The Budget Fairy

It is a persistent plaint of the security managers that they do not have sufficient budget to do what they think should be done.  One wonders where they think budget comes from.  There is no budget fairy that comes down and confers budget on good little boys and girls. Those managers who have budget all got it the same way; they asked for it.  

Security managers are peculiarly loath to ask for budget for fear they will be told no. (A "no" in the record might look bad but it is an implicit acceptance of any risk that the proposal was intended to reduce.  It should be in the record.) Those who ask for budget get told no a lot. Those who have budget did not take no for an answer. They re-did their proposal or their justification and asked again.  And again.  As many times as necessary to get to yes.

Note that almost anyone in the hierarchy can say no.  Those who have budget, find the executive or manager who can also say yes.  They never accept no for an answer until they are sure that they have proposed to someone who can say yes if she wants to.  Note that while we may sometimes get budget from senior staff, it is usually the line of business executives who control most of the resources and incur losses.  (Senior line of business executives often have "budget" or "plans and controls" staff, who manage budget, understand the process, and know how much discretion the executive has.  These staff can be very helpful.)

Those who have budget are the same managers who are being promoted.  General management likes few things better than managers who will tell them how to spend money profitably.

Security initiatives are usually justified either by a reduction, at least over time, in the cost of security or the cost of losses.  These reductions have the advantage that they fall through to the bottom line as profit.  It is useful to budget for "losses;" while they occur irregularly, they do occur.  At least at the level of the enterprise or business unit, they can be estimated; all budgets are estimates but get more accurate with experience.  Increases in the budget for initiatives can be justified in part by a reduction in the budget for losses.  

Managers often see budget as a restriction on their ability to spend.  Rather they should see it as permission.