Software TCO — a buyer-side framework that survives the renewal.

Direct, indirect, exit, risk-adjusted.

A buyer-side TCO framework distinguishes four cost layers. Direct costs are the contractual line items: license or subscription fees, support and maintenance, professional services, named user or transaction-based variable fees. Vendor-supplied TCO usually covers these well; buyer-side adjustments are limited to verifying CPI escalators and stress-testing usage assumptions.

Indirect costs are where TCO models routinely understate. They include internal labour for vendor management, license administration, audit response, contract negotiation, integration maintenance, training and adoption. For an enterprise vendor of any scale, indirect cost runs 15–30% of direct cost on a five-year basis. Most vendor TCO models acknowledge this in a single "professional services" line or omit it entirely.

Exit costs are the costs of leaving — data extraction, format conversion, parallel running, retraining, replacement procurement, transition risk. They are real, they are non-trivial, and they accrue only at the end of the relationship. Including them in TCO from year one — even at zero current realisation — surfaces the lock-in dimension of the commercial structure and supports better exit-clause negotiation.

Risk-adjusted costs are probability-weighted contingent costs that may or may not materialise: audit settlement, price increase above contracted caps, vendor failure, required regulatory exit, material roadmap divergence. They are uncertain by construction, but their expected value is rarely zero — and the buyer's contractual choices materially affect their distribution.

Five years, with three- and seven-year sensitivity.

Time horizon choice is the single largest source of TCO model manipulation. Vendor-supplied models default to one-year or three-year horizons because these horizons capture the upfront transition cost of any alternative while masking the steady-state cost of the incumbent. Five years is the minimum reasonable horizon for material software decisions; sensitivity at three and seven years tests robustness.

In our experience across 340+ engagements, the seven-year sensitivity is where the most informative results often appear — it captures the contractual price escalation, hidden true-up dynamics, and accumulated indirect costs that the three-year view misses. A SaaS renewal that looks attractive at three-year TCO can look very different at seven-year TCO, particularly when the vendor's roadmap forces feature consumption upgrades and the contractual caps on price increase do not bind beyond the initial term.

SaaS versus on-premise

TCO comparison between SaaS and on-premise consistently favours the model that benefits from the buyer's specific usage profile. SaaS TCO concentrates cost in subscription and exit; on-premise distributes cost across license, support, infrastructure, internal labour and lifecycle upgrade. SaaS is typically TCO-favourable at low or variable utilisation and predictable scale. On-premise is more favourable at high utilisation, stable workloads, and where data residency or regulatory constraints add meaningful SaaS-side cost.

Hybrid models are increasingly common and require their own TCO treatment — particularly for vendors that offer cloud subscriptions with on-premise licensing entitlements (Microsoft Hybrid Benefit, Oracle BYOL, IBM Cloud Pak entitlements). Hybrid TCO often surfaces commercial structure choices that pure SaaS or pure on-premise comparisons obscure.

Audit, increase, exit — three contingent lines.

Three risk-adjusted cost lines belong in any serious TCO model for enterprise software. They are not large in the median outcome; they are very large in the tail and their inclusion changes the commercial choice.

1. Audit exposure. Vendors with active audit programmes — Oracle, IBM, Microsoft and SAP being the most material — impose ongoing audit-related cost on customers. A probability-weighted line item, calibrated to vendor audit frequency and average settlement size in the buyer's segment, captures this. In our experience, this is typically 2–6% of annual direct cost as an expected-value line; for high-risk vendors and use cases, it can be materially higher.
2. Price escalation above cap. Most contracts contain price escalation provisions. The question is what happens at the cap. Vendors with strong renewal leverage frequently push above the contracted cap by reclassifying entitlements, adjusting product mix, or imposing co-termed renewals at uncapped pricing. Modelling a 1–3% per annum overshoot above cap is a reasonable starting point.
3. Required exit. Most exits are voluntary; some are forced by vendor failure, regulatory direction, or unacceptable commercial outcome. The probability is low; the cost is high. A 5–10% probability of required exit at year five, modelled at the full exit cost, often dominates the risk-adjusted line.

None of these are intended as point estimates. The value of including them is comparative — between vendors, between contract structures, between renew and replace decisions. Buyers who run TCO without risk-adjusted lines systematically under-price flexibility and over-price commitment.

When independent advisory pays back

For enterprise commitments above $250K a year, an independent software contract negotiation review built on the four-layer TCO — direct, indirect, exit and risk-adjusted — typically returns several times its fee. In our 340+ engagements the seven-year, risk-adjusted view is what reframes a "fair" vendor renewal into a negotiable one: the indirect and contingent layers are exactly where vendor-supplied models understate, and where buyer-side analysis recovers the most.