Twelve Questions to Ask Before You Sign Next Year's Technology Budget

Budget season arrives every fall with the same asymmetry: you're expected to approve seven-figure technology spending with less visibility than you'd demand from a single marketing campaign. Your CTO presents slides. Your CFO checks the math. And somewhere between the two, the actual condition of your software — the debt, the dependencies, the risk — goes unexamined.

You don't need an engineering degree to fix this. You need a structured set of questions, asked over 30 days, that reveal how healthy your technology operation really is. Below are twelve, organized by theme, each with guidance on what a good answer sounds like, what should worry you, and what to investigate next.

Technical Debt and Codebase Health

1. If our top engineer quit tomorrow, how long before someone else could safely modify their code? Healthy: 'Days to a couple of weeks — the code is documented and covered by tests.' Red flag: 'That's a hard question' or a long silence. Follow up: Ask for the documentation coverage rate and whether key systems have a second engineer familiar with them.

2. How much of our engineers' time goes to maintenance versus new capability? Healthy: A specific number, typically 30–50% maintenance, with a plan to shift it. Red flag: 'We don't measure that,' or a figure above 70% with no remediation plan. Follow up: Request a one-page debt register: the top five aging systems and what each costs to keep alive.

3. When did we last say no to a feature because the underlying system couldn't support it? Healthy: A recent, specific example. Red flag: 'We always find a way' — which usually means fragile workarounds piling up. Follow up: Ask which two systems most constrain the product roadmap.

Security and Compliance Posture

4. When was our last independent security assessment, and what did it find? Healthy: Within the past 12 months, with a summary of findings and their remediation status. Red flag: 'We do our own testing' or a report nobody outside IT has read. Follow up: Have the findings briefed to your audit committee or board directly.

5. If we suffered a ransomware event tonight, what's the recovery time for our core systems? Healthy: A tested number, backed by a recent restore exercise. Red flag: An estimate that has never been rehearsed. Follow up: Ask to see the date and results of the last backup-restore test — not the backup schedule, the restore test.

Vendor and Dependency Concentration

6. Which single vendor, if it raised prices 40% tomorrow, would hurt us most — and what's our exit path? Healthy: A named vendor plus a documented exit or migration plan. Red flag: 'We're locked in, but they've been fair so far.' Follow up: Request data portability terms for your top three contracts before renewal.

7. What software are we paying for that nobody uses? Healthy: A recent license audit with actual cancellation. Red flag: 'There's probably some shelfware.' Follow up: Ask for a 90-day usage report on your ten largest subscriptions.

Team Capacity and Knowledge Risk

8. Are we relying on any contractor or employee whose departure would halt a critical system? Healthy: 'No single points of failure' with evidence — paired programming, documentation, cross-training. Red flag: A name that comes to mind immediately. Follow up: Fund knowledge-transfer time in next year's budget explicitly.

9. What's our open engineering roles aging, and how has it affected delivery? Healthy: A specific time-to-fill and its roadmap impact. Red flag: Positions open for six-plus months with no adjusted commitments. Follow up: Ask whether current timelines assume hiring that hasn't happened yet.

ROI and Portfolio Visibility

10. Of the software we built or bought in the last two years, what measurable business result did each produce? Healthy: Named metrics — hours saved, revenue influenced, error rates reduced. Red flag: Activity-based answers ('we delivered 14 features'). Follow up: Require a post-implementation review at 90 days as a standing condition for any new build.

11. What are we still doing manually that our competitors have automated? Healthy: A candid list with a prioritization rationale. Red flag: 'Nothing' or 'we haven't compared.' Follow up: Commission a lightweight process audit of your two most labor-intensive back-office workflows.

12. If you had my budget authority for one year, what would you stop funding — and what would you double? Healthy: A decisive, specific answer. Red flag: Hedging, or defending every existing line item. Follow up: Whatever they name, take it seriously. This question reliably surfaces what your leadership actually believes but hasn't said out loud.

Making the 30 Days Count

Spread the questions across four weekly conversations rather than one marathon meeting — you'll get candor you'd never get in a single session. Put the answers in writing, share them with your board or leadership team, and let the pattern of vague responses tell you where next year's dollars should and shouldn't go. The goal isn't to catch your technology team doing something wrong. It's to walk into budget negotiations knowing, for the first time, exactly what you're buying.