The SaaS Subscription Audit for Small Teams

A repeatable audit: where to find every subscription you're paying for, which ones are also standing access grants, and what your stack should cost at your head-count.

By the founder — infrastructure engineer, 15 years (bio) · Updated 2026-08-11

Nobody decides to spend $600 a month on software. It accrues. Someone trials a tool for one project and the card keeps getting charged. A departed employee’s Dropbox is still billing. Two people bought two different e-signature products in the same quarter because neither knew the other had. There was never a bad decision — there was just never an owner of the list.

This is the audit that produces the list. It takes about two hours the first time and twenty minutes a year after that.

What this is and isn’t: a process you run against your own accounts, not a survey of what other businesses pay. The cost benchmarks below are verified list prices from vendors’ own pages, dated. We don’t know your stack, and any number we quote for it would be invented — the point of the audit is that you produce the numbers.

Step 1 — find everything

Most audits fail here, because people check the obvious source and stop. Work all six.

Card and bank statements, thirteen months back. Not three. Annual renewals are the ones that hide, and a twelve-month window can miss a renewal entirely depending on where you start. Thirteen guarantees you see every annual charge at least once.

Your inbox. Search for receipt, invoice, your subscription, payment successful, and renews on. This catches anything paid by a method that isn’t the company card — a personal card that gets expensed, or PayPal.

Personal app store subscriptions. Business tools bought through the App Store or Google Play bill to an individual’s Apple or Google account and never appear in your accounting at all. Ask each person to check their own subscriptions page. This is consistently the source that surprises people.

Your identity provider’s third-party app grants. In Google Workspace: Admin console → Security → Access and data control → API controls → Manage third-party app access. In Microsoft 365: Entra admin centre → Enterprise applications. Every entry is something somebody connected to your company data with a “Sign in with Google” button. Many are free tools, which is exactly why they never showed up in a financial audit.

Your password manager. If you use one properly, the vault is closer to a real inventory than your accounting is. Sort by date created and read down the list.

Your DNS records. Open your domain’s DNS and read the TXT records. Verification strings are fossils — each one is a service that at some point asked you to prove you owned the domain. Some belong to tools you stopped using years ago, and the record is the only remaining evidence you ever signed up.

Put every finding in one table with five columns: tool, what it’s for, who owns it, how it’s paid, and what it costs annually. That table is the deliverable. Everything after this is reading it.

If you’d rather not build it from scratch, our SaaS account inventory template is a free CSV with the columns already set up, including the ones this audit is about to ask you for.

Step 2 — the column most audits leave out

Add a sixth column: what does this have access to?

A subscription audit is usually framed as a cost exercise. It’s also an access review, and treating it as only the first is how small teams end up with forgotten integrations holding live tokens into their email and files.

For each line, note whether it holds a standing OAuth grant into your email, calendar, files, or CRM. Those are the ones where cancelling the subscription isn’t sufficient — the grant survives the billing relationship. You have to revoke it separately in the admin console above.

Two findings tend to fall out of this column:

Tools nobody uses that still have full access. The trial from eighteen months ago that read your entire Drive. Free tier, so it never appeared on a statement, and the token is still valid.

Subscriptions in a former employee’s name. These are worse than the money. The account recovery email is a mailbox you no longer control, which means you can’t cancel it, can’t change the payment method, and can’t get the data out. If you’ve had anyone leave, our former-employee access guide covers the full sequence — this audit is where you find out what you missed.

Step 3 — decide, one line at a time

Four questions per row, in order. The first “no” is your answer.

The consolidation rule is the one people get wrong. When two tools overlap, the instinct is to keep whichever is technically better. Keep whichever your team already uses, unless the gap is severe — a migration nobody wanted costs more than the feature difference is worth, and half-finished migrations leave you paying for both.

Where the money actually turns out to be

From the 20 products we track, all prices checked 2026-07-30:

Monthly billing, on tools you’re going to keep anyway. This is the largest recoverable line in most audits and the easiest to fix. The spread is much wider than most people assume:

Switch to annual only on tools that survived Step 3. Paying a year up front for something you’re about to cancel is how an audit loses money.

Seat minimums you don’t meet. Keeper Business Starter, NordPass Business and IDrive Team all start at 5 seats; Proton Pass starts at 3. A three-person firm on a five-seat minimum is carrying 67% overhead on that line. Sometimes unavoidable — but if two products are otherwise close, the one without a floor is cheaper at your size and stays cheaper.

Per-device lines you counted as per-person. Backup is usually priced per device, not per user — Backblaze Business Backup at $8.25/computer/month, Acronis True Image at $72.99/computer/year. Anyone with a laptop and a desktop is two lines. When you model a hire you add seats; when you buy hardware, these move too, and forecasts routinely miss it.

Included seats you’re paying past. Per-organisation products bundle a few users and then charge for extras at a different rate: Zoho Books Standard includes 3 users then $2.50 each, SignWell Business includes 3 senders then $12 each, FreshBooks Lite includes 1 then $11 each. Check whether your extra seats are real people or leftovers.

A benchmark, once you have your number. A complete six-category stack — email, passwords, backup, CRM, accounting, e-signature — priced from vendors’ own pages comes to $58.25/month solo, $216.25 at five people, $395 at ten, $931.25 at twenty-five. Per person that’s $58.25, $43.25, $39.50, $37.25. If you’re materially above the figure for your head-count, the audit will usually find overlap or an outgrown tier rather than one expensive mistake. Full workings are in what a small team actually pays for software, and the cost calculator will price your own stack against it.

Two things that will trip you up

Annual-only vendors give you one chance a year. Six of the 20 products we track bill annually only — 1Password, Bitwarden, Keeper, Dashlane, Acronis and Microsoft 365 Business Basic. There is no mid-term downgrade on those. If your audit lands a month after renewal, you’re carrying that line for eleven more months. Run the audit 60 days before your largest renewal, not whenever it occurs to you.

Cancellation is not always self-serve. Some vendors make you email support or sit through a retention call, and a cancellation you started but didn’t finish still renews. Get written confirmation, and diarise a check the day after the renewal date to confirm no charge landed. How hard a product is to leave is a real cost of owning it, and it’s one of the things we time in our own testing methodology.

Make it a habit

Twice a year is enough, and the dates matter more than the frequency:

• 60 days before your largest annual renewal — the full audit, all six sources.
• Every time someone leaves — access review only, using the offboarding checklist.
• Every time someone buys a new tool — one row added to the table. This is the step that keeps the next audit at twenty minutes instead of two hours.

The table is the thing. Not the savings from this round — the fact that from now on somebody owns the list.

Pricing figures are verified list prices from each vendor’s official pricing page on 2026-07-30, US pricing, annual-billing rate where offered; see the pricing tracker for sources and check dates. This page contains no affiliate links.