I don't understand ...
... exactly what “Harold” meant by "The 2IC is having none of that argument". He provided an estimate along with identifying some possible risks. And the #2 boss is saying "No"? Does he have some insight into the process and a more streamlined approach? Or is he one of these supervisors that just think the IT department throws a handful of faerie dust at the servers and its 'job done'.
Having worked in some heavily audited lines of business, this sounds like a request to 'just get it done, but hide the expenditures' which can get even a CEO canned. Or at least the business banned from government contracts. Now I understand that not everyone must answer to this high a level of accountability. But Harold should take whatever steps are needed, through official channels, to request budget for and set up charge lines to track this activity. That might be enough to stop 2IC in his tracks.