year.

These costs do not necessarily appear as line items in the IT budget.

Sometimes, not spending is the most expensive decision of all.

Of course, not every risk means that new equipment must be purchased or a new project launched. Sometimes improving a process, reviewing contracts, or making better use of existing resources is the more appropriate solution.

Recognizing these differences is a central skill in IT financial management.

One Budget, Dozens of Companies, and Hundreds of Choices

The issue becomes more complex at the level of a ministry or a holding company.

Imagine that 40 entities under its supervision each submit a list of IT projects and needs.

Senior management now faces dozens of requests and limited resources.

Should funding be divided according to company size?

Should companies with lower maturity scores always receive more funding?

Should resources be allocated to the entities best prepared to implement projects?

None of these considerations is sufficient on its own.

A company may have low maturity, yet its problems could be addressed through low-cost management actions.

By contrast, an organization with a sound maturity score may face a critical security risk that requires more urgent attention.

Intelligent budgeting therefore requires more than ranking companies.

Several factors need to be considered together:

  • The severity of identified weaknesses and risks
  • The importance of business services and processes
  • Improvement or deterioration in performance across assessment periods
  • The actual experience of users and managers
  • The recurrence of problems across different entities
  • The cost, feasibility, and expected impact of corrective actions

The best budget decision is not necessarily to allocate resources to the weakest company, but to choose the action that creates the greatest value and risk reduction with the resources available.

Feedora: When Budget Decisions Are Grounded in Reality

This is precisely where Feedora can provide a different kind of value for senior management.

Rather than simply presenting a picture of the current state of information technology, Feedora provides a foundation for budget decisions based on a more accurate understanding of needs and risks.

Imagine that the CEO of a holding company needs to decide on investment requests from subsidiary companies.

Feedora can provide important information to support that decision:

First, it identifies where the problem actually lies.

Technical assessment results show which domains and subdomains have weaknesses and which risks need attention.

Second, it shows how widespread the problem is.

A security or infrastructure weakness may recur across several companies. Identifying this pattern can support the development of shared projects and help avoid duplicated efforts.

Third, it helps examine the impact of past investments.

Comparing assessment periods makes it possible to observe how a company's condition has changed after corrective actions were implemented.

However, attributing these changes to a specific project also requires examining cost information, implementation timelines, and other influencing factors.

Fourth, it brings managers' and users' perspectives into the decision.

Sometimes an investment appears technically necessary, while users' main problem lies elsewhere. Considering technical assessments, management assessments, and user feedback together reduces the likelihood of overlooking these important issues.

Fifth, it helps identify investment priorities.

Using assessment evidence and risk analysis, management can identify which needs are more urgent, which problems are shared, and which actions should receive priority for review and funding.

The important difference is this:

Feedora does not simply tell a manager which company is weaker; it helps them understand why it is weak, what risk threatens it, and which investment could improve its condition.

From Annual Budgets to Measurable Investments

Imagine that every future IT budget request is accompanied by three questions:

Before the investment: What problem is this intended to solve, and what evidence demonstrates the need?

When making the decision: Why should this project take priority over other requests?

After implementation: Have the indicators that were expected to improve actually changed?

In such a model, the IT budget is no longer merely a collection of figures and expense line items.

Each investment is connected to a specific need, a measurable objective, and an expected outcome.

By providing assessment data and enabling comparisons across different periods, Feedora can serve as one of the information foundations for this approach.

This is the change a ministry or holding company needs to move from managing costs to managing value.

The Question Worth Hundreds of Billions of Tomans

Finally, imagine that you are about to decide on next year's IT budget at a board meeting. Requests totaling hundreds of billions of tomans are on the table.

Would you prefer to base your decision solely on the explanations and documents submitted by the applicants?

Or would you want to know which request addresses a real risk, which project solves a problem shared by several companies, which investment has a more defensible need, and which expenditure might fail to produce meaningful improvement?

Feedora is not intended to make decisions in place of the finance director or CEO; it is intended to help them make decisions based on a more accurate understanding of reality.

Because in IT management, the main question is not how much we have spent.

Nor is it simply how much funding we need.

The main question is:

“With every rial we spend on information technology, which problem are we solving, which risk are we reducing, and what value are we creating for the organization?”

Feedora: From Understanding Costs and Needs to Informed IT Investment Decisions.