Budget vs forecast vs alert · ZopDev University

Outcome

By the end of this lesson, you will be able to distinguish budget, forecast, and alert as three separate concepts; explain why budgets do not auto-enforce; and design each independently for your team’s monthly cycle.


Prerequisites	M4.5: Showback dimensions
Time	9 minutes

1. Concept

Three words get mixed up constantly, usually in the same meeting.

A budget is what you agreed to spend. A forecast is what you now think you will spend. Actual is what you have spent so far. They answer different questions and they are allowed to disagree.

BUDGET     The monthly spend limit leadership has agreed to, set on
           one target: a resource, a resource group, a cloud account
           or an AI provider. Top-down ("we'll spend $X") or bottom-up
           ("we need $X for these workloads").

FORECAST   The data-driven projection of what spend will actually
           be by month-end. Updated as data arrives; rough early in
           the month, close to actual late in the month.

ALERT      A notification when month-to-date spend crosses the
           budget's alert threshold (one optional percentage you set)
           or reaches 100%. The alert prompts a conversation; it does
           not enforce.

Conflating them produces dysfunction: people argue about budget when they should be discussing forecast; alerts get treated as enforcement when they are notifications; forecasts get treated as commitments when they are projections.

Each serves a different purpose

BUDGET    "We will spend at most $X this month."
          Used for: planning, capacity discussion, cash flow.
          Changed: deliberately, by editing the amount.

FORECAST  "We expect to spend $Y this month based on current data."
          Used for: weekly reviews, intra-month decision-making.
          Updates: continuously, as new cost data arrives.

ALERT     "Spend crossed the warning threshold" or "spend reached 100%."
          Used for: triggering conversation at the right moment.
          Fires: from the daily cost job, at two levels only.

A team’s monthly cycle uses all three:

1. BUDGET set for the month (top-down or bottom-up agreement)
2. FORECAST checked weekly as data lands (data-driven projection)
3. ALERTS fire at the warning threshold and at 100% (conversation triggers)
4. VARIANCE analysis at month-end (budget vs actual vs forecast)
5. ADJUST next month's budget amount based on lessons

Budgets do not auto-enforce

This is the most-asked question from new ZopNight customers: “If we go over budget, does ZopNight stop the spend?” No. ZopNight fires alerts; spend continues. The reasoning is deliberate.

WHY NO AUTO-ENFORCEMENT:

  Production safety
    Hard-stopping cloud spend mid-month could kill production
    workloads. A budget overrun is not a reason to take down
    customer-facing services.

  False positives
    Forecasts and budgets are approximate. A 100% crossing might
    just mean "lumpy spend that will normalize" rather than
    "runaway." Hard enforcement would over-correct.

  Customer control
    Different orgs want different responses. Some absorb the
    overrun; some cut spend immediately; some adjust budget.
    ZopNight provides the signal; the customer decides.

  Audit clarity
    "Spend was X" and "spend was stopped at $Y" are different
    audit stories. We want the actual story, with the human
    decision logged, not an automated mid-month cut-off.

So the model is: alert, then conversation, then decision, then action. Each step is human-mediated. This is the same philosophy as the MCP write surface (M6.5): writes are tiered and need explicit permission, and nothing cuts spend on its own; humans decide.

Forecast refines over the month

EARLY MONTH (day 1-7)
  Few days of actuals; the projection swings with every day
  Treat it as rough

MID MONTH (day 8-20)
  Enough actuals to see the run rate
  The projection tightens

LATE MONTH (day 21-end)
  Mostly-known actuals plus a small tail
  Close to the final number

ZopNight shows the org-level forecast on Cost Reports, Summary tab: a Forecast card (“Projected for selected period”) and a forecast line extending the cost trend chart. A budget has no forecast of its own. For one budget’s target, project it yourself: month-to-date spend, divided by days elapsed, times days in the month. By mid-month that simple run rate is usually a good estimate of the month-end number.

Variance analysis at month-end

At month-end:
  ACTUAL:    $105K     (final spend)
  BUDGET:    $100K     (committed)
  FORECAST:  $104K     (mid-month projection)

VARIANCE TO BUDGET:   actual - budget = +$5K (+5%)
VARIANCE TO FORECAST: actual - forecast = +$1K (+1%)

INTERPRETATION:
  Budget was set $4K below trend (planning gap)
  Forecast was accurate (data was reliable)
  Action: next month's budget should account for the underlying
          trend, not the under-set budget

A team that consistently overruns budget without overrunning forecast has a budgeting problem, not a spend problem. The fix is to align the budget to data, not to demand the team spend less than the forecast.

Two alert levels: the conversation triggers

A ZopNight budget has exactly two alert levels:

WARNING   The alert threshold you set on the budget (0-100%).
          Optional: 0 turns it off. One number per budget,
          for example 80%.
          "We are getting close; is the trajectory reasonable?"

EXCEEDED  Fixed at 100% of the monthly amount. Always on.
          "We are at or over the committed level; decide on
          overrun handling."

There is no chain of 50%, 75%, 90% and 110% markers. If you want an earlier conversation, set the warning threshold lower; if you want a louder one at 100%, route the exceeded alert to more people (L3).

How often you hear about it depends on where the alert goes. If a notification channel (Slack, Microsoft Teams, Google Chat or a webhook) subscribes to the budget alerts, it gets a message on every daily cost run while the budget stays over the level. If the org has no channel subscribed, ZopNight emails the org’s admins instead, once per level per month, and again only if the level rises.

How ZopNight uses it

ZopNight surfaces budgets in two places: the Budgets page (one row per budget with spend, limit and status) and the Budget Health dashboard widget. The org-level forecast lives on Cost Reports, Summary tab.

Alert routing is set up as notification subscriptions to the budget.warning and budget.exceeded events (covered in L3). Variance analysis at month-end is a review you run: the budget amount from the Budgets page, the actual from the same row on the last day, and the forecast you noted mid-month.

2. Demo

A team’s full month:

BUDGET: prod-platform resource group
AMOUNT: $100,000/month   ALERT THRESHOLD: 80%

DAY 7:
  Actual:   $21K (21% of budget)
  Run rate: $21K / 7 days x 31 = about $93K (on track)
  Status:   Green
  Alert:    none

DAY 15:
  Actual:   $49K (49%)
  Run rate: about $101K (slight overrun expected)
  Status:   Green (the colour does not forecast)
  Alert:    none

DAY 23:
  Actual:   $81K (81%)
  Run rate: about $109K
  Status:   Yellow
  Alert:    budget.warning fires to #platform-alerts,
            and again on each daily run while spend stays above 80%

  INVESTIGATION (same day):
    Marketing campaign launched mid-month: 25% more user
    traffic than planned. Cost is proportional to traffic.

  DECISION:
    Accept the overrun; campaign revenue exceeds incremental cost
    Raise next month's amount to account for the higher baseline
    Document: campaign-driven; the plan didn't include this scenario

DAY 28:
  Actual:   $100.5K (100.5%)
  Status:   Red (over budget)
  Alert:    budget.exceeded fires to #platform-alerts and #finops-alerts

DAY 31 (month-end):
  Final:    $110.8K (110.8%)
  Day-23 run rate was $109.2K: accurate within 1.5%

  ACTION:
    Variance review with finance; documented
    Next month's amount raised to $112K (data-driven re-baseline)
    No corrective action on this month's spend (campaign justified)

Two alert levels fired. Three conversations (warning, exceeded, month-end). Outcome: the budget was set low; the run-rate projection was accurate; the team raised next month’s amount.

3. Hands-on (5 min)

For one of your team’s budgets:

BUDGET TARGET:      __________ (resource / group / account / AI provider)
MONTHLY AMOUNT:     $__________
CURRENT SPEND:      $__________ ($_____ % of budget)

RUN-RATE PROJECTION (spend / days elapsed x days in month):
  $__________
VARIANCE TO PROJECTION (projection minus budget):
  __________   (positive = expected overrun;
                 negative = expected underrun)

ALERTS:
  Warning threshold:        _____ %  (0 = off)
  Exceeded:                 100% (fixed)
  Channel for warning:      __________
  Channel for exceeded:     __________
  (no channel = admins get email)

OWNER for the budget:    __________
OWNER for the forecast:   __________ (often the FinOps Lead)
RESPONSE OWNER if alert fires:    __________

If the projection is well over budget and growing, plan a mid-month conversation now rather than waiting for the warning alert.

Do it through MCP. The same task you just did in the console, asked in one sentence.

BEFORE  A ZopNight account with one cloud connected. One month of cost history, so the budget has something to sit against.
ASK     "Create a monthly budget of 40k for the data platform and alert at 80%."
CHECK   the scope. A budget on the wrong scope reads healthy while the thing you cared about overruns, which is L2.

Tools behind it: create_budget (write, tier 1, metadata only), get_budget_spend (read, Govern), get_budget_summary (read, Cost). Connection details are in the MCP integration docs.

4. Knowledge check

Q1

Budget is exceeded. What does ZopNight do automatically?

A. Sends the budget’s exceeded alert
B. Stops all new spending straight away
C. Blocks any further new provisioning
D. Automatically disables the resources

Show answer

Correct: A. At 100% the budget turns red and the exceeded alert goes to its subscribed channels (or to the org admins by email). ZopNight does not enforce; that’s a human conversation. Auto-stop would risk production outages and override customer judgment about how to handle overruns. Alert and conversation, not enforcement. The model is deliberate.

Q2

Forecast refines because:

A. Someone presses the manual refresh
B. As data arrives, the forecast tightens
C. The cloud rate-card changes arrive
D. The budget period is reset by an admin

Show answer

Correct: B. Early-month projections have few days of actuals behind them; late-month projections approach the actual. Data-driven refinement is what makes the forecast useful; late in the month, it becomes precise enough to act on.

Q3

A budget’s warning threshold is set to 50%, and the warning fires mid-month. Best response:

A. Note and watch
B. Panic and cancel projects
C. Disable spending
D. Raise the budget so the alert stops firing

Show answer

Correct: A. Spend at 50% by mid-month is on track: 50% just means halfway through the month. A threshold that low is set for early awareness; the conversation matters only if the run rate is concerning. Mid-month awareness: informational, not action.

5. Apply

Set budgets on the Budgets page: pick the target, the monthly amount and the alert threshold. Route the alerts by subscribing a channel to budget.warning and budget.exceeded in Settings → Notifications. The org forecast is on Cost Reports, Summary tab.

Schedule a 30-minute month-end variance review; budget vs forecast vs actual, with lessons captured for next-period planning.

Glossary terms touched

Budget · Forecast · Variance analysis

Outcome

1. Concept

Each serves a different purpose

Budgets do not auto-enforce

Forecast refines over the month

Variance analysis at month-end

Two alert levels: the conversation triggers

How ZopNight uses it

2. Demo

3. Hands-on (5 min)

4. Knowledge check

Q1

Q2

Q3

5. Apply

Related lessons

Glossary terms touched

Start with the bill.