The SaaS Spend Audit Playbook

Nearly every company has SaaS spend it isn't fully aware of. Not because anyone is hiding anything, but because SaaS purchasing happens in enough different places, on enough different cards, that no single person naturally sees the whole picture. What follows is an audit process worth running roughly once a year, whether or not anything seems obviously wrong.

Where the hidden spend actually hides

Before running the audit, it helps to know what you're looking for: tools purchased directly by a department on a company card and never routed through procurement or IT, free trials that converted to paid plans automatically, duplicate tools where two teams independently bought something that does roughly the same job, contracts inherited from an acquisition or a team reorg with no clear current owner, and tools kept "just in case" after the project that justified them ended.

Step 1: Pull every source of truth separately

Don't start with a single list. Pull corporate card and expense statements filtered for recurring software charges, your accounting system's vendor list, SSO or identity provider logs showing what tools employees are actually authenticating into, and any existing contract repository, however incomplete. The longer-term aim is contract terms held as data rather than PDFs.

Step 2: Reconcile the lists against each other

This is where the real discoveries happen. Tools that show up in card statements but not in your contract repository are your blind spots. Tools that show up in SSO logs but nowhere on the spend side may be free tiers quietly attached to paid ones, or shadow purchases routed through an individual's account.

Step 3: Group by function, not by name

Once you have a fuller list, group tools by what they actually do: analytics, project management, e-signature, and so on. Overlaps become obvious fast. It's common to find three or four tools doing substantially the same job across different teams, each with its own renewal date and its own notice period. A simple SaaS renewal tracker with notice deadlines prevents this from happening.

Step 4: Assign an owner to everything you find

An audit that produces a list nobody owns just becomes next year's blind spot again. Every tool that comes out of this process needs a named owner, even if the immediate decision is simply "keep as is".

Then decide, don't just document. For each overlap or forgotten contract, make an actual call: consolidate, cancel, renegotiate, or keep. A completed audit with no decisions attached is a spreadsheet, not a savings plan, and running this process once properly, with an owner and a decision attached to every line, is what keeps it from turning back into a rediscovery exercise next year.