SaaS sprawl audit for small teams: find the tools you forgot you're paying for

Nobody decides to run eleven tools. It accretes: a free trial that converted, a tool one person loved, two apps that do the same thing because nobody checked. The cost isn't just the subscriptions — it's the data scattered across logins nobody owns, and the churn risk when one of those forgotten accounts is also an unreviewed vendor with your customer list in it. This audit takes one hour and pays for itself the first month.

1. Why sprawl happens (and what it actually costs)

• Trials convert silently. The card on file auto-bills, the invoice goes to a shared inbox nobody reads, and the tool becomes furniture. If an invoice lands in an inbox instead of a person, the spend is already unowned.
• The person who bought it left. Their tool keeps billing, and only they knew the workflow it supported. This is the offboarding checklist leaking money: access gets revoked, but subscriptions and their data don't.
• Duplicates look cheaper than they are. Two task apps, two e-sign tools, three analytics scripts. Each is cheap; the real cost is that no single source of truth exists, so every process built on them is harder to automate later.
• Every tool is also an attack surface. An abandoned survey tool with 4,000 customer emails is a breach waiting on someone else's password policy. Sprawl audits are cost control and security hygiene in the same hour.

2. The one-hour audit, step by step

1. Pull the card statement for the last 90 days. Export it (CSV), and mark every line that isn't payroll, rent, or a supplier. Recurring software hides in descriptions like "SQ *SOMEAPP" — google anything unfamiliar before assuming it's known.
2. Ask the team for their logins, not their opinions. One shared doc: tool name, what it's for, who uses it, last used. Password manager shared collections are the ground truth — if a tool isn't in the vault, nobody can revoke it, which makes it both a spend and a security finding.
3. Name exactly one owner per tool. "Marketing" is not an owner. If a tool has no name next to it, that's the kill pile by default — the audit's sharpest rule.
4. Check usage against cost. For each paid tool: what did the last invoice cost, and did anyone log in this month? The tools with zero logins and nonzero invoices are your first wins. Expect to find at least one.
5. Check the admin seat count. Most SaaS bills per seat. Ex-staff still holding seats, contractors who finished months ago, the "sales@" generic login counted as a human — seat cleanup is often 10–20% of the bill, and it's the same cleanup as removing departed people's access.

3. The kill / keep / consolidate decision

• Kill: zero logins in 60 days, or the owner left and nobody picked it up. Cancel the same week — "we'll look at it next quarter" is how sprawl survives audits. Export the data first if anything in it matters, then note where it went.
• Keep: daily use, clear owner, invoice goes to a person. These are fine. Don't over-prune: the tool that saves two hours a week is worth $30 a month, and pretending otherwise costs more in payroll than it saves in software.
• Consolidate: two tools that do the same job. Pick one by workflow fit, migrate the live data, and keep the other's export in the archive. If both survive because two people each prefer theirs, the decision rule is: the one with the documented process wins — the other is undocumented tribal knowledge wearing a subscription.
• The uncomfortable pile: tools you keep because leaving means migration work. Price that migration honestly (usually a day, not a month), then decide. Paying $40/month to avoid one day of work breaks even in a year — and most of these are $200/month.

4. Stop the creep from coming back

• One card for software, period. A virtual or dedicated card for every SaaS subscription. When the audit runs next time, the statement is the inventory — and cancelled cards kill orphaned trials automatically.
• A renewal calendar with the owner's name on it. Annual renewals get a calendar entry 30 days out: "renew Y — owner Z — used weekly? yes/no." The renewal prompt is the only moment cost and value are both visible; waste it and you auto-pay another year on hope.
• New-tool rule: trial with the software card, owner named before signup. If nobody will put their name next to a trial, it doesn't start. This is a change decision like any other — small, recorded, reversible.
• Feed the winners into automation. The tools that earned "keep" are your automation surface: the two that pass data between each other by copy-paste are the first workflow to automate, and the pick-first sequence lives in the automation ideas list.
• Security check the survivors annually. Every tool that survives an audit owes you a pass of the vendor security review — what data it holds, how it's accessed, and what happens if it gets breached. Sprawl you decided to keep is a portfolio; sprawl you forgot is an exposure.

The pattern across the whole audit: every subscription needs a name next to it — an owner, an invoice destination, and a renewal date. Tools with names get managed; tools without names quietly become both a line item and a liability.