I Cannot Explain Our IT Spend to the Board

You cannot explain IT spend to the board because you are being sent two different products on invoices that look identical. One is a recurring fee for a standing service. The other is a run of quotes, each triggered by a fault or a finding. Put twelve months of both in a pack and it reads as a budget with no shape. inSUPPORT publishes its support component as a per-user rate, $68, $100 or $135 a month by tier, with insurance, backup and security awareness quoted as separate named lines.

If this has left you feeling slightly stupid in front of the board, look at the invoices before you look at yourself. The structure is doing it. A finance team that can model a wage bill to the dollar can still come unstuck on IT, for one reason. Nobody ever drew the line between what recurs and what does not.

No support fee covers the lot, and a provider who will not name what sits outside it has told you where next year's surprises come from. Hardware sits outside. Licences usually sit outside. New projects sit outside. So the question a board can test is narrower and better. Is the boundary written down, and did you agree to it?

Below is a layout a director can pull on line by line without it unravelling, and the six questions they tend to reach for first.

TL;DR: What to put in front of the board

• ✅ Present two columns, not one number. What recurs, and what was billed because something went wrong. The second column is the whole conversation.
• ✅ A board wants three answers: what recurs, what was exceptional and why, and who is accountable for it. None of them needs a technical explanation.
• ✅ Write a cause beside every exceptional invoice. The same cause four times is a structural finding.
• ✅ Ask for the inclusions list as a schedule to the agreement, so the boundary has a clause number a director can point to.

Contents

• Why can I not explain the spend when I have every invoice?
• What does a board actually want to know about IT cost?
• How do I structure the line items so recurring and exceptional look different?
• Which questions should I be able to answer on the spot?
• Every fault produces a quote. What do I do about that?
• Questions CFOs ask about reporting IT spend

Why can I not explain the spend when I have every invoice?

Because the invoices describe two different things and arrive looking the same. The monthly fee buys a standing service: somebody answers users, somebody watches the systems, somebody patches them on a schedule. The quotes buy episodes. Each one is a response to a fault or a gap. Added together they produce a number. Separated, they produce an argument.

That separation is the actual work, and it is finance work rather than technical work. What has been missing is a classification, and your team already classifies everything else it pays for.

There is a reason the two keep blurring. An agreement can quite properly put monitoring and helpdesk inside the fee and treat security remediation and project work as quoted work, and a company that picks that arrangement with its eyes open has made a fair commercial call. The trouble is inheriting it without anyone making the call. Then every fault reads to the board as an unforeseeable event, when it is the predictable output of a commercial design.

Once you can see the design, the spend starts behaving. The recurring column becomes a forecast. The exceptional column becomes explainable, because each line has a cause written beside it. And the pattern inside that second column is the page worth putting in front of the board, because it is the one that explains the rest.

Two columns, and a cause beside every line in the second one.

What does a board actually want to know about IT cost?

Three things, and none of them is technical. What recurs and can be forecast. What was exceptional, and why. And who is accountable for the risk the money is meant to be reducing. What a director is actually doing is discharging an obligation they hold personally.

That is worth knowing because it tells you which answers land. The Australian Institute of Company Directors and the Cyber Security Cooperative Research Centre publish a checklist for directors of smaller companies and not-for-profits, and the items are governance items rather than engineering ones. Document who has responsibility for cyber security. Identify your key digital providers and understand their controls. Assess whether using reputable external providers improves resilience compared with managing it in-house.

Read those three against your own spend and the shape of the conversation changes. To explain IT spend to the board is then to report on a decision the company made: which risks it pays to reduce, which providers it lets into its systems, and what it has decided to carry.

There is a second half to the answer, and it is the part that makes preventive spending defensible. The Australian Signals Directorate says it in one line in its guidance on engaging a managed service provider: cleaning up after a compromise costs far more than putting the controls in beforehand. That line belongs in the pack. It turns the recurring column from an overhead into a position the board has chosen to hold, and it comes from the national technical authority rather than from a vendor.

How do I structure the line items so recurring and exceptional look different?

Sort twelve months of invoices into five buckets and the picture assembles itself. Recurring support, charged per user. Named recurring add-ons. Licensing. Exceptional work, with a cause against each line. And remediation, which is the bucket that decides whether the agreement is working for you. The first three roll up into the recurring column and the last two into the exceptional one.

Keep the per-user rate separate from everything else, because it is the only line a board can forecast against. It should move when seat numbers move and at no other time. inSUPPORT's published per-user support pricing sets the support component at $68 per user per month for weekday hours, $100 for a tier that runs Thursday and Friday evenings to 9pm plus Saturday mornings, and $135 for round-the-clock cover. Monitoring and remediation are printed on every tier card, and the cards part ways on a few other inclusions, so have the ones for your tier written into the agreement. The add-ons sit beside it as their own lines: security awareness training, backup, Microsoft licensing, Mac support, a password vault, and cyber insurance, which is arranged through licensed insurance partners and underwritten by the insurer, with cover subject to the insurer's assessment.

Set those add-ons out one per line in the pack, and list the ones the company declined as well. A director reading that page can see that each was a decision, and can ask about the one they would have bought. A single combined figure leaves them nothing to question except the total, which is the least useful thing on the page.

The exceptional bucket is where the work is. Against every line, write what caused it in six words. A failed restore. An account nobody closed. An out-of-hours outage. Unsupported software that finally stopped. Then count the causes rather than the dollars, because four invoices with the same cause is a finding and four invoices with four causes is just a year. For the arithmetic that sits under the per-user comparison, what a managed IT support fee covers works through the inclusions and the hours tiers in detail.

Which questions should I be able to answer on the spot?

These are six a director can put to you, in roughly the words they will use. Each is far easier to answer when the answer is already printed in the pack, so read the list as a page layout as much as a script.

• What are we paying each month, and what does that buy? Print the per-user rate, the seat count and the inclusions schedule, cited by its clause and date. The director is checking that a signed document draws the boundary somewhere they could read it. If no such schedule exists yet, say so, and give the date you asked for one.
• What did we spend beyond that, and why? Last financial year's out-of-fee total, with each cause beneath it and how many invoices that cause produced. Have the provider confirm the total against its own billing first, so the board is looking at one agreed figure. Directors can then see whether the overspend was a run of different events or the same one repeating.
• If the provider uncovers a fault, whose budget does the fix come out of? Quote the clause that answers it, and put last year's quoted remediation total beside it. Directors ask this one because the answer shows which way the provider's incentive points.
• Who answers when something breaks at our busiest hour? Set your trading hours and the provider's staffed hours side by side, and mark the gap. A director can weigh a gap stated in hours a week. A reassurance gives them nothing to weigh.
• Which outside providers can get into our systems, and how do we know their security holds? A short register of every provider with a way in, what each one can touch and when the register was last brought up to date, plus whether each contract obliges them to tell you when their own systems are compromised. ASD's advice is to know where the boundaries are between you and your provider and to keep that record current, and to put incident notification clauses in the contract. ASD also lists managing third-party risk as one of four priorities for Australian businesses in its 2024 to 2025 threat report. The same item sits on the AICD director checklist quoted above, under Principle 1, so a well-prepared director may walk in already holding it.
• How long are we committed, and when could we leave? The term, the notice period and the next date the company could give notice. inSUPPORT does not publish either on its pricing page, so ask for both in writing from whoever you are signing with. The exit date belongs beside the price, because it sets how long a poor decision would last.

Every fault produces a quote. What do I do about that?

Three moves, in order, and the first two cost nothing. Name the pattern with a number. Ask for the boundary in writing. Then decide whether what you are looking at is untidy administration or the way the agreement was designed, because those two problems have different fixes.

Naming it with a number means the out-of-fee total for the year and the causes beside it. Put that page next to the monthly fee. It is a harder document to argue with than a complaint, and it puts both halves of the spend on one page. Asking for the boundary in writing means the inclusions list attached as a schedule to the agreement, with a clause number you can quote back to the provider. The twelve questions to ask your IT provider before you renew covers the rest of that conversation, including the handover question worth asking while the contract is still unsigned.

If the pattern survives both of those, it is structural, and the only real fix is a different structure. The honest version of the alternative is on the managed IT services page: the remediation an audit finds is included in the support fee rather than billed back as a separate project. What that changes is the incentive. Pricing remediation inside the fee removes the separate remediation-billing incentive, so the provider that identifies a gap is not paid a second time to close it. That is checkable against published terms, which is why it holds up in front of a board where an adjective would not.

Give the limits their due, because a director will find them anyway. Hardware, licences and genuinely new projects usually sit outside a support fee, whoever the provider is. Backup, security awareness and insurance are quoted as their own lines here, deliberately, so you can see what each one costs and decline it. The test was never whether a fee covers the lot. No fee does. The test is whether the exclusions are named, agreed and boring.

Questions CFOs ask about reporting IT spend

How do I explain IT spend to the board when the number changes every month?

Stop presenting one number and present two. Column one is the recurring fee, which should be a per-user rate multiplied by seats, and it should sit flat unless headcount moves. Column two is everything billed outside that fee, with a cause written against each line. A board can read that in a minute, because the first column is a forecast and the second is a list of events. If the second column is long, what you have is a finding about how the agreement is built, and it belongs in the pack as an item of its own.

Should our IT provider build the board report, or should finance?

Finance owns the pack, and the provider supplies the evidence that goes into it. Ask for three things: the inclusions list, last financial year's out-of-fee total, and a list of every system the provider has access to. That third item comes straight from ASD's guidance for organisations engaging a managed service provider, which says to know where the boundaries sit between you and the provider and to keep that record up to date. Finance then decides how the evidence is laid out, because finance is the one standing in front of the directors when they ask about it.

How long does it take to get IT spend into a shape the board can read?

An afternoon for the arithmetic and a week or two for the documents. Sorting twelve months of invoices into recurring and exceptional is one spreadsheet and it is the part you control. The slower half is getting the inclusions list and the out-of-fee total in writing, because that depends on somebody else. Write down the date you asked and the date it arrived. If a director asks why the pack took a month, that gap is the honest answer.

What does a board-ready page on IT spend actually look like?

One page. At the top, the per-user rate multiplied by seats, shown as a flat line across the year with any headcount changes marked. Under it, the out-of-fee total, grouped by cause, with the number of invoices beside each cause. Then the add-ons, the ones bought and the ones declined. Then the clause and date of the inclusions schedule. Last, one sentence on what the company is doing about its most frequent cause. A director can read that page in the order they would ask the questions, and every line on it answers to a document or a decision. If the most frequent cause points at the environment itself, an independent audit gives that sentence a costed plan to name.

Citations

• "Cyber Security Governance Principles Checklist for SME and NFP Directors, Australian Institute of Company Directors and Cyber Security Cooperative Research Centre, Version 2, November 2024", The director-level actions quoted in this article, all from the checklist itself: under Principle 1, document who has responsibility for cyber security and identify our key digital providers and understand their cyber controls; under Principle 2, assess whether utilising reputable external providers will enhance cyber resilience compared with managing in-house. Read 20 October 2026. aicd.com.au
• "AICD and CSCRC release refreshed Cyber Security Governance Principles, Australian Institute of Company Directors, 25 November 2024", The release date and scope of Version 2 of the Principles, including the expectation that directors map key suppliers and understand supplier cyber security controls, and oversee data sharing arrangements with third parties. Confirms the checklist above is the current SME and NFP tool. Read 20 October 2026. aicd.com.au
• "How to manage your security when engaging a managed service provider, Australian Signals Directorate, published 21 December 2018, last reviewed 5 April 2023", The line this article paraphrases, that the cost of remediation after a compromise far exceeds the cost of upfront implementation; the instruction to know where the boundaries are between you and your provider and keep the record up to date; the advice to state cyber security expectations upfront and to include cyber security incident notification clauses in the contract. Read 20 October 2026. cyber.gov.au
• "Annual Cyber Threat Report 2024-2025, Australian Signals Directorate, published 14 October 2025", ASD's four priorities for businesses and network owners, of which effectively managing third-party risk is one, alongside best-practice logging, replacing legacy IT and preparing for post-quantum cryptography. Read 20 October 2026. cyber.gov.au

Related Reading

• IT Support Pricing
• What a Managed IT Support Fee Covers
• Twelve Questions to Ask Your IT Provider Before You Renew
• What an Outage Costs Across Three Support Models
• Cyber Strength Audit

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.