One Line Called IT: Can It Be Smaller?

Run is the cost of keeping every promise the firm already relies on. Licenses, connectivity, support contracts, the security stack, the people who answer at eight in the morning, and the renewals that arrive whether or not anyone planned for them. Change is the cost of making something different: a migration, a new system, an automation, a control you do not have yet. Both are real, both recur in their own way, and presented together they hide each other completely.

The hiding is not neutral, because the reader has to assume something. A finance partner looking at a single line called IT that grew ten percent cannot tell whether the estate is costing more or the technology function has become more ambitious, and the safe assumption from their chair is ambition. You then spend the meeting arguing about intent rather than about a number. Split it and the argument becomes precise: run rose because headcount grew and three contracts renewed at the uplift written into them, and change is a separate proposal the committee may accept, defer, or refuse on its own merits.

At Tbar Holding I owned an annual IT budget of six million riyals across seven operating entities with an eighth being built, and it covered both halves at once: the Odoo 15 to 18 program, the Microsoft 365 tenant and domain transition, the security stack, and day-to-day operations for roughly a hundred and fifty users. Presenting that as one figure would have been indefensible, not because the number was large but because no single question could be asked about it. Split, every line had an owner and a consequence.

The split disciplines the technology function before it disciplines anyone else. Work migrates quietly from change into run — a pilot that became a dependency, a tool one department can no longer operate without, a temporary license nobody retired — and it is invisible until somebody asks which column it now sits in. I ask that question every quarter. It has surprised me more often than I would like.

Pricing the run means attaching a number to each service in your catalog rather than to each invoice. Invoices are how vendors organize your money; services are how the business consumes it. Until the two are mapped you cannot answer the only question that matters when the pressure arrives, which is not "what does this cost" but "what would stop if this line went away".

Expect the mapping to be uncomfortable, because it exposes three things at once. Shared platforms serve several services and refuse to be allocated cleanly. A large part of run is people rather than contracts, and people do not appear on a renewal calendar. And somewhere in the list will be a line item supporting something the firm decommissioned a year ago that nobody cancelled. That last category is where the first honest saving lives, and finding it before finance does is the difference between arriving with a result and arriving with an explanation.

Then state each run line with the commitment it keeps and the assumption underneath it, in one sentence a non-technical reader can hold: this amount keeps the broker portal available during business hours, and it assumes the single shift we operate today. Written that way, a request to cut it stops being a request to be more efficient and becomes a request to change a commitment. That is a decision the business is entitled to make. It is not a decision it should make by accident.

A service catalog is the prerequisite here, and I have written separately about building one before buying anything else. The budget conversation is the place where its absence is most expensive, because without it every number you present is defended by your credibility alone.

In most technology functions the biggest block of money nobody has examined this year is not a project. It is the set of contracts that renewed automatically because a notice window passed while everyone was busy. Nobody chose to keep them. A date did, and the date is not on anybody's calendar because renewal dates live in contracts and contracts live in a folder.

Build the register before you build anything else: vendor, service, annual value, renewal date, notice period, the internal owner, and the decide-by date. That last column is the one that matters, and it is not the renewal date — it is the renewal date minus the notice period minus however long your own approval cycle takes. It is the only date that belongs in an operating calendar, and in my experience it is between one and three months earlier than the one people write down.

Then review the next two quarters at every operating meeting, so decisions are made while alternatives still exist. A vendor conversation held ninety days out is a negotiation. The same conversation held two weeks out is a signature with a discussion attached to it. Nothing about your position changes except the time you have, and the time you have is the entire position.

Use the register to ask the questions that only make sense in advance. Are we paying for seats nobody has signed into. Is this tier still the right one. Has this been superseded by something we already own inside another license. And what does leaving actually cost — data export, retraining, integration rework, the parallel-run period. That exit number is the one vendors quietly rely on you never having calculated, and calculating it is free.

The word change invites the committee to hear optional, and in a regulated Saudi firm a substantial part of it is not. Take the clearest example available. The Zakat, Tax and Customs Authority's electronic invoicing program phases taxpayers into system integration by announced groups, and the authority commits to notifying each group at least six months before its integration date. Group twenty-five was announced on 24 July 2026, covers taxpayers whose VAT-taxable revenue exceeded one hundred and eighty-seven and a half thousand riyals in 2022, 2023, 2024 or 2025, and has an integration deadline of 1 February 2027. That six-month notice is not a courtesy. It is the entire runway, it is the same six months for every group, and a firm with no funded change line cannot buy more of it.

The direction of travel is worth stating as arithmetic rather than as commentary, because it is available on the authority's own published numbers. Group twenty-four's threshold was three hundred and seventy-five thousand riyals — exactly the mandatory registration threshold for value added tax. Group twenty-five's is one hundred and eighty-seven and a half thousand — exactly the voluntary registration floor. Group twenty, announced in January 2025, was set at one and a half million riyals; eighteen months later the threshold is the floor of the tax system, which is another way of saying that almost nobody is outside it now. Work that arrives with a published date attached is change in the accounting sense and mandatory in every other sense, and presenting it in the same list as a proposal to modernize reporting is what causes it to be deferred by a committee that thought it was choosing between two ambitions.

So split change once more, and label the halves plainly: obliged and proposed. For everything in the obliged column, carry the instrument, the date, and who says so — not a summary of it, the instrument. A row that says "PDPL work" is an opinion. A row that names the law, the date it came into force, and the specific obligation you are not yet meeting is a deadline, and deadlines survive budget meetings that opinions do not.

I hold myself to a rule here that costs me some rhetorical force and is worth it. If I have not read the instrument itself, I say I have read counsel's summary of it, and the row carries the summary as its source rather than the law. If implementing regulations have not been issued, I say the obligation has no measurement behind it yet rather than inventing one. A committee that catches you overstating a regulatory deadline once will discount every other date you bring for a year, and they will be right to.

The practical effect of the split is that the proposed column becomes short and honest. It also becomes rankable, because the business is no longer being asked to weigh a modernization against a legal obligation dressed in the same font. In my experience the obliged column is also the one most likely to be under-costed, because it is written by whoever noticed the deadline rather than by whoever will do the work.

A cut request is not an attack, and answering it as one is how technology leaders lose a room they had. Answer it as an operator instead: here are three ways to reach the number you asked for, here is precisely what each one withdraws, and here is the one I would choose and why. That answer takes an hour to prepare and it changes who is holding the problem.

Prepare the options before the meeting where they are demanded, because the meeting is not where thinking happens. Deferring an item in the proposed column is the cheapest and belongs first. Reducing a service level — a shorter support window, a slower recovery target, a queue that is answered next business day instead of within the hour — is real money and a real decision, and it must be accepted in writing by the business that consumes the service. Cutting run without withdrawing any commitment is the only option that is not honest, and it is the one that will be suggested to you, usually by someone who means well.

Say the second-order cost out loud whenever it exists and can be sourced. Deferring a migration by a year can cost more than it saves once extended-support pricing starts, and that belongs on one slide with the vendor's own published lifecycle dates beside it. If I cannot source the number, I say I cannot source it and give the shape of the risk instead. A committee accepts a number it can trace and discounts an adjective, and it remembers which one you brought.

The outcome I want from that meeting is not to keep my budget. It is that whatever is decided, the firm knows what it bought and what it gave up, and that sentence appears in the minutes. At Tbar Holding the change program was paused during a corporate restructuring, and the mandate my role existed to deliver ended with it. That was a legitimate decision made by people who were entitled to make it. What made it a clean decision rather than a quiet one was that the run and the change had never been the same number.

The split is a presentation discipline, not a truth about money, and I have seen it used badly by people who learned it from someone like me. Labelling something run does not make it untouchable; it makes it a commitment somebody has to be willing to name. If you cannot name the commitment, the line is not run — it is change that stopped being discussed, and moving it into the protected column is how a technology function stops examining itself.

I have also under-costed the obliged column more than once, and always the same way: by pricing the software and not the people. A regulatory integration is rarely expensive to buy and reliably expensive to operate, because it needs someone to reconcile what it produces, every period, forever. That recurring cost is run, it starts the day the project closes, and it belongs in the paper that approves the project rather than in next year's surprise.

And I do not have a defensible benchmark for the ratio between the two, which is worth saying precisely because everybody quotes one. I went looking for the figure that circulates as a fact about how much of technology spend goes to keeping the lights on, and I could not get to a source whose sample I could inspect and whose definition of run matched the one I have been using here. So that figure is not in this article. The split everybody repeats is repeated a great deal more often than it is sourced, and a ratio you cannot trace back to a method is worth less in a budget meeting than one line of your own measured history.

For Saudi insurance specifically I have nothing to hand you, and I did look. The honest answer to what a Saudi insurer should be spending on technology is that I do not know of a figure I would stand behind, and a ratio is only useful against your own previous year measured the same way — which is an argument for starting the measurement now rather than for finding a number to compare yourself against.

What has held up across every version of this is smaller than the framework. Say what a line keeps alive. Say what a cut withdraws. Report what last year's funded items actually delivered, including the ones that underdelivered, because a function that only reports its successes is read as marketing and has its numbers discounted silently. Credibility is the budget you get next year.