Untagged spend: the allocation backstop.

Here is why untagged spend exists, how to build the backstop, and how to shrink it over time without stalling the business.

Why does untagged spend exist at all?

Some spend is structurally hard to tag and some is simply missed. Shared services such as networking, logging, and a central platform team's tooling serve many consumers and carry no single owner. Data transfer and egress are charged at the boundary, not at the resource. Support and marketplace charges arrive without resource tags. And every estate has resources created before the tagging policy existed, or by automation that never set the tags. The result is that even a disciplined organisation runs with a meaningful untagged remainder, and pretending otherwise is how chargeback loses credibility with the teams it bills.

What does a good allocation backstop look like?

A backstop is a waterfall of fallback rules applied in order, so that anything a tag does not catch is caught by the next signal down. The principle is that allocation never returns nothing.

• Account and subscription boundaries. On AWS, the account is the strongest ownership signal when a tag is absent; on Azure, the subscription and resource group; on GCP, the project; on OCI, the compartment. Map each to an owning team so any resource inside it has a default home.
• Usage based splits for shared services. Allocate shared networking, logging, or cluster cost by a fair driver such as consumption share, request volume, or headcount, rather than leaving it central and invisible.
• A named unallocated owner. Whatever still escapes lands on a platform or central owner who is accountable for shrinking it, not on a faceless bucket nobody reviews.

Each rule trades a little precision for complete coverage, which is the right trade. An approximate owner who can be challenged beats an exact figure that belongs to no one.

How do you keep the backstop from becoming a dumping ground?

The danger is that a backstop makes untagged spend painless, so teams stop tagging. Prevent that two ways. First, enforce tags at creation: AWS tag policies and Service Control Policies, Azure Policy with required tags, GCP organization policies, and OCI tag defaults can reject or flag resources that lack the mandatory keys, so new spend is tagged by default. Second, make the backstop slightly uncomfortable. Show each team both its tagged cost and its share of the backstop, and review the largest unallocated items every cycle so they convert into real tags. A backstop that is visible and reviewed shrinks; one that is silent grows.

How does the FOCUS specification help?

The FinOps Foundation FOCUS specification standardises billing data across providers, which makes a multicloud backstop far easier to build. Instead of writing separate allocation logic for each provider's native export, you map AWS, Azure, GCP, and OCI billing into one schema and apply a single waterfall of backstop rules across all of them. That consistency is what lets a central FinOps function report one allocation number the whole organisation trusts, rather than four that never reconcile.

A worked example

Build an allocation model that allocates everything

We help enterprises build showback and chargeback that reach one hundred percent allocation across AWS, Azure, GCP, and OCI, backstop included, so no spend escapes ownership and waste has nowhere to hide. Our guarantee: we reduce your cloud spend or we reimburse our service fee, on either a Fixed Fee or a no risk Gainshare basis. Start with the operating model guide, then bring us your billing data.