Every company has a SaaS problem. Most don’t know the full extent of it.
It starts innocuously. Someone signs up for a tool to solve a specific problem. Someone else does the same. A contractor brings their preferred platform. A new hire sets up the tool they used at their last company. The credit card gets entered 47 times.
Six months later, nobody has a complete picture of what software the company is actually using, who’s paying for it, or what data it has access to.
This is SaaS sprawl. And it’s a financial, security, and operational problem.
What I Found at a 35-Person Company
I recently completed a SaaS audit at a company with 35 employees. Before I started, the ops lead estimated they were using about 25 tools. The actual number was 47.
Here’s what the audit revealed:
Financial waste:
– 12 tools had company credit cards attached — including 3 where the billing contact email belonged to a former employee who’d left 8 months earlier
– 4 tools were still being paid for that nobody actively used
– 2 tools had overlapping functionality — both being paid for simultaneously
– Total monthly spend: £4,200
– Estimated waste: £1,400/month (£16,800/year)
Security risks:
– 3 tools where company data was stored on a free plan with no Data Processing Agreement (DPA) — a GDPR problem
– 6 tools where the login credentials were shared via a Google Sheet
– 2 tools where the original account holder had left the company, and nobody knew the login
– 8 OAuth connections to Google Workspace that hadn’t been reviewed in over a year
Operational risks:
– 5 tools where only one person knew how to use them — single points of failure
– 2 tools with active data that nobody had thought about migrating if the company switched platforms
The audit took one day. The cleanup took two weeks. The savings paid for both many times over.
#How to Run a SaaS Audit
You don’t need specialised software to do this. Here’s a practical process:
Step 1: Collect data sources
– Ask your finance team for a list of all software subscriptions on company credit cards and invoices
– Ask your IT admin (or Google Workspace admin) to export the list of OAuth applications connected to your email domain
– Ask department heads to list the tools their teams use
– Check your email inbox for software invoices and renewal notifications
– Look at your password manager if you have one — every saved login is a tool
Step 2: Build a master list
Create a spreadsheet with:
– Tool name
– Monthly cost
– Owner (who manages this tool?)
– Users (how many? who?)
– Data stored (what company data does this tool have access to?)
– Last used (when was it last actively used?)
– DPA in place? (for tools that handle personal data)
Step 3: Categorise and decide
For each tool, one of four actions:
– Keep— active, necessary, properly owned
– Consolidate— overlaps with another tool; decide which to keep and cancel the other
– Cancel — no longer used or needed
– Review — unclear ownership or usage; investigate before deciding
Step 4: Remediate
– Cancel unused subscriptions (set calendar reminders before renewals)
– Transfer billing contacts from former employees to current team members
– Review and revoke unnecessary OAuth connections in Google Workspace admin
– Ensure DPAs are in place for all tools handling personal data
– Document ownership for every remaining tool
Step 5: Build a process for the future
The audit solves today’s problem. The process prevents tomorrow’s.
– Create a SaaS request process — no new tool gets set up without approval
– Assign an owner for each tool — someone responsible for its renewal, usage, and security
– Schedule a quarterly SaaS review — 30 minutes to check for anything that’s crept in
The Security Dimension
The financial savings from a SaaS audit are obvious. The security dimension is less visible but equally important.
OAuth connections deserve particular attention. When a team member clicks “sign in with Google” to set up a SaaS tool, they grant that application access to their Google account — sometimes including the ability to read emails, access Drive files, or act on their behalf.
These connections persist even after the original employee leaves, even if the tool is no longer used, and even if nobody remembers setting them up.
A quarterly review of OAuth connections in your Google Workspace admin console takes 30 minutes. It’s one of the most effective security maintenance tasks you can do.
The Bottom Line
SaaS sprawl is universal in companies that are growing fast. The tools accumulate because the team is moving quickly, solving problems, and not thinking about IT governance.
The audit is not a criticism of how the company has operated. It’s a reset — a chance to understand what exists, decide what should stay, and build a process that keeps things manageable going forward.
Want to understand the full picture of your IT environment?
The free assessment at itops.zlefterov.com includes questions specifically about your SaaS management practices.