A SaaS audit checklist for service businesses

Why a SaaS audit is worth doing

Software creeps in. A project manager signs up for a scheduling tool with a company card. A departed employee's seat on a design tool keeps renewing. Two departments pay for different e-signature products. Each charge is small enough that nobody questions it, and together they add up to a meaningful monthly cost that no one is managing.

There is a risk side too. Every subscription holds some company or client data and has its own set of users. If you do not know which tools exist, you cannot be sure former staff have lost access, or that client files are not sitting in a free account someone forgot about.

Step 1: Build the inventory from the money

Do not start by asking people what they use. Start with what you pay for. Export 12 months of transactions from company cards and bank accounts, and the vendor list from QuickBooks Online or Xero. Filter for recurring charges. Add annual renewals that only appear once a year, which are easy to miss. Check Apple and Google app store receipts and any marketplace billing in Microsoft 365 or Google Workspace.

Then add free tools that hold company data. Ask each team lead for anything they log into for work that is not on the list. Sign-in reports in Microsoft Entra ID or the Google Workspace admin console can show which third-party apps staff have connected with their work accounts.

Use a shared spreadsheet with one row per tool. Resist the urge to buy a SaaS management platform for the first audit. A spreadsheet is enough to make decisions, and you will learn what you actually need to track before paying for a tool to track it.

• Vendor and product name
• Monthly or annual cost, and payment method
• Number of paid seats
• Renewal date and notice period
• Business owner (a person, not a department)

Step 2: Check actual usage

For each tool, compare paid seats with active users over the last 60 to 90 days. Most SaaS admin consoles show last login dates. Where they do not, ask the owner. Mark seats belonging to people who have left, people who log in once a quarter, and accounts shared in ways the contract may not allow.

Also note overlap. It is common to find two or three products doing the same job: Zoom and Teams, Dropbox and OneDrive, a standalone scheduling tool alongside the booking feature in your practice software. Overlap is where the bigger decisions come from.

Step 3: Review contracts and terms

Pull the agreement or order form for every tool above a threshold you choose, for example anything over $100 a month. Note auto-renewal terms, notice periods, price increase clauses and minimum seat counts. Put every renewal date in a shared calendar with a reminder 60 to 90 days ahead, which is usually enough time to negotiate or cancel.

Prices and plan structures change often. When comparing alternatives, check current pricing directly with the vendor rather than relying on an old quote or a review site.

Step 4: Check security and data handling

For each tool that holds client or employee data, confirm a few basics: single sign-on or at least enforced multi-factor authentication, the list of admins, whether former employees still have accounts, and where data is stored. If you handle regulated data, confirm the right agreement is in place, such as a business associate agreement for health information under HIPAA.

Accounting and tax firms should check the audit against their written information security plan under the FTC Safeguards Rule and IRS Publication 4557. Law firms should confirm tools that hold client matter data meet their confidentiality obligations.

Step 5: Decide keep, cut, consolidate or fix

Give every tool one of four labels. Keep: it is used, valued and fairly priced. Cut: low usage, no clear owner, or a duplicate. Consolidate: overlaps with another tool and one of them should go. Fix: valuable but badly configured, under-adopted or missing an integration.

The fix category is often the most valuable. A CRM that only two people use properly is not a reason to buy a new CRM. Assign each decision an owner and a date, and schedule cancellations around notice periods. Make sure you export any data you need before closing an account.

The checklist, and keeping it current

If you want something to print and hand to an office manager, this is the condensed version. Work through it in order and do not skip the money step, because people consistently underestimate what they pay for. Expect the first pass to surface a few surprises: a tool nobody remembers buying, an annual renewal that is larger than anyone thought, or a free account holding client files.

Plan for the audit to raise questions you cannot answer immediately, such as whether a tool's data can be exported or whether a contract allows seat reductions mid-term. Log those as follow-ups with an owner rather than letting them stall the whole exercise. The goal of the first pass is a complete, honest picture; refinements can come in the next review.

An audit is only useful if it stays current. Agree a simple rule for new subscriptions, such as a short request to the operations lead for anything over a set monthly cost, and review the inventory every six months. Add tool access to your staff offboarding checklist.

A first audit for a 20 to 60 person firm can usually be done in a few weeks with the inventory spreadsheet and a couple of short interviews per department. When InTheory runs one, the deliverable is a short list of decisions with owners and dates, not a long report.

• Export 12 months of card, bank and accounting transactions and flag recurring software charges
• Add annual renewals, app store subscriptions and marketplace billing
• Ask each team lead for free tools that hold company data
• Record cost, seats, renewal date, notice period and owner for each tool
• Compare paid seats with active users over 90 days
• Note overlapping tools that do the same job
• Pull contracts for tools above your cost threshold and note auto-renewal terms
• Check admin lists, MFA or SSO, and former-employee access
• Confirm required agreements for regulated data
• Label each tool keep, cut, consolidate or fix, with an owner and date
• Add renewal reminders to a shared calendar
• Schedule the next review