The Shadow Subscription Register: A Quarterly Control for Unlisted SaaS

Third-party SaaS rarely announces itself. It arrives through a design team’s trial, a finance manager’s expense tool, a project group’s whiteboard app or an individual’s spreadsheet workaround. None of that is necessarily misuse. The risk begins when those accounts sit outside the organisation’s identity, procurement and leaver processes. At renewal, the invoice becomes visible; the access and data behind it often do not. For UK SMEs, the practical answer is not a one-off clear-out but a quarterly control: a shadow subscription register that makes unlisted SaaS visible, owned and actionable.

The control objective: no unknown accounts at renewal

The aim is not to eliminate departmental software choice. It is to ensure that every active subscription has a named business owner, a known user population, a documented authentication route, a renewal date and a clear view of the data it holds. That is a governance outcome, not a procurement preference. It gives finance a forward view of renewals, gives IT a route to revoke access and gives the board evidence that third-party spend and data access are being managed.

The register should be treated as a control document. It does not need to become a catalogue of every free tool or browser extension. It should capture services that carry a cost, hold business data, connect to Microsoft 365 or Google Workspace, or require user accounts. Those are the accounts that create renewal exposure and access risk.

Three sources of evidence, used together

A quarterly audit works best when independent sources are reconciled rather than relying on a single list. Three are particularly useful for UK SMEs.

Single sign-on and identity logs. Review the identity provider’s application gallery, sign-in logs and OAuth consent grants. These show which applications are using corporate identities, which users are active and which permissions have been granted. They will not show every locally created account, but they provide a strong baseline for anything integrated with corporate email.

Expense reports and corporate card statements. Filter for software, subscription and recurring payment descriptions. Reimbursement claims often reveal team-level purchases that never passed through IT. Look for monthly patterns, annual renewals and duplicate tools serving the same function.

Browser password managers, under a published policy. A password manager can expose work-related credentials that sit outside SSO. This should not be a covert exercise. Use a sanctioned export process, ask employees to disclose work accounts, or rely on a managed browser vault where one is already in place. The purpose is to identify business accounts, not to inspect personal credentials.

Each source has gaps. SSO misses local accounts; expenses miss free tiers; password managers miss shared service accounts. Used together, they provide enough evidence to build a credible register and a short list of exceptions.

From findings to a working register

Start with a simple spreadsheet or a table in the IT service management tool. For each service, record the tool name, business function, account owner, estimated user count, authentication method, data classification, contract or renewal date, annual cost, integration points and exit route. Add a status field for retain, rationalise, restrict or retire.

The owner is the critical field. An account without a named business owner is an orphaned account, even if someone is still logging in. Ownership should sit with a manager who can confirm the business need, the user list and the renewal decision. IT can maintain the register, but it should not be asked to invent ownership for departmental tools.

Disposition: retain, rationalise, restrict or retire

Every entry needs a decision. Retain means the service has a valid owner, a confirmed user list and a plan to bring it under SSO and procurement where appropriate. Rationalise means two or more tools serve the same purpose and should be consolidated. Restrict means access should be limited to a defined group, with local accounts removed and sharing settings reviewed. Retire means the service should be closed, data exported or deleted, OAuth tokens revoked and billing cancelled.

For orphaned accounts, the sequence matters. Disable access first, then transfer any required data to the business owner, then revoke integrations and close the subscription. Where a renewal is imminent, set a decision deadline at least thirty days before the renewal date so that notice periods and data export can be handled without panic.

A quarterly cadence that survives the diary

A repeatable cycle is more valuable than an exhaustive annual cleanup. Two weeks before quarter end, pull the three evidence sources. One week before quarter end, reconcile them against the register and flag new, changed or unowned accounts. Hold a short review with business owners to confirm dispositions. Update the renewal calendar and report exceptions to the appropriate governance forum.

Useful measures include the percentage of paid SaaS under SSO, the number of accounts without a named owner, renewals discovered after the invoice arrived, duplicate tools retired and estimated annual savings. These measures should be reported alongside the exceptions, not instead of them. The point is to show whether the control is working between quarters.

Embedding the habit

A quarterly audit is stronger when it connects to everyday processes. Add a software subscription field to expense claims so that finance can route new tools to IT for review. Include SaaS ownership in onboarding and offboarding checklists. Require a business owner and renewal date before a new subscription is approved. Publish a short acceptable-use position for browser password managers so that employees know how work credentials should be stored and disclosed.

None of this requires a large IT team. It requires a defined routine, a named owner for the register and the discipline to review evidence before renewals rather than after them. The result is not a perfectly tidy software estate. It is a predictable one, where unknown accounts become known, orphaned access is closed and renewals are decided rather than discovered.