Best practices in financial forecasting for IT operational run costs

Research Question

What are the established best practices for financially responsible forecasting of Information Technology (IT) operational run costs — covering cost estimation by technology and infrastructure type, required assumptions, uncertainty modelling (error bars and compounding estimate impact), and the regulatory and governance considerations that apply when these projections appear in financial filings or are used for planning and investment decisions?

Findings

Executive Summary

Financially responsible forecasting of IT operational run costs requires three interlocking practices: a structured cost taxonomy aligned to the Technology Business Management (TBM) Council standard or ITIL (IT Infrastructure Library) 4 cost types; stated and documented assumptions for each material cost driver (consumption growth, unit prices, contract terms, labour rates, and exchange rates); and quantified uncertainty modelling that reflects the correlated nature of most IT cost risks. The dominant external disclosure frameworks — International Accounting Standard (IAS) 1 paragraph 125, US Generally Accepted Accounting Principles (GAAP) ASC 275, Securities and Exchange Commission (SEC) Management Discussion and Analysis (MD&A) Item 303, Sarbanes-Oxley Act (SOX) Sections 302/404, the UK Financial Reporting Council (FRC) guidance, and EU Prospectus Regulation 2017/1129 — converge on the principle that material forward-looking cost estimates must be accompanied by their assumptions and a quantification of the uncertainty that attaches to those estimates. The key distinction between internal planning standards and external disclosure standards is one of threshold: internal good practice is conservative and range-based; external disclosure is legally required when uncertainty is material and the estimate is reasonably likely to change materially. Organisations that present single-point IT cost estimates in board papers or regulatory filings without stated assumptions and uncertainty ranges are neither meeting best practice standards nor, where the estimate is material, meeting their disclosure obligations.

Key Findings

1. The TBM Council V4 taxonomy is the de facto industry standard for categorising IT operational costs, providing a cost pool layer — labour, Software-as-a-Service (SaaS), cloud services, hardware, telecom, and facilities — that forms the required structure for building auditable run-cost estimates across all deployment models. Confidence: high.

2. Infrastructure-as-a-Service (IaaS) cloud compute costs are consumption-driven and metered by the second, making them the highest-volatility IT cost category: cloud spend can increase 20–30% annually without active governance, driven by usage growth that outpaces the per-unit price reductions that cloud providers have historically delivered. Confidence: high.

3. Eight canonical assumptions must be documented for an IT run-cost estimate to be auditable: consumption growth rate by category, unit prices and vendor escalation clauses, staffing headcount and grade mix, currency and exchange rate assumptions, vendor contract terms and renewal dates, capitalisation versus expense treatment, hardware refresh cycle schedule, and planned organisational changes such as cloud migrations or divestitures. Consumption growth rate and unit price assumptions are typically the most material. Confidence: high.

4. Scenario analysis, sensitivity analysis (tornado charts), and Monte Carlo simulation are complementary uncertainty modelling techniques addressing different aspects of forecast uncertainty: scenario analysis describes qualitatively different futures; sensitivity analysis identifies which assumptions drive the most variance; Monte Carlo produces a probability distribution of outcomes required for regulatory or board-level defensibility. Confidence: high.

5. Most IT cost uncertainties are positively correlated — macro-economic inflation, foreign exchange movements, and vendor price cycles affect multiple cost categories simultaneously — so arithmetic addition of percentage uncertainty ranges is more conservative and appropriate than root-sum-square (RSS) combination, which systematically underestimates combined uncertainty when inputs are correlated. Confidence: medium.

6. In multi-year total cost of ownership (TCO) forecasts, errors in year-one growth rate assumptions compound through later years: an annual uncertainty of ±15% produces approximately ±34% five-year uncertainty under the independence assumption and up to ±75% under full correlation, meaning that the stated uncertainty range for a five-year forecast must be substantially wider than the stated annual uncertainty. Confidence: medium.

7. IFRS IAS 1 paragraph 125 requires disclosure of assumptions with a significant risk of resulting in a material adjustment to asset or liability carrying amounts within the next financial year; UK FRC thematic reviews conducted in 2017 and 2022 found widespread non-compliance characterised by generic boilerplate text, missing quantitative sensitivity disclosures, and failure to distinguish short-term from longer-term estimation uncertainties. Confidence: high.

8. US GAAP ASC 275 triggers disclosure when it is at least "reasonably possible" that an estimate will change materially in the near term, a lower threshold than IFRS IAS 1.125's "significant risk" standard, making ASC 275 more easily triggered for IT cost commitments such as cloud minimum spend obligations and prepaid licence agreements. Confidence: high.

9. SEC MD&A Item 303 (FR-72) classifies disclosure of known trends reasonably likely to cause a material change in cost-revenue relationships as a required disclosure, not optional forward-looking information — explicitly covering known or reasonably likely increases in labour, materials, or vendor prices, which encompasses IT labour cost escalation and software vendor price increases at contract renewal. Confidence: high.

10. SOX Sections 302 and 404 require that internal controls over financial reporting (ICFR) extend to the processes underlying all material financial estimates; for organisations where IT operational costs are material to reported financial figures, the IT cost estimation process itself must be assessed as part of ICFR by management (Section 404(a)) and attested by external auditors (Section 404(b)). Confidence: high.

11. EU Prospectus Regulation (Regulation (EU) 2017/1129) requires material, issuer-specific risk factors categorised by significance; generic IT cost risk factors that apply to all technology companies are non-compliant, and a material IT operational cost uncertainty must be disclosed with specific quantification and placed prominently according to its materiality ranking. Confidence: high.

12. The structural gap between internal planning practice — which commonly uses single-point optimistic estimates to secure budget approval — and external disclosure requirements — which require range-based, assumption-transparent, specifically quantified disclosures — creates regulatory risk for organisations that submit internal forecast outputs directly into prospectuses or annual reports without upgrading disclosure quality to the applicable standard. Confidence: medium.

Identified but not consulted:

• Vose, D. — Risk Analysis: A Quantitative Guide (3rd ed., Wiley) [ ]
• Hubbard, D.W. — How to Measure Anything (3rd ed., Wiley) [ ]
• RICS Professional Standards — Uncertainty of Valuation [ ]
• PCAOB AS 2101 full text [ ]
• ISACA COBIT 2019 full publication text [ ]
• IFRS Practice Statement 1 on Materiality Judgements [ ]

Assumptions

1. [assumption] The TBM Council V4 taxonomy is sufficiently representative of industry practice to serve as the reference taxonomy for IT cost categorisation. Justification: cited by multiple independent practitioner sources and adopted by US government agencies; no competing standard of equal authority was found.

2. [assumption] Error propagation mathematics from engineering and travel demand modelling applies to IT cost forecasting. Justification: the mathematical mechanism (correlated vs. independent errors, compounding through multiplicative models) is domain-independent. Specific correlation coefficient values for IT cost categories are not empirically calibrated from this investigation.

3. [assumption] The 20–30% annual IaaS cost increase figure applies to organisations without active cloud cost governance. Justification: the source explicitly conditions the figure on unmanaged cloud spending; it is not a universal rate and should not be applied to organisations with active FinOps (Financial Operations) practices.

Analysis

The evidence supports a two-tier framework for IT operational run-cost forecasting.

Tier 1 — Internal planning standard: A well-constructed internal IT run-cost forecast uses the TBM taxonomy to categorise costs, documents the eight canonical assumptions for each material category, applies sensitivity analysis to identify the critical assumptions, and presents a range (minimum/base/maximum) rather than a single point. This is the standard that ITIL 4 Service Financial Management, COBIT 2019 APO06, and the TBM Council collectively endorse.

Tier 2 — External disclosure standard: When IT cost estimates appear in financial filings, regulatory requirements add further obligations: assumptions must be specifically disclosed (not generic boilerplate), sensitivity must be quantified, and the uncertainty must be characterised in terms of near-term material adjustment risk (IFRS/FRC) or reasonable possibility of material change (GAAP/SEC MD&A). The EU Prospectus Regulation requires issuer-specific quantified risk factors where IT costs are material.

The governance mechanism linking Tier 1 and Tier 2 is SOX 302/404: the Chief Executive Officer (CEO) and Chief Financial Officer (CFO) certification obligation means the internal estimation process itself must be subject to internal controls. [inference] The quality of Tier 1 is therefore a prerequisite for the integrity of Tier 2.

[inference] The most significant practical gap is in uncertainty treatment. Organisations commonly present single-point IT cost forecasts with qualitative uncertainty acknowledgment. IAS 1.125 (confirmed by FRC enforcement) and ASC 275 both require quantitative uncertainty disclosure where it is material. Bridging this gap requires building range-based models internally and translating them into the specific disclosure language required by the applicable standard.

The correlation structure of IT cost uncertainties is the technically decisive issue that most practitioners overlook. Assuming independence (and applying RSS) when inputs are actually correlated produces overconfident uncertainty ranges that understate the true risk. For a board or regulatory audience, this is a material disclosure failure. [inference] The correct approach is Monte Carlo with an explicit correlation matrix, or, more conservatively, arithmetic addition of percentage ranges where correlation is suspected but not quantified.

Risks, Gaps, and Uncertainties

1. Correlation coefficients not standardised: No authoritative standard specifies how IT cost category correlations should be estimated or disclosed. The direction (positive correlation for most categories) is well-reasoned; the magnitude must be estimated from organisation-specific historical data or expert calibration.

2. Multi-year uncertainty disclosure gap: No specific standard (IFRS, GAAP, FRC) directly addresses how multi-year compounding uncertainty in IT cost forecasts should be disclosed. Existing guidance focuses on near-term (next financial year) material adjustment risk, leaving a gap for 3–5 year TCO projections in business cases and investment papers.

3. Internal vs. external document consistency: The risk that internal business case forecasts and external filings use inconsistent assumptions without explanation is real but was not quantified from enforcement data in the consulted sources.

4. Jurisdiction coverage gap: Only IFRS, US GAAP, SEC, UK FRC, and EU Prospectus Regulation were investigated. Australian, Canadian, Japanese, and other regulatory frameworks may have different requirements.

5. Practitioner framework depth: COBIT 2019, ITIL 4, and TBM Council were accessed via secondary summaries and online practice guides. Full publication text may contain more specific uncertainty quantification guidance than captured here.

Open Questions

1. How do organisations listed under both IFRS and US GAAP (dual-listing) reconcile the different disclosure thresholds for IT cost uncertainty, where ASC 275 triggers at "reasonably possible" and IAS 1.125 at "significant risk of material adjustment"? (Suggested priority: medium — relevant to dual-listed technology companies)

2. Does PCAOB AS 2101 or AICPA AU-C 540 contain guidance specifically applicable to auditing IT operational run-cost estimates as a category of accounting estimate? (Suggested priority: medium — relevant to audit preparedness for listed companies)

3. Does the RICS uncertainty of valuation methodology provide a directly portable disclosure model for IT cost uncertainty, given its mature practice for quantifying estimation ranges in professional standards? (Suggested priority: low — exploratory)

Output

• Type: knowledge
• Description: Structured reference on IT operational run-cost forecasting best practices, covering cost taxonomy, required assumptions, uncertainty modelling techniques, compounding error propagation, and regulatory disclosure requirements across IFRS, GAAP, SEC MD&A, SOX, FRC, and EU Prospectus Regulation.
• Key sources:
  • TBM Council V4 Taxonomy (primary IT cost taxonomy standard): www.tbmcouncil.org
  • SEC FR-72 / Item 303 MD&A guidance (regulatory disclosure standard): www.sec.gov
  • FRC July 2022 Thematic Review: Judgements and Estimates (enforcement evidence): www.frc.org.uk

sources

• [ ] IFRS Practice Statement 1 — Making Materiality Judgements — IFRS Foundation
• [ ] IAS 37 — Provisions, Contingent Liabilities and Contingent Assets — IFRS Foundation (relevant for uncertain future obligations)
• [ ] FASB Accounting Standards Codification (ASC) 275 — Risks and Uncertainties — GAAP disclosure requirements for estimates subject to significant change
• [ ] SEC FR-72 — Commission Guidance Regarding Management's Discussion and Analysis — SEC guidance on forward-looking disclosures
• [ ] Public Company Accounting Oversight Board (PCAOB) AS 2101 / American Institute of Certified Public Accountants (AICPA) AU-C 540 — Auditing accounting estimates
• [ ] ISACA COBIT 2019 — IT governance framework including Financial Management practices
• [ ] ITIL 4 — Financial Management for IT Services — practitioner framework for IT cost modelling
• [ ] Gartner IT Budgeting and Cost Optimisation research — industry benchmarks and cost categorisation frameworks
• [ ] Royal Institution of Chartered Surveyors (RICS) Professional Standards — Uncertainty of Valuation — for uncertainty disclosure methodology
• [ ] Vose, D. — Risk Analysis: A Quantitative Guide (3rd ed., Wiley) — Monte Carlo simulation and compounding uncertainty
• [ ] Hubbard, D.W. — How to Measure Anything (3rd ed., Wiley) — applied estimation and uncertainty quantification
• [ ] UK FRC — Financial Reporting Lab: Judgements and Estimates — guidance on disclosing estimation uncertainty
• [ ] EU Prospectus Regulation (2017/1129) — financial projections disclosure requirements