Outcome
By the end of this lesson, you will be able to read budget traffic-light signals at a glance, diagnose a red budget systematically, and propose the right corrective action by pattern.
| Prerequisites | M4.6.L1-L3 (budget fundamentals, scopes, thresholds) |
| Time | 9 minutes |
1. Concept
Budget health shows as a colour: green, amber or red.
Behind the colour are two things: what you have spent this month, and what you agreed to spend, measured against the alert threshold you set on the budget. Compressing those into one signal is what lets somebody glance at a dashboard and know whether to open it. Where you are heading is your judgement; the colour does not forecast.
SIGNAL SPEND vs BUDGET ACTION──────────────────────────────────────────────────────────────────GREEN below the budget's No action alert threshold Healthy steady-state
YELLOW at or above the alert Investigate threshold, below 100% May exceed; understand why
RED 100% or more Diagnose + act Already over; root cause + fixThe alert threshold is set per budget (for example 80%). If a budget has no threshold set, it stays green until it reaches 100% and then turns red; there is no yellow. The signal is intentionally three-state. Two-state (over/under) is too binary; five-state (intricately tiered) overloads the dashboard. Three states give meaningful differentiation with simple semantics.
Reading green
GREEN means: Month-to-date spend is below the budget's alert threshold (or below 100% if no threshold is set)
ACTION: None required. Look once a week to confirm, then move on.
SUSTAINED-GREEN observation: Green for 6 months in a row, never reaching the threshold? Possible: budget was too generous; could tighten. Possible: workload shrank. Possible: discount realization improved. Periodic review of green budgets surfaces over-budgeted lines.Green budgets are the boring majority in a healthy org. The dashboard should show mostly green; the eye is drawn to the yellow and red exceptions.
Reading yellow
Yellow is the most interesting signal. It is the early-warning state; spend is approaching budget, but the outcome is not yet decided.
YELLOW signals require investigation: Will spend continue at current pace? (will exceed budget) Or is it a one-time spike that will normalize? Or is it simply a threshold set low on purpose, for early warning?
INVESTIGATION STEPS: 1. Look at the daily cost trend on Cost Reports (Summary tab) Is the rate of spend changing? Acceleration matters more than absolute %.
2. Cross-reference with anomaly detection Is the yellow caused by a specific anomaly? Often yes.
3. Identify the driver Which resource/team/account is contributing the increased velocity?
4. Project: continued or one-off? One-off: accept; expect to land yellow but in-budget. Continued: project the actual end-of-period; plan response.
ACTIONS by projection: Continued and minor overrun (105% projected): document and accept Continued and major overrun (130% projected): corrective action One-off and will fall back: monitor; expect to land in budgetThe skill in yellow-state investigation is distinguishing trend from spike. A spike will reverse; a trend will not.
Reading red
Red means the budget is already exceeded. The conversation has shifted from “will we overrun?” to “we did; what now?”
RED diagnosis follows a specific path:
1. ROOT CAUSE What drove the overrun? - Open Cost Reports (Summary tab, daily view) - Identify the day/week the daily spend broke from its baseline - Cross-reference with anomaly detection for that period - Look at Cost Flow Sankey to find the dimension dominating
2. SEVERITY - 105% over: small overrun; usually accept + document - 120% over: significant; investigate and act - 150%+ over: emergency; immediate action + executive awareness
3. CORRECTIVE ACTION (by severity): Small (<110%): document the cause; accept; adjust next period Medium (110-130%): identify recoverable spend; act if possible Large (>130%): kill resources, throttle workloads, escalate
4. NEXT-PERIOD ADJUSTMENT Was the budget too low? (re-baseline) Was the workload unplanned? (planning gap to fix) Was the overrun preventable? (process improvement)The red conversation is two-step: stop the bleeding (or accept it), then learn the lesson for next period.
How budgets surface
SURFACE DETAIL──────────────────────────────────────────────────────────────────Budget Health widget Every budget's signal at a glance(dashboard) Colour + spend + budget amount, plus MTD spend, remaining and alert counts
Budgets page One row per budget: target, spend, limit, status; edit amount and threshold here
Team detail page Budget summary: the total of the budgets on the team's resources and groups
Notifications budget.warning at the threshold, budget.exceeded at 100% (M4.6.L3)There is no per-budget detail page and no budget trend chart: a budget shows today’s month-to-date position. For the shape of the spend over the month, go to the cost views. The widget on the dashboard is the most-used surface. A FinOps Lead’s morning routine often includes a 30-second glance at it.
Diagnosing red: the standard path
STEP 1: Find the budget on the Budgets page See current spend, limit and % used
STEP 2: Cost Reports, Summary tab, daily view When did daily spend break from baseline? Sudden spike (one-time event)? Gradual ramp (growth)? Step change (specific event)?
STEP 3: Cost Flow Sankey Click the budget's account (or provider) node to narrow the flow Which dimension dominates? Drill into the top contributors
STEP 4: Identify specific resources or pattern For a group budget, open the group and check its members on the Inventory page Often resolves to: one specific resource, one team, one account, one cloud service
STEP 5: Take action Decide: stop the spend, accept and adjust, or escalate Document the decisionFor most red budgets, steps 1-4 take 5-10 minutes. The action in step 5 is where the time goes.
Common red causes
Recurring patterns from customer telemetry:
CAUSE PATTERN──────────────────────────────────────────────────────────────────New workload deployed Step change in spend (sudden jump on launch day)
Marketing campaign Sudden spike, then decline (clear start + end)
Cloud provider rate change Step change across all (uniform multiplier effect)
Failed schedule (resource kept on) Gradual increase from one specific resource
Compromised credentials Anomalous spike + unusual regions/services
Unauthorized provisioning Specific user creating resources outside policy
Migration ongoing Temporary spike during the migration window
Autoscaler misconfiguration Gradual or sudden growth tied to a specific cluster
Forgotten cleanup after experiment Slow drift; specific resource hanging aroundEach pattern guides the remediation. Marketing campaigns are accepted; misconfigurations are reverted; compromised credentials trigger incident response.
How ZopNight uses signals
ZopNight’s Budget Health dashboard widget renders the signal from live-computed spend (L5), and its “View all budgets” link opens the Budgets page. The daily cost job sends the warning and exceeded alerts. From a non-green budget, the diagnosis moves to the cost views: Cost Reports for the daily trend, Cost Flow for the dominant dimension, the Inventory page for individual resources.
For weekly Operate cadences, the recommended ritual is: scan the dashboard, click into any non-green budgets, diagnose, document. 20-30 minutes per week to keep budget hygiene healthy.
2. Demo
A real red-budget diagnosis:
SCENARIO: Tuesday morning; FinOps Lead checks dashboardSIGNAL: dev-platform-eu group budget is RED at 130% of budget (30% over)
T+0 Find the budget on the Budgets page Spend: $6,240 / $4,800 budget = 130% Day 23 of 31; 8 days left
T+30 sec Cost Reports, Summary tab, daily view Org daily spend shows a step change on day 14; still elevated today (last week's review noted this group at 45%, $2,160, on day 13: about $166/day)
T+1 min Open Cost Flow; click the budget's account node EKS cluster dominates the spike (compute spend 3x of pre-spike baseline)
T+2 min Click into the EKS cluster details Worker node count went from 8 to 23 on day 14 Sustained through day 23 (current day)
T+3 min Check the cluster's HPA / autoscaler config HPA max was 12 prior to day 14 Now set to 30 (the change happened on day 14)
T+5 min Kubernetes audit log (EKS control-plane logs): who changed the HPA? The change was made in the cluster, not through ZopNight, so ZopNight's own audit log does not show it. User: jane@platform on day 14, 09:23 UTC Reason: none recorded
T+8 min Reach out to Jane "Did you change the HPA max for prod-eks-cluster?" Jane: "Yes: load test for the new feature. Forgot to revert."
T+10 min Action: revert HPA max to 12 Set a calendar reminder for next planned load test Document in team wiki the HPA-revert checklist after load tests
T+15 min Confirm: pod count dropped from 23 back to expected range Budget impact: ongoing spend back to baseline Month-end projection: $6,240 + 8 days x $166 = about $7,570 (158% of budget); month-to-date spend cannot fall, but the overrun has stopped growing faster than baseline
LESSONS: - Load tests need budget impact noted - HPA changes should have time-bound revert (or auto-revert) - Record a reason for config changes in the ticket; the audit log captures what changed, not why15 minutes from red signal to root cause to fix. The diagnostic path is the key.
3. Hands-on (5 min)
For your current budgets:
SIGNAL SCAN (all budgets): Green count: _____ Yellow count: _____ Red count: _____
PICK ONE YELLOW or RED: Budget: __________ Signal: yellow / red Spend / budget: $_____ / $_____
Driver (best guess): □ New workload □ Marketing campaign □ Failed schedule □ Autoscaler misconfig □ Forgotten cleanup □ Other: __________
DIAGNOSIS STEPS to take: 1. __________ 2. __________ 3. __________
ACTION PLAN: __________________________________________________________If you have no yellow or red budgets, scan the green ones for sustained over-budgeting (budgets set too high). Those are worth tightening to free fiscal headroom.
4. Knowledge check
Q1
A budget is yellow at 85% mid-period:
A. Ignore it until the period ends, since a mid-period figure means very little on its own
B. Treat it as a crisis and escalate it immediately to the leadership team for a decision
C. Always escalate it, whatever the period or the rate of spend so far may be at that point
D. Investigate whether the spend will continue at this rate (and exceed budget) or whether it will slow
Show answer
Correct: D. Plan corrective action if continuing; document and monitor if one-off. Yellow is the early-warning state: it has more diagnostic value than red. Yellow warrants investigation but not crisis response. The diagnostic value is highest here because the period is not yet decided.
Q2
A budget is red at 130% of budget. Diagnosis path:
A. Find the budget on the Budgets page → daily cost trend on Cost Reports → identify the inflection point → Cost Flow Sankey to find the dominant dimension → drill to the root cause → act
B. Question whether the budget was set at the right level in the first place, then re-baseline it against the last three periods of actuals before taking any further action on it
C. Open the Cost Trend for the period, then escalate straight to the owning team’s lead without narrowing the cause down any further than the period total itself, since that is the number leadership asks about
D. Disable the budget so the alerts stop, then investigate the overrun at the next monthly review once the period has fully closed out and all the figures have settled down
Show answer
Correct: A. The diagnosis is systematic, not just “the budget is wrong.” Diagnose, don’t disable. The budget signal is doing its job; the response should match.
Q3
A budget is green for 6 months in a row, always well below its alert threshold:
A. The budget is poorly set
B. Healthy steady-state
C. Crisis
D. Evidence the forecast model is miscalibrated
Show answer
Correct: B. The team is comfortably within commitment. A reasonable secondary observation: the budget could be tightened to free headroom for other priorities, but only after confirming the current state is intentional and not a workload shrinking unexpectedly.
5. Apply
The Budget Health dashboard widget surfaces signals at a glance (zop.dev/zopnight/app/dashboard). Every budget, with its spend and status, is listed on the Budgets page.
Schedule a weekly Operate cadence: 20-30 minutes per week to scan the dashboard, diagnose yellows and reds, document. This is the highest-leverage budget discipline activity.
Related lessons
- L1: Budget vs forecast vs alert
- L2: Budget scopes
- L3: Threshold-crossing notifications
- L5: Live computation, not stored (next)
- T4.M4.8.L1: Trend vs flow