Fixed Price vs Time and Materials: Picking the Right Contract for a Software Project

Fixed Price vs Time and Materials: Picking the Right Contract for a Software Project

Clients ask me which pricing model is cheaper. That's the wrong question. Fixed price and time and materials (T&M) don't sit on a cheap-to-expensive scale.

They sit on a risk scale. Most of the price you pay is really the cost of moving that risk to the other side of the table.

Think of it like car insurance: the premium costs more because the insurer carries the loss if you crash. Pay per repair yourself instead, and the rate drops, but now the risk is yours. Seen that way, picking a pricing model stops being a guess.

The real question is who holds the risk

Under a fixed-price contract, you agree on a price before work starts, and the seller carries the risk of getting it wrong. If the build runs long, the vendor's margin shrinks, not your invoice. That only works cleanly when scope is detailed and unlikely to change.

T&M flips it. You pay for hours and materials actually consumed, so cost risk sits with you, the buyer. In PMBOK-style procurement framing, T&M is treated as a hybrid of fixed-price and cost-reimbursable, with risk nominally shared. In practice it leans toward the buyer unless the contract caps it.

Milestone-based hybrids split the difference again, fixing price per deliverable while leaving room to adjust between phases. None of these is "the good one." Each is a different answer to who absorbs the uncertainty.

Why a fixed-price quote is never just cost plus margin

A fixed-price bid isn't the vendor's honest time estimate with a margin stapled on. It's that estimate plus a risk premium, because the vendor is now on the hook for every unknown that surfaces after signing. Think of a third-party API that turns out half-documented, or a "simple" integration that isn't. Fixed-price shifts risk to the seller, and sellers price that risk in before it ever materializes.

Industry practitioners commonly cite a 15-30% markup for this premium over an honest T&M estimate of the same scope. I'll flag that number for what it is: a rule of thumb vendors repeat to each other, not a measured statistic from any published study. The direction is real even without an exact percentage. The less certain the scope, the fatter the buffer a rational vendor builds in.

Why the buffer is bigger than most clients expect

Early-stage software estimates carry enormous natural variance. The range often cited, traced to Barry Boehm's work on estimation, puts early-concept estimates anywhere from 0.25x to 4x of the eventual true cost. That's not a vendor being sloppy. It's the honest state of knowledge before a design exists.

A fixed-price quote made at that stage is, as one industry write-up puts it, an expensive insurance policy against everything nobody can see yet. It's priced for the worst plausible case rather than the average one.

The scale of what's at stake isn't hypothetical. McKinsey and the University of Oxford studied more than 5,400 IT projects. Large ones (over $15M) run 45% over budget and 7% over schedule on average, delivering 56% less value than promised. 17% of those turn into "black swan" overruns severe enough to threaten the company.

Vendors who quote fixed-price on ambiguous scope have seen numbers like these, even if they've never read the study. The premium they charge is downstream of that fear.

When T&M is actually cheaper

Here's the part vendors rarely volunteer: if the risks the fixed-price premium was pricing in never show up, you paid for insurance you didn't use. As one analysis puts it, "the client pays this premium regardless of whether the risks ever materialize... if the project proceeds smoothly, the client has simply overpaid." Under T&M there's no buffer sitting idle. A feature that turns out simpler than expected shows up as a smaller invoice, not fatter vendor margin.

T&M also lets a team reprioritize mid-project instead of grinding through a locked spec. Fixed-price teams keep building features nobody wants anymore because the contract said to build them. Under T&M, that hour goes somewhere useful instead.

For engagements where the roadmap is going to shift — most early-stage products, most SME systems layered onto existing operations — that flexibility is worth real money. It's a big reason software projects built with an outside team tend to run smoother under T&M once the relationship is past its first release.

The milestone hybrid: fixed price, flexible phases

Milestone-based pricing fixes the price for each defined chunk of work while leaving room to adjust between chunks. Agree on scope and price for "user authentication and admin dashboard," pay when it's delivered and accepted against a checklist, then scope the next milestone with whatever you've learned.

The client pays when the provider completes a specific, predefined piece of work, agreed before that phase starts — not before the whole project starts.

This keeps both sides honest in a way neither pure model does alone. Fixed-price milestones give the vendor a reason to finish and demo working software instead of billing hours against a fog. A defined checkpoint with acceptance criteria gives the client a reason to sign off cleanly instead of drifting into scope creep mid-phase.

The friction point is real: disputes surface when delivered work doesn't obviously match the checklist. It needs to be specific enough to settle an argument, not just gesture at intent. A written acceptance process belongs in the contract, the same place you'd lock down who owns the resulting code.

Capped T&M: the other lever

A not-to-exceed clause is the simpler fix when milestones don't fit: ongoing maintenance, a small embedded team, work that doesn't decompose cleanly into deliverables. You still bill hours and materials, but the total can't cross an agreed ceiling without a change order.

The buyer gets the cost predictability of fixed-price without losing T&M's flexibility. The vendor keeps discretion over how the budget gets spent. Left unprotected, T&M poses real risk to the buyer, with hours able to drift and no natural stopping point. A cap is cheap insurance against that, and most vendors worth hiring will agree to one without a fight.

Red flags from the consultant's chair

On fixed-price engagements, watch for a vendor who treats every clarifying question as a change order. Watch too for quality that erodes quietly once the budget gets tight. Teams under margin pressure skip writing automated tests or defer refactoring nobody will notice until it's expensive. Locked scope plus change-order friction pushes the relationship toward an adversarial "me versus you" dynamic, the opposite of what you hired a consultant for.

On T&M, the red flags run the other way: no not-to-exceed clause, no milestones, no regular reporting on where the hours went. A vendor proposing open-ended T&M with no guardrails is asking you to hold 100% of the cost risk with zero visibility into how it's spent. That's not a pricing model.

It's an open tab. Ask for the cap, the milestones, or both before you sign.