Counting the Cost of Creeping SaaS: A 2026 Audit Playbook for UK SMEs
Photo: Francisclarke, CC BY-SA 4.0, via Wikimedia Commons
UK SMEs rarely set out to create a sprawling software estate. It accumulates: a project tool here, a reporting add-on there, a payment service attached to a single invoice. By the time finance notices the monthly direct debits, no one person can explain what each subscription does or why it remains. The result is familiar: duplicated functionality, idle licences and a security surface that has expanded faster than the controls around it.
A full software asset management programme can take months. A 90-minute triage will not replace it, but it can produce a defensible first pass before year-end. The aim is not to cancel everything that looks untidy. It is to establish a single inventory, identify the highest-value decisions and assign owners with dates.
Set a narrow scope and a named owner
Choose one accountable person for the exercise and give them access to finance, procurement and IT records. The scope should be every recurring software or cloud service paid for by the business, including those bought on cards and those embedded in a managed service. Exclude hardware, broadband and one-off professional services for now. Book 90 minutes with no interruptions and agree that the output will be a one-page decision log, not a perfect register.
Minutes 0-20: Build one inventory
Start with the bank and card statements, then reconcile against the finance ledger. Add the single sign-on directory, browser bookmarks, expense claims and any departmental spreadsheets. For each tool, capture the vendor, business owner, primary function, annual cost, contract term, renewal date, notice period, authentication method, integration points and the highest category of data it holds.
Do not accept the supplier's description alone. A tool described as a collaboration platform may also store personal data, hold client files or connect to the finance system. Mark any service that processes personal data or provides administrative access to other systems. That distinction will matter later.
Minutes 20-40: Expose overlap and dormant access
Group the inventory by function rather than by vendor: project management, file storage, video conferencing, customer relationship management, expense capture, analytics and so on. Within each group, ask three questions. Do two tools do the same job? Does one tool duplicate a feature already paid for in a wider platform? Is the tool used by a team that has since changed process or been absorbed into another department?
Then test usage. Where single sign-on is in place, pull last-login data. Where it is not, ask owners for a simple count of active users this month. Flag accounts belonging to leavers, shared generic logins and tools with no named business owner. These are not merely housekeeping issues. They are access risks that sit outside joiner-mover-leaver controls.
Minutes 40-60: Put a number and a risk rating on each tool
Annualise every cost, including seat-based charges, storage tiers and support add-ons. Note auto-renew clauses, minimum terms, price escalation mechanisms and the notice period needed to exit. UK procurement practice should also include a check on suppliers' data processing terms. For services holding personal data, confirm whether a data processing agreement is in place, where data is stored, which subprocessors are used and whether any transfer outside the UK relies on an appropriate mechanism such as the international data transfer agreement.
Risk-rate each tool on a simple high, medium or low basis. High-risk indicators include administrative access to core systems, personal or financial data, no multi-factor authentication, no clear owner and no documented exit route. Cyber Essentials or equivalent supplier assurance may be relevant for smaller vendors, but it is not a substitute for reading the contract and understanding the data flow.
Minutes 60-75: Choose consolidate, renegotiate or retire
Apply three decision rules. Consolidate where two tools serve the same function and one can absorb the other without material disruption. Renegotiate where the tool is needed but the contract is poor value, the seat count is overstated or the renewal is close enough to create leverage. Retire where usage is negligible, the function is duplicated or the risk cannot be justified.
Be realistic about switching costs. A cheap tool with deep integration into finance or operations may be more expensive to remove than to keep. Conversely, a low-cost tool holding sensitive data without a clear owner is a poor bargain. Record the decision, the owner and the next action. Where retirement is chosen, require data export, confirmation of deletion and a diary note to verify that billing has stopped.
Minutes 75-90: Convert findings into dated actions
Close the session by producing a one-page log with four columns: action, owner, deadline and expected saving or risk reduction. Assign a 30-day follow-up for consolidation and retirement actions, and a renewal calendar entry for every contract with a notice period longer than 30 days. Send the log to finance and the leadership team the same day. That simple step turns an audit into a managed process.
The exercise will not answer every question about software value. It will, however, give UK SME leaders a repeatable way to see what they are paying for, where access has drifted and which decisions must be taken before the next renewal cycle. In a year when budgets remain tight, that is a practical form of control.
