I can give you my dev input on this after years of doing this for people. If your account is hardly customized and you just need a quick update then you don't need a sandbox. If you have a lot of stuff going on and the chances of a screw up impacting your business is high, then you should definitely get the sandbox first. Its really what level of risk are you willing to accept for the business should something go wrong?