Budget vs forecast vs alert

BUDGET     The financial commitment leadership has agreed to.
           Top-down ("we'll spend $X") or bottom-up ("we need $X
           for these workloads"). Locked at the start of a period.

FORECAST   The data-driven projection of what spend will actually
           be by period-end. Updated as data arrives; refines from
           rough early-period to precise late-period.

ALERT      A notification when spend crosses a configured threshold
           (50%, 75%, 90%, 100%, 110% of budget). The alert prompts
           a conversation; it does not enforce.

BUDGET    "We will spend at most $X this quarter."
          Used for: planning, capacity discussion, cash flow.
          Locked: at start of period; changes are explicit and audited.

FORECAST  "We expect to spend $Y this quarter based on current data."
          Used for: monthly reviews, intra-period decision-making.
          Updates: continuously, as new data arrives.

ALERT     "Spend crossed Z% of the budget."
          Used for: triggering conversation at the right moment.
          Fires: once per threshold per period (no notification spam).

1. BUDGET set at start of period (top-down or bottom-up agreement)
2. FORECAST updated weekly as data lands (data-driven projection)
3. ALERTS fire at configured thresholds (conversation triggers)
4. VARIANCE analysis at period-end (budget vs actual vs forecast)
5. ADJUST next period's budget based on lessons

WHY NO AUTO-ENFORCEMENT:

  Production safety
    Hard-stopping cloud spend mid-month could kill production
    workloads. A budget overrun is not a reason to take down
    customer-facing services.

  False positives
    Forecasts and budgets are approximate. A 100%-crossing might
    just mean "lumpy spend that will normalize" rather than
    "runaway." Hard enforcement would over-correct.

  Customer control
    Different orgs want different responses. Some absorb the
    overrun; some cut spend immediately; some adjust budget.
    ZopNight provides the signal; the customer decides.

  Audit clarity
    "Spend was X" and "spend was stopped at $Y" are different
    audit stories. We want the actual story, with the human
    decision logged, not an automated mid-month cut-off.

EARLY PERIOD (day 1-7)
  Forecast = extrapolation from prior period + planned changes
  Confidence: low (high uncertainty)

MID PERIOD (day 8-20)
  Forecast = early-period actuals × extrapolation
  Confidence: medium (data tightens the projection)

LATE PERIOD (day 21-end)
  Forecast = mostly-known actuals + small tail
  Confidence: high (close to actual)

At period-end:
  ACTUAL:    $315K     (final spend)
  BUDGET:    $300K     (committed)
  FORECAST:  $312K     (last mid-period projection)

VARIANCE TO BUDGET:   actual - budget = +$15K (+5%)
VARIANCE TO FORECAST: actual - forecast = +$3K (+1%)

INTERPRETATION:
  Budget was set $12K below trend (planning gap)
  Forecast was accurate (data was reliable)
  Action: next period's budget should account for the underlying
          trend, not the underforecast budget

50%   "We're halfway through the period; how does it feel?"
       Soft signal; sometimes set; often skipped.

75%   "We're three-quarters through; reasonable trajectory?"
       Moderate signal; investigate if trend is concerning.

90%   "Approaching budget; expect to land slightly under or over?"
       Strong signal; explicit conversation; possibly action.

100%  "At budget; we are at the committed level."
       Significant signal; leadership awareness; decide on
       overrun handling.

110%  "Over budget by 10%; significant variance."
       Strong action signal; emergency conversation for prod.

TEAM: platform-team
Q4 BUDGET: $300K (committed at end of Q3)

WEEK 1 (Oct 1-7):
  Actual:   $24K (8% of budget)
  Forecast: $295K (likely on-track)
  Status:   Green
  Alert:    none fired

WEEK 4 (mid-Oct):
  Actual:   $98K (33%)
  Forecast: $290K (on-track, slight tightening)
  Status:   Green
  Alert:    none

WEEK 6 (early Nov):
  Actual:   $145K (48%)
  Forecast: $293K (on-track)
  Status:   Green
  Alert:    50% crossing fires (informational; #finops-info)

WEEK 8 (mid-Nov):
  Actual:   $215K (72%)
  Forecast: $315K (slight overrun expected)
  Status:   Yellow
  Alert:    75% crossing fires (#dev-platform-eu + #finops-alerts)
            "Forecast: $315K, +$15K over budget"

  INVESTIGATION (same day):
    Marketing campaign launched mid-Oct: generated 25% more user
    traffic than planned. Cost is proportional to traffic.

  DECISION:
    Accept the overrun; campaign revenue exceeds incremental cost
    Adjust Q1 budget to account for higher traffic baseline
    Document: campaign-driven; budget plan didn't include this scenario

WEEK 12 (early Dec):
  Actual:   $295K (98%)
  Forecast: $312K (continued overrun)
  Status:   Yellow → Red incoming
  Alert:    90% crossing fires

WEEK 13 (end-Dec):
  Actual:   $310K (103%)
  Final:    $312K (Forecast accurate within 1%)
  Status:   Red (over budget)
  Alert:    100%, then 105% crossing

  ACTION:
    Variance review with finance; documented
    Q1 budget revised up to $325K (data-driven re-baseline)
    No corrective action on Q4 spend (campaign justified)

BUDGET:             $__________ for period __________
CURRENT FORECAST:   $__________ as of today
CURRENT SPEND:      $__________ ($_____ % of budget)

VARIANCE TO FORECAST (forecast minus budget):
  __________   (positive = expected overrun;
                 negative = expected underrun)

THRESHOLD ALERTS configured:
  □ 50%  → channel: __________
  □ 75%  → channel: __________
  □ 90%  → channel: __________
  □ 100% → channel: __________
  □ 110% → channel: __________

OWNER for the budget:    __________
OWNER for the forecast:   __________ (often the FinOps Lead)
RESPONSE OWNER if alert fires:    __________