Build the budget around scope, uncertainty and ownership
Grouping web applications into small, medium and large categories is a common starting point for cost estimation, but it becomes misleading the moment you treat those labels as price brackets. Two applications that appear similar in scale can carry very different costs because "size" in a business system is not measured by the number of screens or pages. It is determined by process complexity, the number of distinct user roles, the volume and structure of data, integration requirements, and the security and compliance standards the system must meet.
A straightforward internal tool that replaces a single spreadsheet might involve only one or two user roles and a handful of workflows. A customer portal serving the same number of users could require document management, payment processing, role-based access control and integration with an existing CRM. Both might be described as "medium" projects, yet the portal will typically cost considerably more to design, build and test because the underlying process logic is more involved.
When a supplier offers cost ranges tied to project size, the practical question is not which bracket you fall into, but what assumptions sit behind each bracket. A "small" estimate from one development company might include discovery, acceptance testing and a handover period, while the same label from another might cover only the coding of a fixed list of features. Until you understand what is included and what is excluded, the size label tells you very little about the actual outlay.
Size categories can, however, serve a useful purpose early in planning. They help you communicate the rough nature of your project before a detailed specification exists, and they give suppliers a starting point for an initial conversation. The mistake is to move from that starting point directly to a budget commitment without unpacking the factors that will ultimately determine the cost.
| Cost area | What to quantify | Budget control |
|---|---|---|
| What actually drives cost within any size category | Regardless of whether a project is labelled small, medium or large, the following factors tend to have the greatest influence on the final figure: | Documented assumptions, exclusions, ranges, approval limits and actual-versus-plan reporting. |
| Small projects: single-process tools | A typical small project focuses on one core process with limited roles and no complex integrations. | A named owner, current-state evidence, unresolved questions and a dated decision record. |
| Medium projects: multi-workflow business systems | Medium projects typically involve several connected workflows, multiple user roles with different permissions, and at least one or two external integrations. | A named owner, current-state evidence, unresolved questions and a dated decision record. |
| Large projects: platforms and multi-tenant systems | Large projects are characterised by multi-tenancy, complex data models, numerous integrations and stringent security or compliance requirements. | A named owner, current-state evidence, unresolved questions and a dated decision record. |
What actually drives cost within any size category
Regardless of whether a project is labelled small, medium or large, the following factors tend to have the greatest influence on the final figure:
- Number and interaction of user roles. A system with three independent roles is simpler to build than one where five roles overlap, require approval chains and have conditional access to records.
- Process branching and exception handling. A linear workflow where every step follows the previous one costs less than a process with conditional paths, reversals, escalation rules and manual overrides.
- Data volume, structure and migration. Moving a few hundred records from a spreadsheet is a different task from migrating years of transactional data with relational links, deduplication and validation rules.
- Integration count and type. Each external connection adds discovery work, error handling, retry logic and ongoing maintenance. Read-only integrations are simpler than bidirectional syncs.
- Security and compliance requirements. Handling personal data, payment card details or regulated information introduces additional controls, audit logging and testing that do not appear on a feature list but directly affect cost.
Understanding how project size translates into cost is easier when you look at concrete scenarios. The following examples are illustrative rather than definitive, but they show how the same size label can mask very different underlying requirements.
Small projects: single-process tools
A typical small project focuses on one core process with limited roles and no complex integrations. Examples include an internal booking system for a small team, a simple approval workflow for purchase requests, or a basic admin panel for managing a mailing list. The process logic is usually linear, the data structure is flat or only lightly relational, and the security model can be handled with straightforward authentication.
Even within this category, costs can vary. A booking tool that needs to check real-time availability against a shared calendar and send confirmation emails involves more logic than a form that simply collects requests into a database. If the tool must also integrate with an existing accounting system to generate invoices, it may edge into a higher cost bracket despite appearing small on the surface.
Medium projects: multi-workflow business systems
Medium projects typically involve several connected workflows, multiple user roles with different permissions, and at least one or two external integrations. Common examples include a CRM tailored to a specific sales process, a customer portal with document upload and messaging, or an operations dashboard that pulls data from two or three internal sources.
The cost drivers in this category are usually the interactions between workflows and the permissions model. If a sales manager can only see records assigned to their team, and that rule changes depending on whether a deal is in negotiation or closed, the permission logic alone can represent a significant portion of the development effort. Adding document versioning, email notifications at specific workflow stages, or a reporting layer with filters and exports each introduces further complexity.
Large projects: platforms and multi-tenant systems
Large projects are characterised by multi-tenancy, complex data models, numerous integrations and stringent security or compliance requirements. A SaaS product serving multiple organisations, a legacy system replacement that must run in parallel with the old system during migration, or an enterprise portal with single sign-on, detailed audit logs and role-based access across several departments all fall into this category.
In these projects, a substantial portion of the cost is often absorbed by work that is not visible to end users: infrastructure design, data migration planning, security reviews, load testing and operational monitoring. The build itself may be only one part of a broader programme that includes discovery, migration, parallel running and phased rollout.
Mapping your own project to a size category
Rather than asking whether your project is small, medium or large, a more useful exercise is to list the concrete elements that will need to exist in the finished system:
- How many distinct processes must the system support, and how many of those processes branch or loop?
- How many user roles are needed, and do any roles have conditional or overlapping permissions?
- What data will the system hold, where does that data currently live, and how must it be validated during migration?
- Which external systems must connect to the new application, and what does each connection need to do?
- Are there specific security, compliance or retention requirements that will constrain the design?
This list gives you and any potential supplier a shared vocabulary for discussing scope. It also makes it easier to see where a project might shift from one size category to another if a requirement is added or changed.
Mistaking screen count for project size
One of the most persistent errors in cost estimation is equating the number of screens or pages with the amount of work involved. A dashboard with a single view might require complex data aggregation, permission filtering and real-time updates, while a multi-page form with simple validation and a flat database write could be considerably quicker to build. Always focus on what each screen does, not how many there are.
Assuming size categories are standardised
There is no industry-standard definition of what constitutes a small, medium or large web application. Each supplier will have their own framing based on their team structure, preferred technologies and typical client base. A project described as medium by one company might be classed as small or large by another. This is why comparing estimates by size label alone is unreliable; you need to compare the underlying scope assumptions.
Overlooking non-build costs
Size-based estimates frequently focus on the development phase and omit or understate discovery, data migration, user acceptance testing, infrastructure setup, security review and post-launch support. For medium and large projects in particular, these activities can represent a significant share of the total outlay. When you receive a size-based estimate, ask explicitly what is included and what is treated as a separate phase or charge.
Ignoring the cost of changes after launch
A project that is small at launch can become medium or large over time as new processes are added, integrations are connected and user counts grow. Size-based estimates typically describe a point in time, not a trajectory. Understanding how the system is designed to accommodate future change, and what that change is likely to cost, is a separate but closely related consideration.
Key checks before accepting a size-based estimate
- Scope definition. Is there a written description of what the estimate covers, or does it rely on a verbal summary?
- Exclusions. Does the supplier list what is not included, such as data migration, third-party licence costs, security testing or ongoing support?
- Assumptions. What assumptions about integrations, data quality, user numbers and infrastructure sit behind the figure?
- Acceptance criteria. Is it clear how you will determine whether the delivered system meets the agreed scope?
- Change handling. If a requirement shifts the project from one size category to another during build, how will that be identified and priced?
Review the budget as evidence changes
Size categories are a reasonable way to begin a conversation about cost, but they are not a substitute for a detailed scope, clear acceptance criteria and a shared understanding of what the estimate does and does not cover. The more precisely you can describe your processes, roles, data and integrations before approaching suppliers, the more meaningful any size-based estimate will be.