IT Budget Planning for SMEs: Stop Buying When Things Break, Start Ranking by Risk

What "buy it when it breaks" really costs

Plenty of SMEs spend on IT like this: the server dies on Monday, a replacement is bought in a panic on Tuesday at whatever price is on offer. The firewall licence lapses and nobody notices until the whole office loses internet. And in Laos there's another layer: a lot of equipment comes from Thailand and can take weeks, customs included. Emergency buying ends up both expensive and slow.

An IT budget has two jobs: make costs predictable, and spend first on whatever removes the most risk.

Step 1: Know what you have

A plain spreadsheet is enough. List device, model, serial, purchase date, warranty end, user and location. Then add every subscription and licence with its renewal date: domain, email, Microsoft 365 or Google Workspace, firewall, antivirus/EDR, backup, accounting software. A domain that expires without anyone noticing can stop email for the whole company.

Step 2: Replacement cycles

50 PCs on a 5-year cycle → replace about 10 a year. Not all 50 at once every five years, blowing that year's budget. Spending stays smooth, and your finance team will thank you.

Turning cycles into a yearly set-aside

Once you know the cycles, the yearly amount almost calculates itself. For each item, divide its replacement cost by its life in years, and set that much aside every year, whether or not anything is replaced that year.

Take an imaginary office where a server costs 100 units, the firewall 40, the core switch and Wi-Fi together 60, and each PC 8:

Swap in your own quotes and the table becomes your hardware line. Annual licences and subscriptions go on top as a separate line, because they recur and don't depreciate. The point isn't the exact numbers. It's that the server replacement in year six stops being a shock.

Step 3: Separate CapEx and OpEx

• CapEx (capital): hardware, cabling, new projects.
• OpEx (running): cloud subscriptions, annual licences, internet, maintenance contracts, managed services.

The industry is moving from CapEx to OpEx. VMware is now subscription-only, and so is a lot of other software. Tell finance early, because it changes cash flow.

Exchange rates: much equipment and many subscriptions are priced in USD or THB, while your budget is in kip. Hold a contingency for that, every year.

Subscriptions move on their own

Hardware costs stay put once bought. Subscriptions change under you, and 2025–2026 has been busy:

• Microsoft 365 raised list prices on most business and enterprise plans from July 2026. Separately, since April 2025 an annual subscription paid monthly costs 5% more than the same subscription paid once a year.
• VMware by Broadcom sells only subscriptions now, in bundles, which has raised renewal costs sharply for many small virtualization users.
• Windows 10 support ended in October 2025. Paid security updates for businesses last at most until October 2028 and cost more each year, so old PCs that can't run Windows 11 are now a budget item.
• Per-user costs grow with headcount. Ten new hires mean ten more email, security and backup licences, every year.

Put each subscription's renewal month in the plan, check the renewal quote two to three months ahead, and decide then whether to renew, downgrade or switch.

Step 4: Rank by risk

Score impact (1–5) × likelihood (1–5):

High scores get funded first. Notice that none of the top three is expensive? MFA costs almost nothing. UPS batteries cost far less than the server they protect.

See how many minutes your current UPS really gives you with our UPS runtime calculator.

Step 5: A 3-year plan

Example: a 50-person SME, one office:

• Year 1, reduce risk: 3-2-1 backup with an offsite copy, MFA on every account, new UPS batteries, replace 10 PCs, phishing awareness training.
• Year 2, infrastructure: replace the firewall nearing end-of-support, upgrade Wi-Fi, add a second internet line, replace 10 PCs.
• Year 3, efficiency: replace the server or move some systems to the cloud, add monitoring, replace 10 PCs.

Review it every year before the budget cycle starts.

A yearly rhythm that keeps the plan alive

A plan reviewed four times a year stays accurate. One written once and filed away is out of date by the second quarter.

What usually gets left out

Labour and training. New equipment nobody knows how to use is worthless. Maintenance (MA) contracts for critical systems. A 10–15% contingency for emergencies and currency swings. And security: backups kept in more than one location and actually test-restored, regular staff training, and an incident response plan. None of these is expensive, yet they are often the first things cut from the budget.

What's different for a Lao SME

• Lead time is a budget line. Equipment ordered through Thai distributors commonly takes several weeks to arrive. Keep a small spares shelf: one spare access switch, one spare laptop, power supplies for the firewall and NAS, and a set of UPS batteries if you run several identical units. It costs less than a week of downtime.
• Travel to branches. Every site visit outside Vientiane costs a day or more of an engineer's time. Budget remote management tools and a maintenance visit per branch per year rather than paying for emergency trips.
• Power protection first. Brownouts and surges wear out equipment quietly. UPS units, surge protection and good earthing are cheap compared with the power supplies and drives they save.
• Buy for local warranty. A cheaper Thai-market model may carry a warranty that only applies in Thailand. Count the cost of shipping a failed unit back across the border before choosing it.

Selling the plan to management

Keep it to one page. Show the risk table, the three-year plan with a yearly total, and one line per item saying what happens if it isn't funded ("if the firewall subscription lapses in March, web filtering and threat updates stop"). Directors approve risks they can see. They rarely approve a list of model numbers.

Four ways budgets blow up

1. Cutting backup and security because "nothing has gone wrong yet".
2. Buying the cheapest hardware, with a warranty that isn't valid in Laos.
3. Not tracking licence expiry dates, so systems stop without warning.
4. Planning one year at a time with no 3-year view.

Our advice

Start with the asset and expiry-date list. It can be done in a week. Put backup, power (UPS) and MFA ahead of everything else. Order early, allowing for import time. Spread replacements evenly across the years.

Not sure where to start? Send us whatever device list you have, even a rough Excel sheet or photos of old invoices. We'll help you structure it, score the risks and draft your first 3-year plan together.