How to Perform a SaaS Spend Audit for Small Businesses (Step-by-Step)

A SaaS spend audit is a structured review of every software subscription your business pays for: what each one costs, who owns it, who actually uses it, what it duplicates, and when the contract renews. For a small business, this is rarely a finance exercise alone. Subscriptions are bought by whoever needs them, on whichever card is nearest, and the accumulated result is a stack that nobody has ever seen in one place.

This guide is a working method rather than a summary. It walks through each stage of an audit in the order that produces usable answers: define the scope, build a defensible inventory, gather billing and contract evidence, prove utilisation from admin data, look for functional overlap, review seats and plan levels, check the security and identity implications, verify the invoices, and only then make decisions. It closes with the negotiation preparation, the implementation sequence, and the ongoing governance that stops the same drift from returning.

A structured SaaS audit can identify unused licences, overlapping tools, plan levels above what the team needs, seats belonging to people who have left, and contracts that deserve renegotiation before they roll over. What it produces for any particular business depends entirely on that business’s contracts, headcount and usage patterns, so this article deliberately publishes no savings figures, benchmarks or expected outcomes. Atlas assessment: a spend audit that promises a number before it has read your invoices is selling a result, not performing an audit.

What a SaaS Spend Audit Actually Is

A SaaS spend audit has three deliverables. The first is an inventory: one row per subscription, with an owner, a purpose, a plan level, a seat count, a renewal date and a cost. The second is an evidence layer: the invoice, the contract or order form, and the admin-console export that shows who signed in and when. The third is a decision record: for each subscription, a chosen action, the reason for it, the person accountable for executing it, and the date it takes effect.

Anything less than those three deliverables is a spreadsheet exercise. The inventory alone tells you what you buy but not whether it is used. Usage data alone tells you what is idle but not what you are contractually able to change. The decision record is what converts the analysis into cancelled trials, reclaimed seats, downgraded plans and renegotiated renewals.

It also helps to be clear about what a SaaS audit is not. It is not a security assessment, although it surfaces security findings and should feed into one. It is not a procurement policy, although it usually exposes the need for one. And it is not a tooling purchase: a small business can complete a first audit with a bank statement export, the admin consoles it already pays for, and a single shared spreadsheet.

How it differs from a general expense review

A general expense review asks whether a charge was legitimate and correctly coded. A SaaS audit asks harder questions that a bookkeeping process cannot answer: is this subscription still doing a job that the business needs, is the plan level matched to how the team works, is the seat count matched to headcount, and does the contract let you change any of that at the next renewal date. Two subscriptions can be identical on the ledger and completely different once you read the order form.

Why Small Businesses Need One More Than Large Ones

Large organisations usually have procurement gates, a software asset register and an identity platform that records every application login. Small businesses typically have none of those, which means the three mechanisms that quietly inflate SaaS spend all operate unchecked.

• Decentralised buying. Subscriptions are started by the person with the problem, often on a personal or company card, without a record of the business purpose or the renewal terms.
• Headcount drift. Seats are added when people join and are rarely removed when they leave or change roles, because the offboarding checklist does not enumerate every application.
• Automatic renewal. Subscription billing is designed to continue by default. A monthly plan renews silently; an annual plan renews on a date nobody has diarised.

Vendor documentation shows how much of this is structural rather than accidental. Google documents two distinct payment plans for Workspace, a Flexible plan billed for the users you have and an Annual/Fixed-Term plan with a commitment for the term, and the commercial consequences of the choice are set out in its own admin help article. Microsoft documents its own separate processes for adding licences and for cancelling a subscription, and notes that what happens on cancellation depends on the subscription and when it was purchased. Neither of those facts is hidden; they simply are not visible to a small business that has never opened the billing section of the admin console.

Access risk compounds the cost problem. An unused subscription with live accounts is not merely wasted money — it is an unmanaged authentication surface. CIS Control 2 treats the inventory and control of software assets as a foundational security control precisely because you cannot protect, patch or decommission software you have not enumerated, and NIST SP 800-53 sets out account management as a baseline control family for the same reason.

Atlas assessment: for a business under roughly fifty people, the strongest argument for an annual SaaS audit is usually not cost at all. It is that the audit produces the first complete list of the systems holding company and customer data, which is the prerequisite for the access reviews, offboarding discipline and vendor questions described in our guide to building a zero trust framework in a small business.

Step 1: Set the Scope Before You Collect Anything

Scope decisions made at the start prevent the audit from stalling halfway through. Four of them matter.

• Time window. Twelve months of billing data is the practical default, because it captures annual renewals, seasonal add-ons and any one-off implementation charges that a three-month window would miss.
• Inclusion threshold. Set a monthly value below which a subscription is logged but not analysed in depth — with one exception: any tool holding customer data, financial data or credentials is in scope regardless of price.
• Entities and cards. List every payment instrument the business uses, including personal cards that are reimbursed and any app-store or marketplace billing, or the discovery step will miss whole categories.
• Ownership model. Decide in advance that every subscription must end the audit with a named internal owner. Rows without an owner are the rows that later renew unnoticed.

Roles should be equally explicit and can be thin in a small team. One person owns billing accuracy and is the only person who touches invoices. One person owns admin-console evidence and access questions. Department leads confirm the business purpose and the features they actually rely on. One decision maker approves cancellations and plan changes, because an audit where five people can each veto a change produces no changes at all.

Step 2: Build the SaaS Inventory From Independent Records

The inventory is the backbone of the audit, and its reliability depends on triangulating several sources rather than trusting any single one. Each source has a characteristic blind spot, and the overlap between them is what makes the list defensible.

• Card and bank statements. The only source that captures subscriptions bought outside any central system. Search twelve months of transactions for recurring merchants, then check for annual charges that appear once.
• Accounts payable and vendor records. Catches invoiced subscriptions and resellers that do not appear as recognisable software merchants on a card statement.
• Identity provider application list. If you use single sign-on, the identity platform’s application inventory is the most accurate record of which applications employees actually authenticate to. Microsoft documents this application management view for Entra ID, and its sign-in logs provide per-application authentication evidence.
• Admin consoles of your core platforms. Google’s Workspace admin console records connected applications and administrative activity in its audit and investigation logs, which surfaces third-party tools that were granted access to company data.
• Email search. Receipts, trial expiry notices and “your plan renews” messages in the finance and owner mailboxes surface subscriptions that no other source records.
• Team confirmation. A short written request to each function for the tools they use daily catches free tiers, browser extensions and anything paid personally, which is where unmanaged data sharing tends to hide.

Record the same fields for every row, because inconsistent fields are what makes an inventory unusable at the second audit: vendor, product, business owner, function, plan level, billing frequency, seats purchased, cost per billing period, renewal or anniversary date, login method (SSO or local password), data sensitivity, and where the contract or order form is stored. Add a free-text evidence column and put the actual source in it — statement line, invoice number, or admin export date.

Two categories are consistently missed. The first is add-ons billed separately from the base subscription, including AI features, extra storage, additional environments and premium support. The second is usage-metered charges, which do not appear as a stable monthly figure and therefore look like noise on a statement. Both belong on the inventory as their own rows, attached to the parent subscription.

Step 3: Assign Ownership and a Written Business Purpose

Every subscription needs two things that no billing system stores: a named owner and one sentence describing the job it does. The owner is the person who answers questions about the tool, approves seat changes and is notified before renewal. The purpose sentence is the test the tool has to pass at every future review.

The purpose sentence has to be specific enough to be falsifiable. “Project management” is not a purpose; “the only system where client deliverable deadlines are tracked” is. The difference matters when you reach the overlap analysis, because two tools with vague purposes always look distinct and two tools with precise purposes often turn out to be doing the same job for different teams.

Expect some rows to have no plausible owner. Those are the highest-value findings of the whole audit: they are usually trials that converted, tools bought for a project that has ended, or subscriptions belonging to someone who has left. Do not resolve them by assigning an owner arbitrarily. Mark them for a cancellation decision and note the access implication if the account still holds data.

Step 4: Prove Utilisation From Admin Data, Not Opinion

Utilisation is the step where audits most often go wrong, because the fastest way to measure usage is to ask people, and self-reported usage is systematically optimistic. Every mainstream business platform publishes admin reporting that answers the question directly, and that data should override opinion in every case where the two disagree.

• Identity provider sign-in logs give per-application, per-user authentication events. Microsoft documents the sign-in log reports available in Entra ID for exactly this purpose, and equivalent identity-side visibility is the reason identity platforms are positioned as an inventory control point.
• Platform activity reports. Microsoft publishes activity reports in the Microsoft 365 admin centre; Google documents audit and investigation logs in the Workspace admin console; Slack documents workspace analytics covering member activity.
• Per-application user administration. Salesforce documents its user licence types, which determines what a given seat can do and therefore whether a cheaper licence type would suffice.
• Last-activity exports. Most per-seat products expose a user list with a last-login or last-active column. Export it rather than reading it on screen, so the evidence is dated and reviewable.

Record three numbers per subscription: seats purchased, distinct accounts that authenticated in the review window, and accounts with no activity in the window at all. Keep the window consistent — thirty days is too short for tools used monthly, and ninety days is a reasonable default for most small business stacks. Note the window in the inventory so the next audit compares like with like.

Feature-level usage matters as much as login counts, because it drives plan-level decisions rather than seat decisions. If the reason you are on a higher plan is one capability — an integration, a permission model, an audit log, a support tier — check whether it is genuinely in use. Vendor pricing pages document what separates tiers; Slack, Google Workspace, Jira, HubSpot, Salesforce, Dropbox, Notion, Zapier, Xero and Okta all publish plan comparison pages, and those pages are the correct reference for what you would lose by downgrading.

Atlas analysis: the two utilisation findings that recur most in small business stacks are seats belonging to former staff on tools outside the offboarding checklist, and a premium plan bought for a capability that a single project needed once. Neither requires sophisticated analysis to find. Both require an export nobody has run.

Step 5: Find Duplicate and Overlapping Tools

Overlap analysis is not a search for identical products. It is a search for two subscriptions where one could do the other’s job well enough that the second is not worth paying for. Group the inventory by function and examine each group.

• File storage and document collaboration — frequently duplicated because a storage subscription persists after the business moves to a suite that includes storage.
• Messaging, meetings and calling — overlapping because suites bundle meeting and chat capability that standalone subscriptions also provide.
• Project and task management — often two systems, one adopted by an individual team, one adopted company-wide.
• CRM, email marketing and forms — overlap grows as CRM platforms add marketing features and marketing platforms add pipeline features.
• Automation and integration — overlapping with native integrations already included in the platforms being connected; our comparison of Zapier and Make for small business automation covers how those platforms differ on operating cost and maintenance.
• Design, documentation and knowledge — commonly duplicated between a dedicated tool and features included in an existing suite.
• Payroll, bookkeeping and HR — overlap between a payroll provider’s included HR features and standalone HR subscriptions; our Gusto and ADP payroll comparison documents where those product boundaries fall.
• Device and endpoint management — overlapping between suite-included management, a dedicated device management product and endpoint security; see our small business device management comparison.

For each overlap, answer four questions before proposing consolidation. Which tool holds the authoritative data? Which one is embedded in an external workflow — a client-facing process, a regulator’s requirement, an integration another system depends on? What would migration actually involve, including data export format, historical records and retraining? And is the surviving tool’s plan level sufficient once the extra users arrive, or does consolidation push you into a higher tier that erases the reason for consolidating?

That last question is the one most consolidation exercises miss. Because per-seat pricing tiers step up at specific feature and volume boundaries documented on vendor pricing pages, moving a team onto the surviving tool can change its plan requirement. Check the pricing page for the target tool before deciding, and record the result in the evidence column.

Atlas assessment: overlap is worth resolving when the duplicate tool is genuinely idle, when the two tools split a single dataset in a way that causes rework, or when the duplicate is an unmanaged access path into company data. Overlap that annoys a spreadsheet but works fine for the team that relies on it is usually not worth a migration.

Step 6: Review Licences, Seats and Plan Levels

Seat and plan review is where most of the mechanical work of an audit sits, and it is highly vendor-specific. Three mechanisms determine what you can change and when.

How seat counts behave

Some vendors bill for the seats you have assigned at the time of billing; others bill for a committed quantity for the term regardless of how many are assigned. Slack publishes a Fair Billing Policy stating that you are billed for active members and that a prorated credit is applied when someone you have already paid for becomes inactive, and it documents deactivating a member’s account as the mechanism. Google documents the difference between its Flexible and Annual/Fixed-Term payment plans and how licences are assigned to users. Microsoft documents adding licences to a subscription as a distinct billing action. These are not equivalent models, and assuming one vendor’s behaviour applies to another is the most common seat-review mistake.

How plan levels behave

Plan levels bundle capability, and downgrading is only safe once you know which bundled capability you rely on. Read the vendor’s own plan comparison rather than a third-party summary: Slack, Google Workspace, Jira, HubSpot, Salesforce, Dropbox, Notion, Zapier, Xero and Okta each publish current plan pages. Where a capability you depend on is only available above your current tier, that is a documented constraint to record, not a negotiating position.

How licence types behave

Within a single plan, some platforms have several licence or user types with different capabilities and prices. Salesforce documents its user licence types explicitly. Where such types exist, check whether every user needs the most capable one — read-only, limited-access or platform-only user types frequently cover people who only consume reports.

Step 7: Review Contracts, Terms and Renewal Dates

Contract review determines what the audit is actually allowed to change this year. Read the order form or subscription agreement for every subscription above your inclusion threshold and record five specifics.

• Term end date — the date the current commitment ends, not the date you are next billed.
• Renewal mechanism — whether it renews automatically, and for how long.
• Notice period — the deadline before term end for notifying non-renewal or a change in quantity. This is the single most consequential field in the inventory.
• Quantity commitment — whether seats can be reduced mid-term, at renewal only, or not at all.
• Price change terms — any documented uplift at renewal, and whether your price is locked for the term.

Vendors document the self-serve side of this clearly. Microsoft publishes a cancellation article for Microsoft 365 business subscriptions and notes that the outcome depends on the subscription and when it was purchased. Google publishes cancellation guidance for Workspace and documents how its plans differ in commitment. Zoom publishes billing and subscription documentation in its support centre. Where terms are negotiated rather than self-serve, the answer is in your order form and nowhere else — this article cannot tell you what your contract says, and any public article that claims to is guessing.

Build a single renewal calendar from these fields with two dates per subscription: the term end date and the notice deadline. Put a reminder on the notice deadline, not the renewal date. A renewal you notice on the day it happens is a renewal you have already accepted.

Step 8: Assess the Security and Access Implications

A spend audit produces the best software inventory the business has, which makes it the right moment to answer access questions that would otherwise never be asked. Four checks are worth running against every row.

• Authentication method. Does the tool authenticate through your identity provider, or does it hold its own password? Local passwords mean offboarding requires a per-tool action, which is where lingering access comes from.
• Administrative accounts. Who holds administrative rights, and is that list current? Microsoft’s access management documentation for enterprise applications describes assignment and access review as ongoing administrative work.
• Data sensitivity. Does the tool hold customer records, financial data, credentials or employee data? This determines how much scrutiny a cancellation needs, because data export and deletion have to be handled before access ends.
• Third-party access grants. Which applications have been granted access to your core suite? Google’s audit and investigation logs record this kind of administrative and access activity in Workspace.

Standards guidance is useful here precisely because it is vendor-neutral. The NIST Cybersecurity Framework treats asset identification as the foundation on which protective controls rest, NIST SP 800-53 sets out account management as a baseline control family, CIS Control 2 covers inventory and control of software assets, and CISA’s Secure Cloud Business Applications project publishes configuration guidance for cloud office platforms. None of these require enterprise tooling to apply at small business scale.

Cancellation has its own security sequence, and doing it in the wrong order creates problems. Export the data you are required or likely to need, confirm where it will live, remove third-party integrations and API keys, deactivate user accounts, then close the subscription. Closing the subscription first can remove your own ability to retrieve the data.

Atlas assessment: the access findings from a first audit are usually more actionable than the cost findings, because they can be fixed immediately without a contract conversation. Deactivating accounts for people who have left costs nothing and requires no vendor negotiation.

Step 9: Verify Pricing and Billing Against the Invoice

Billing verification is a separate step from cost mapping, and it is the step most audits skip. The question is not what a subscription costs; it is whether what you are charged matches what you agreed and what you use.

• Quantity check. Does the seat quantity on the invoice match the seats assigned in the admin console? A gap in either direction is a finding.
• Rate check. Does the unit rate on the invoice match the rate in the order form, allowing for any documented uplift?
• Line-item check. Are add-ons, storage, extra environments, premium support and usage charges itemised, and can you attribute each one to a business purpose?
• Currency, tax and fee check. Are taxes and any processing or currency fees expected for your jurisdiction and payment method?
• Duplicate-billing check. Are two accounts for the same product being billed separately — a common outcome when two teams sign up independently, or when a trial account was never merged.

Public pricing pages are the reference for list rates, and vendors publish them for exactly this purpose. What they cannot tell you is your negotiated rate. Where a vendor publishes no figure for the configuration you use, the honest entry in the inventory is Not publicly documented or Contact sales; an estimate entered into a cost model becomes a fact three months later, which is how audits end up producing confident numbers that were never true.

Finish this step by reconciling the inventory total against the general ledger for the same period. If the two do not agree, the difference is either a subscription you have not discovered or a charge that is not what you think it is. Both are worth chasing before you make decisions on the strength of the inventory.

Step 10: Apply a Keep, Downgrade, Consolidate, Replace or Cancel Framework

With evidence assembled, each subscription gets exactly one recommended action. Six neutral outcomes cover every case, and defining them precisely is what stops the decision stage from becoming a negotiation about preferences.

• KEEP — the tool has a named owner, a clear purpose, utilisation consistent with the seats purchased, and a plan level matched to how it is used.
• REVIEW — the evidence is incomplete. Usage data, contract terms or ownership is missing, and a decision would be a guess. This is a legitimate outcome, provided it carries a date and an owner.
• DOWNGRADE — the tool is needed but the plan level, licence type or seat count exceeds documented use, and the vendor’s terms permit a change now or at renewal.
• CONSOLIDATE — another tool already in the stack can do this job at an acceptable cost, and the migration is proportionate to the saving.
• REPLACE — the job is needed but this tool is the wrong fit on cost, capability or access risk, and an alternative has to be selected.
• CANCEL — the job is no longer needed, or the tool is idle, or it has no owner and no purpose that survives scrutiny.

The matrix below is the working format for that decision. It is filled with an illustrative small business stack to show how the columns interact, not as a recommendation about any product: the recommended action for the same product in your business depends on your usage, contract and dependencies. Where a value cannot be known from public information, the cell says so explicitly.

Tool / vendor	Business owner	Primary purpose	Active users	Paid seats	Usage evidence	Functional overlap	Renewal timing	Security dependency	Switching difficulty	Recommended action	Evidence / notes
Google Workspace	Operations lead	Email, identity and document collaboration	Internal data required	Internal data required	Admin console audit and investigation logs	Storage overlaps standalone file service	Depends on Flexible vs Annual plan	High — primary identity and email	High — email and identity migration	KEEP	Plan model and licence assignment documented by Google; contract-specific pricing
Microsoft 365 Business	Operations lead	Office applications and identity	Internal data required	Internal data required	Admin centre activity reports; Entra sign-in logs	Overlaps meetings and storage subscriptions	Contract-specific; cancellation terms documented	High — identity and document store	High — identity and mailbox migration	KEEP	Licence purchase and cancellation processes documented by Microsoft
Slack	Team lead	Internal messaging	Internal data required	Internal data required	Workspace analytics; member activity	Overlaps suite-included chat	Monthly or annual per plan page	Medium — holds internal discussion history	Medium — history export and retraining	REVIEW	Fair Billing Policy documents prorated credit for members who become inactive
Zoom	Team lead	External meetings and webinars	Internal data required	Internal data required	Host activity in account admin reports	Overlaps suite-included meetings	Contract-specific	Low to medium — recordings may hold client data	Low — external participants need no migration	DOWNGRADE	Billing and subscription management documented in Zoom support centre
Dropbox	Operations lead	External file sharing	Internal data required	Internal data required	Team admin activity view	High — duplicates suite storage	Contract-specific	Medium — external sharing links	Medium — link and permission migration	CONSOLIDATE	Current plan tiers published on Dropbox plans page
Notion	Team lead	Internal documentation	Internal data required	Internal data required	Workspace member list and last activity	Overlaps suite documents and knowledge base	Contract-specific	Low — internal content only	Medium — structured content export	REVIEW	Plan capabilities published on Notion pricing page
Salesforce	Sales lead	Customer records and pipeline	Internal data required	Internal data required	User list with licence type and last login	Overlaps marketing platform pipeline features	Contract-specific	High — customer system of record	High — data model and integration migration	KEEP	User licence types documented by Salesforce; pricing page for list rates
HubSpot Marketing	Marketing lead	Email marketing and forms	Internal data required	Internal data required	Seat assignment and publishing activity	Overlaps CRM native marketing features	Contract-specific	Medium — holds contact data	Medium — asset and list migration	DOWNGRADE	Tier boundaries published on HubSpot pricing page
Jira	Delivery lead	Engineering issue tracking	Internal data required	Internal data required	Active user count in site administration	Overlaps general project management tool	Monthly or annual per pricing page	Low to medium — internal project data	Medium — issue history export	KEEP	Plan tiers and user counts published on Jira pricing page
Zapier	Operations lead	Cross-application automation	Internal data required	Internal data required	Task history in account dashboard	Overlaps native integrations and second automation tool	Monthly or annual per pricing page	High — holds credentials for connected apps	Medium — rebuilding automations	REVIEW	Task-based plan structure published on Zapier pricing page
Xero	Finance owner	Bookkeeping and invoicing	Internal data required	Internal data required	User list in account settings	Low — financial system of record	Contract-specific	High — financial records	High — accounting data migration	KEEP	Plan tiers published on Xero pricing page
Okta	Operations lead	Single sign-on and access control	Internal data required	Internal data required	Application and sign-in reporting	Overlaps identity features in existing suite	Contract-specific	High — authentication control point	High — reconnecting every application	REVIEW	Published pricing tiers; enterprise configurations contact sales
Legacy design subscription	No owner identified	Historic marketing asset creation	None recorded in review window	Internal data required	No sign-in activity in review window	Overlaps current design tooling	Contract-specific	Low — archived assets only	Low — export archive and stop	CANCEL	No owner, no purpose statement and no activity; export assets before closing
Duplicate project tool	Single team lead	Team-specific task tracking	Internal data required	Internal data required	Activity limited to one team	High — duplicates company-wide tool	Monthly	Low — internal task data	Low to medium — task import	REPLACE	Function already covered by the company-wide tool at current plan level

Atlas assessment: the matrix is doing its job when several rows read REVIEW rather than a decisive action. An audit that resolves every row on the first pass has almost certainly resolved some of them on assumption rather than evidence.

Step 11: Prepare for Renewal Conversations

Negotiation preparation is an evidence exercise, not a tactic. The strongest position a small business can hold is a documented one, and it comes from the work already done in the audit.

• Your utilisation data. Seats purchased against accounts active in a stated window, exported from the admin console with a date.
• Your term dates. The notice deadline and term end date, so the conversation starts while you still have options.
• The vendor’s own published pricing. Current list tiers for the plan you hold and the plans on either side of it.
• A specific request. A seat reduction, a licence-type change, a plan change, a price lock for the term, or a documented commitment about renewal uplift.
• A genuine alternative, if one exists. Only raise it if you would actually be willing to move; a bluff you cannot execute costs credibility for the next renewal.

Ask for what the vendor can actually give. Self-serve subscriptions generally have no negotiation surface at all — the plan page is the price, and the lever is the plan or the seat count, not a discount. Where a subscription is contracted through a sales process, the negotiable terms are usually quantity, term length, payment timing, the treatment of mid-term additions, and the renewal price. Vendors publish list pricing but not their negotiation limits, so treat every figure you are told about your own deal as contract-specific.

Get every agreed change in writing before the notice deadline, referencing the subscription and the effective date. A verbal assurance about the next renewal is worth exactly as much as the order form it does not appear on. Then update the inventory: the audit’s usefulness next year depends on this year’s decisions being recorded where the next reviewer will find them.

Step 12: Sequence the Implementation

Executing an audit’s decisions in the wrong order creates outages, lost data and reversed changes. A safe sequence groups actions by risk and dependency.

• First, reversible zero-risk actions. Deactivate accounts for people who have left, cancel trials that converted without an owner, and remove add-ons nobody uses. These need no migration and no negotiation.
• Second, licence-type and seat changes. Move users to cheaper licence types where the vendor’s documentation confirms the capability is sufficient, and reduce seats where the billing model allows it.
• Third, plan-level changes. Downgrade where feature use is documented, one tool at a time, with a named person watching for the capability you were unsure about.
• Fourth, consolidations and replacements. These are projects. Each needs an export, a target configuration, a cutover date, a rollback position and a communication to the team that uses it.
• Last, cancellations of data-holding tools. Export first, confirm the export is complete and readable, remove integrations and keys, deactivate accounts, then close the subscription.

Attach a date and an owner to every action, and keep a single change log. Two entries matter most: the date a change takes effect, and the date you verified it actually happened on the next invoice. Unverified changes are the reason a second audit often finds the same finding as the first.

Communicate before you change anything people touch. A plan downgrade that removes a feature one team relies on will be discovered at the worst possible moment if nobody was told. A short note naming the tool, the change, the date and who to contact prevents most of the friction that makes teams resist the next audit.

Step 13: Put Ongoing SaaS Governance in Place

An audit is a snapshot; governance is what stops the stack drifting back. Four lightweight mechanisms carry most of the value for a small business, and none of them requires additional software.

• A purchase gate. New subscriptions require a named owner, a one-sentence purpose, a check against existing tools, and a note of the renewal terms before the card is used. One approver is enough.
• An offboarding checklist built from the inventory. Every tool with local authentication gets an explicit line. This is the single highest-value output of the audit for both cost and access risk.
• A renewal calendar keyed to notice deadlines. Reviewed monthly, owned by one person, with the owner of each subscription notified ahead of their deadline.
• A quarterly access and seat review. Re-run the admin exports for the largest subscriptions only, compare active accounts to paid seats, and act on the gaps. Standards guidance treats access review as recurring work rather than a one-off, and a quarterly cadence is realistic at small business scale.

Keep the inventory as a living document rather than an audit artefact. Its value compounds: the second audit takes a fraction of the time of the first because discovery, ownership and contract fields are already populated, and the only work is verifying changes. Atlas assessment: a maintained inventory and a notice-deadline calendar deliver more durable benefit than any single cancellation decision the first audit produces.

Limitations of a SaaS Spend Audit

This method has real boundaries, and stating them plainly is part of making the audit trustworthy. A published article cannot know the things that determine most of your outcome.

• Your contract terms. Notice periods, quantity commitments, uplift clauses and termination rights are specific to your order form. Nothing here substitutes for reading it.
• Your negotiated pricing. Public pricing pages document list rates. Your rate may differ, and no article can tell you what yours is.
• Your actual utilisation. Only your admin consoles know who signed in and what they used. Every utilisation cell in this article’s matrix therefore reads “Internal data required”.
• Your workflows. A tool that looks redundant on an inventory may be embedded in a client-facing process, a regulatory requirement or an integration another system depends on.
• Your switching costs. Migration effort, retraining, data-format compatibility and historical record retention vary so widely that a generic estimate would be misleading.
• Your security dependencies. A subscription may be the authentication path, audit trail or data store that other controls assume. Removing it can weaken controls elsewhere.
• Your legal and tax position. Termination rights, data retention obligations and the treatment of software costs depend on your jurisdiction and advisers.

An audit also has a measurement limit worth acknowledging: login activity is a proxy for value, not a measure of it. A tool used once a quarter by one person may be more important than a tool everyone opens daily. That is why every decision in this framework requires an owner’s judgement alongside the data, and why REVIEW is a legitimate outcome rather than a failure.

Atlas assessment: treat any universal recommendation about SaaS spend — including a specific action for a specific product — as a starting hypothesis to be tested against your own contracts and admin data. This article’s matrix is a worked example of the method, not a verdict on any vendor.

A Practical Action Plan You Can Start This Week

If the full method looks like more than you can take on immediately, the sequence below produces useful results in the order that requires the least access and the least negotiation.

• Day one. Export twelve months of card and bank transactions and list every recurring software merchant.
• Day two. Add owners and one-sentence purposes. Flag every row that has neither. Those rows are your first findings.
• Day three. Run the user and last-activity exports for your five largest subscriptions and record seats purchased against accounts active in the last ninety days.
• Day four. Locate the order form or subscription page for those five and record the term end date and notice deadline. Build the renewal calendar from those dates.
• Day five. Execute the zero-risk actions: deactivate departed users, cancel ownerless trials, remove unused add-ons.
• Week two. Complete the matrix for the whole inventory, group by function to find overlap, and assign each row one action with an owner and a date.
• Ongoing. Add the purchase gate, extend the offboarding checklist with every locally authenticated tool, and diarise a quarterly seat and access review.

There is no universal answer to what a small business should cut, and this guide deliberately declines to name one. The durable outcome of an audit is not a single cancellation: it is a maintained inventory, a named owner for every subscription, a renewal calendar keyed to notice deadlines, and a documented reason for every tool you keep paying for. Those four artefacts make next year’s review a short exercise instead of a rediscovery.

Adjacent decisions are covered in more depth elsewhere on this site: automation platform operating costs in our Zapier and Make comparison, payroll platform boundaries in our Gusto and ADP comparison, device management in our MDM comparison, and access architecture in our zero trust guide.

Sources

All vendor and standards documentation below was reviewed in September 2026. Pricing and plan pages reflect published list information at that date and may change; negotiated terms are contract-specific and are not published by any vendor.

• Slack — Slack’s Fair Billing Policy (billing for active members; prorated credit when a paid member becomes inactive)
• Slack — Deactivate a member’s account
• Slack — Pricing and plan comparison
• Slack — Workspace analytics
• Google Workspace Admin Help — Compare Flexible and Annual/Fixed-Term payment plans
• Google Workspace Admin Help — Cancel your Google Workspace subscription
• Google Workspace Admin Help — Assign licences to users
• Google Workspace Admin Help — Audit and investigation logs
• Google Workspace — Pricing and plan comparison
• Microsoft Learn — Cancel your subscription in the Microsoft 365 admin center
• Microsoft Learn — Buy licenses for a Microsoft 365 for business subscription
• Microsoft Learn — Activity reports in the Microsoft 365 admin center
• Microsoft Learn — Sign-in logs in Microsoft Entra ID
• Microsoft Learn — What is application management in Microsoft Entra ID
• Microsoft Learn — What is access management for enterprise applications
• Atlassian — Jira pricing and plan comparison
• HubSpot — Marketing Hub pricing
• Salesforce — Sales pricing
• Salesforce Help — Understanding user licence types
• Dropbox — Plans and pricing
• Notion — Pricing and plan comparison
• Zapier — Pricing and task limits
• Xero — Pricing plans
• Okta — Pricing
• Zoom Support — Billing and subscription management
• Google Cloud — Identity and access security overview
• NIST — Cybersecurity Framework
• NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems and Organizations
• CIS — Control 2: Inventory and Control of Software Assets
• CISA — Secure Cloud Business Applications (SCuBA) project
• IRS — Publication 535, Business Expenses
• U.S. Small Business Administration — Stay legally compliant