Nonprofit technology budget defense pack

The board votes on your technology number

You run a nonprofit, its finances or its operations. A board member says every technology dollar is a dollar lost to the mission. The meeting is set, and you must defend the number.

Do not bring one lump sum. Give every line a mission, funding or control reason. Show what you will remove and reduce before asking for any increase.

Work the workbook first, then build the eight-section board pack. You can do both without hiring anyone.

A defence is credible only if it cuts

A defence must also cut. If every existing line is necessary and the total rises, the board learns your analysis always says the same thing. After that it carries no information, and your next urgent request starts with no credit.

Run the workbook honestly. Most organisations find unused seats, two products doing one job and a subscription tied to someone who left in 2024. Most also find a renewal nobody remembers agreeing to.

Take those to the board beside the increases. “We remove four lines, reduce two and ask for one increase, and here is why” gets believed.

A pack that only asks does not. The cutting is what makes the defending work.

No percentage target

This pack will not say what share of your budget should go to technology. No neutral, current, sourced benchmark for nonprofit IT spending survives scrutiny.

The wider “overhead ratio” idea is also disputed in the sector. It treats infrastructure as waste by definition and varies hugely by program model. It can also be gamed by reclassifying costs instead of cutting them.

If the board wants a percentage, give it a table instead. Every line has a reason, an owner, an evidence state and a decision.

That answers the real question, which is whether the money does anything. If a funder requires a ratio or cost treatment, your award or the funder’s policy governs. Read it, and never swap in a rule of thumb.

Part 1: The eight-section board pack

The order matters. The board sees the decision and the cuts before any request.

1. The amount and the vote

Write one sentence at the top of page one saying what the board is asked to approve, decline or choose. Give the ask, not context or a summary of the year.

For several decisions, number them, three at most, one sentence each. A pack asking for seven decisions gets none.

2. What you will remove or reduce

Put this before any request. List the lines you cut, the yearly amount recovered and when the saving starts. This section proves the analysis is real.

Line	Function	Yearly cost	Decision	Saving starts	Why
			Remove or reduce		Unused seats, duplicate job, program ended or no owner

Total recovered each year, $______

3. Each line tied to a program

Group every remaining line by the program or function it serves, not by vendor or category.

“Case management system, housing program, 340 clients tracked, required by the county contract” makes sense to a board. “Software subscriptions, $61,400” does not, and the board will treat it all as optional.

4. Funding source and restriction

Show which lines are charged where, and what limits apply. Three columns matter: the funding source, whether funds are restricted, and whether the cost is direct, indirect or unrestricted.

Name the lines you are unsure about, since those are the ones your auditor will find. Read Part 3 first.

5. Requirements and evidence

List the lines a control requirement, contract, insurance condition or regulator demands. Here technology stops looking optional, so be strict. A line belongs only when you can name the requirement, not when a vendor called it best practice.

For federal awards, 2 CFR 200.303 requires recipients to establish, document and maintain effective internal control over the award. It also requires reasonable cybersecurity and other measures to safeguard information.

That rule states a duty and names no product. Any vendor claiming its product satisfies 200.303 sells a conclusion only your documents and auditor can reach.

6. What the program loses if declined

Write two or three sentences per item on what would happen to the mission, in units the board uses. Examples are days of service lost, client records exposed, a missing grant report or a missed contract duty.

Do not lead with fear. You can frighten a board once, and then it discounts everything, even the item that warrants alarm.

7. A smaller credible option

Give two or three real options per decision, each one the board could choose. Include the smaller option when it is credible. Add a defer option with a written trigger: what must happen, by when, and who watches.

	Option	Year-one cost	What it covers	What it leaves open
A
B
C	Defer	$0 now		The trigger

8. The vote, owner, date and proof

Field	Entry
Decision owner
Approval date
Implementation owner
Due date
Proof of completion	The artefact that will prove it happened
Reported back to the board on

People skip the proof field. That is why the same item returns three meetings running, bigger each time.

Part 2: The budget workbook

Two sheets. Sheet 1 lists the lines, and Sheet 2 tests them, which is where the money is found.

Sheet 1: Every technology line

One row per line, not per vendor. Three things from one vendor serving three programs make three rows.

#	Line	Program served	Grant or contract	Restriction	Requirement	Yearly cost	Renewal date	Evidence	Owner	Decision
1
2

The value is in the definitions.

• Program served. The program, department or function the line supports. If you cannot name one, write “none identified”. That is a finding.
• Grant or contract. The award, contract or source charged, by its identifier, not just the funder’s name.
• Restriction. Restricted, unrestricted or mixed, with what the restriction says. For a split, record the split and its basis.
• Requirement. The named requirement the line meets, with its source. “Security” is not a requirement. “2 CFR 200.303 internal control records for Award #_____” is.
• Yearly cost. Everything, including seats, support, setup still being paid off and charges on separate invoices.
• Renewal date. The date and the notice needed to cancel. The notice period matters most and is most often unknown, so find it before it costs you a year.
• Evidence. What proves the line works, such as a usage report, seats against staff, a test result or a control artefact.
• Owner. A named person, not a department, “IT” or the vendor. A blank is a finding.
• Decision. One of the six below.

Six decisions

Decision	Use it when
Keep	The line has a mission, funding, control or operating reason, an owner and evidence it is used
Reduce	The job is needed at a smaller size, such as fewer seats, a lower tier, shorter retention or narrower scope
Remove	There is no current reason, owner or use, or another product does the job
Defer	Deciding later is truly better, and a written trigger says when it returns and who watches
Fund from an eligible source	The cost is justified but charged to the wrong place, subject to your cost policy and award terms
Needs evidence	You cannot yet defend it either way, and someone is named to produce what by when

Expect several “needs evidence” lines. Carrying one for two budget cycles is not acceptable, so date every one. A defer with no trigger avoids a decision, and lets a line survive four years unexamined.

Evidence states

State	Meaning
Used and verified	A usage report from the system, dated within 90 days
Assumed used	Someone believes it is used, but nobody pulled a report
Unused	The report shows little use, or seats far exceed the people who need them
No evidence available	The system cannot produce a usage report, which is worth recording

Move every “assumed used” line to a real state before the pack goes out. Most of the recoverable money sits there.

Sheet 2: Five tests

This sheet pays for the exercise. Run five tests against Sheet 1.

1. Seats against people. For each per-seat line, set seats beside the people who need it and those who logged in within 90 days.

Line	Seats	People who need it	Active in 90 days	Seats recoverable	Yearly value

Leavers are the usual finding. So are seats for a finished grant-funded role, seats inside old bundles, and seats for a program that switched tools.

2. Duplicate jobs. Group lines by job, such as file storage, meetings, email, donors, case notes, scheduling, e-signature, forms, backup and passwords. Any job with two or more products is a candidate.

Job	Products doing it	Combined yearly cost	Why both exist	Decision

Duplicates arrive three ways.

A department bought its own, or a grant-funded tool outlived the grant. Or a suite you already pay for does the job and nobody turned it on. That is common, and free money.

3. Owner gaps. List every line whose owner is blank or gone, or that only a contractor understands.

4. Renewal exposure. List every renewal in the next twelve months by date, with the cancel-by date worked back from it. A notice period that passed last month already decided another year.

Line	Renewal date	Notice needed	Cancel by	Auto-renews	Decision due

5. Exit cost. For every remove and reduce candidate, price leaving. Count data export and format, staff hours, any migration, running both and retraining. A $9,000 line costing $14,000 to leave differs from one that exports cleanly to a spreadsheet.

Run all five tests before writing the pack, since section 2 is built from them.

Part 3: Check each award first

This is the highest-risk part, so read it carefully.

Your award decides which technology costs it can be charged, and whether each is direct or indirect. So do the funding notice, the federal cost principles and your written cost policy. This pack does not decide it, and neither does a consultant or a vendor.

Anyone calling a cost allowable without reading your award is guessing with your money and your audit exposure.

This pack makes the question askable. Fill in these fields for each line charged to an award. Then take them to finance, your auditor and, where needed, counsel.

Field	What to record
Award identifier	The award, not the funder’s name
Terms read	Yes or no, with the date and reader
Cost treatment	Direct, indirect or unrestricted
Basis	The written policy or award term that supports it
Allocation	How a shared cost is split across programs or awards
Records held	Where the support for the allocation lives
Open question	What you need your auditor to confirm
Confirmed by	Name and date, once answered

Two facts come from named federal sources.

• Internal control. 2 CFR 200.303 requires recipients to establish, document and maintain effective internal control over federal awards. It also requires reasonable measures to safeguard information.
• Single audit. Under 2 CFR 200.501, the single audit threshold is generally $1 million a year in federal award spending.

Your auditor decides whether you cross that threshold and how spending counts. Both rules are stated because people selling things misquote them constantly.

If HIPAA applies as a covered entity or business associate, separate duties follow.

People must be told of a breach without unreasonable delay and within 60 days of discovery, under 45 CFR 164.404. Timing for HHS depends on breach size, under 45 CFR 164.408. Whether HIPAA applies is a legal question.

Part 4: A $0 licence is not free

Nonprofit pricing is real and worth using. It also causes one failure seen in almost every workbook. A free or discounted tool is not free, since the licence is often the smallest of its costs.

Cost that survives the discount	What it looks like
Administration	Someone sets it up, manages accounts, removes leavers and answers questions
Integration	Moving data in and out of other systems, and keeping it working
Training	Every new staff member and volunteer, forever
Support	Donated tiers often have reduced or community support, which turns vendor time into staff time
Data and exit	What happens to records if the program, its rules or your tier changes
Control burden	Client data in a tool carries the same safeguarding duties, paid or not

Three traps arrive in this order.

1. The unowned tool. A volunteer or departing staff member sets up a donated platform, and then nobody owns it. Accounts pile up, leavers keep access and nobody knows what data it holds. It costs nothing in cash and much in exposure, and its $0 line escapes every review. List every donated tool in Sheet 1 at zero, with an owner filled in.
2. The tier that becomes a purchase. The donated tier covers ten users and you now have twenty-six. It may exclude the module your program needs, or its rules may change. Record the limits and when you would cross them in the renewal test.
3. The move you cannot afford. Three years of program records sit in a donated system. Check the export path now, while nothing is urgent, and record it under exit cost. Ask the vendor in writing what format a full export produces and how long data stays after an account closes.

None of this argues against donated licences, so use them. Record each one, give it an owner and count the admin time in its real cost.

Part 5: Where the money usually is

These are the common findings, roughly from most to least frequent.

1. Seats for people who left. Almost universal, so check every per-seat line against your roster and real logins.
2. Two products doing one job. Usually file storage, video meetings or e-signature, often with one included in a suite you already pay for.
3. A tool from a finished grant. The program closed, but the subscription did not.
4. A tier sized for a past peak. Storage, sending volume or users sized for a campaign three years ago.
5. Support on replaced hardware. It keeps billing.
6. A renewal nobody agreed to. Auto-renewal with a notice period that quietly passed.
7. Paid features already included elsewhere. Backup, password storage and forms are the common three.
8. A device decision hiding in a subscription. Windows 10 support ended on 14 October 2025. Commercial Extended Security Updates start at US$61 per device in year one and double each year. Put any Windows 10 devices in the pack, with a count and a replacement date, before year three surprises you.

Part 6: Questions the board will ask

• “Why is this more than last year?” Answer with the line table, leading with what you removed. If a price rose without the scope changing, name the vendor and the amount.
• “Can we cut it in half?” Show the test sheet, since you already cut what could go. For the rest, say what each cut would stop, in program terms, so the board makes a real choice.
• “What do similar organisations spend?” Use a figure only with its publisher, date, peer set and denominator. Otherwise, say no defensible comparison exists, and answer on your own facts.
• “Didn’t we already buy something for this?” Often yes, and saying so helps. A licensed but undeployed tool turns new money into finishing a job.
• “Can a volunteer do this?” Sometimes, but answer the continuity question too. A volunteer-run system holding client data needs a named backup person and a written handover.
• “Is this program cost or admin?” That is the cost policy question in Part 3. Give the recorded treatment and its basis, and flag lines your auditor has not confirmed.

Part 7: Four mistakes that weaken the number

• Nothing gets cut. It matters most. If the workbook found nothing to remove, it was not run honestly or your stack is perfect. Assume the first.
• The vendor fills in the workbook. Your IT provider is judging whether its own services are needed. Ask it for usage, seat counts and renewal terms, and decide yourself.
• A requirement without a source. “Required for compliance” with nothing behind it protects a line forever. Require a citation, such as the award term, contract clause, policy or regulation.
• The pack defends everything. Once a board sees it as a yearly case for the status quo, it stops working. Its power is that it gives different answers in different years.

Keep the pack with the vote and proof

This is general guidance on budgets and board reporting. It is not legal, accounting or grant compliance advice, and it sets nothing about allowability, cost policy or funder requirements. Those depend on your awards, written policies and facts.

Have finance, your auditor and, for legal questions, counsel review the workbook before anything reaches a funder.

Once the budget is set, reporting begins, for a different audience. The companion nonprofit grant and board IT report ties each line to a program, funding, requirement, evidence and decision.

SBK will work through one budget cycle or one grant report with you. Call (718) 407-4169.