SaaS Sprawl Detection and Remediation

The Problem

The problem

The Detection

How you know it is happening

If the institution cannot, in fewer than ten minutes, produce a list of every active SaaS vendor, with named owner, current cost, current utilisation, and next renewal date, the institution is below Best on this capability.

The Outcome

What success looks like

A reconciled vendor master record, refreshed monthly against payment outflows. A renewal calendar with a thirty-day intercept window for every contract. A documented utilisation feed for the top thirty vendors by spend. A measurable reduction in tail spend within two quarters.

Ship It

The steps, in order.

1. I

   Step 01

   Reconcile payments to vendors

   Pull twelve months of accounts-payable outflows tagged as software, cloud, or subscription. Cross-reference against expense card transactions and procurement card statements. Output is a single CSV with one row per vendor, total spend, and number of distinct payments.

   sqlCopy

   SELECT vendor_normalized, SUM(amount_usd) AS spend, COUNT(*) AS pay_count
   FROM ap.payments
   WHERE category IN ("software", "subscription", "saas", "cloud")
     AND date BETWEEN DATE_SUB(CURRENT_DATE(), INTERVAL 12 MONTH) AND CURRENT_DATE()
   GROUP BY vendor_normalized
   ORDER BY spend DESC

2. II

   Step 02

   Assign a named owner per vendor

   For every vendor on the reconciled list, assign a named human owner. No vendor may persist without an owner of record. Where ownership is contested, escalate to the procurement lead or CIO. Stale ownership becomes a control finding.

3. III

   Step 03

   Capture renewal terms and intercept windows

   For the top fifty vendors by spend, locate the active contract, the renewal date, the auto-renewal clause, and the notice period. Build a renewal calendar with a thirty-day intercept window before each renewal. Treat any vendor with a missing contract as a finding.

4. IV

   Step 04

   Wire utilisation telemetry for the top thirty

   For the top thirty vendors by spend, integrate a daily utilisation feed (active seats, active users, last login, feature usage). For tools without an API, accept a monthly export until the API is built. Telemetry without exception is the standard.

5. V

   Step 05

   Score every vendor against TGS:001:2026

   For the top thirty vendors, produce a TGS:001:2026 score covering integration depth, data exit posture, security questionnaire result, and pricing transparency. Vendors below a documented score floor go on a consolidation queue.

6. VI

   Step 06

   Run quarterly tail-spend consolidation

   Each quarter, identify vendors below a spend threshold or below the TGS score floor. Consolidate, renegotiate, or terminate. Document each decision with named approver and dollar impact.

7. VII

   Step 07

   Establish a procurement intercept policy

   No new SaaS purchase, regardless of payment method, may be initiated without an intercept ticket. The policy applies to expense cards, procurement cards, and individual purchase orders. The aim is to reduce, not eliminate, autonomous purchasing while ensuring it is recorded.

The Templates

Templates and starter code

The Evidence

Prove it.

• I

  Reconciled vendor master CSV

  Twelve-month vendor-level reconciliation against payment outflows, with named owner per vendor.

  Sigstore
• II

  Renewal calendar export

  JSON or CSV export of the renewal calendar covering at least the top fifty vendors by spend.

  Sigstore
• III

  TGS scoring sheet

  TGS:001 scorecards for the top thirty vendors, signed by the procurement lead.

  Sigstore
• IV

  Quarterly consolidation log

  Decision log for the quarterly tail-spend review, with dollar impact and approver per decision.

  Recorded

The Impact

What this earns you.

Pair this with

Related playbooks.