The Software You Are Paying For and Nobody Uses

The exercise takes an afternoon and it goes the same way every time. Somebody exports twelve months of card and bank transactions, filters for anything that looks like software, and puts the result on a screen in front of the finance director and the general manager.

There are always more lines than either of them expected. A design tool billed monthly to a designer who left in March. Two products that do the same thing, bought by two departments eleven months apart. A storage subscription at a tier chosen when a project needed it and never reduced. Forty-one seats of the main business system against thirty-three people. And at least one line nobody in the room can identify at all.

None of it was a mistake at the time. Every item was bought by somebody solving a real problem quickly, which is the correct instinct and also the mechanism by which the estate quietly becomes something nobody has an accurate picture of. It is the same blind spot that makes an honest inventory of what you already own the first useful step in almost any systems decision.

Two different problems that arrive together

They get discussed as one and they are not, and the remedies are close to opposite.

Licence waste is money leaving for things you decided to buy and no longer need: seats for departed staff, editions above what anybody uses, duplicate tools, storage tiers set for a peak that passed, annual renewals that fired on a date nobody was watching. This is purely a money problem and it is the easy half.

Shadow IT is software the business is genuinely using that nobody in a governance role knows exists. A team's project tracker. A spreadsheet-plus-add-in that produces a report finance now relies on. A file-sharing account holding customer documents. A messaging group functioning as an approvals queue.

Waste costs money. Shadow IT costs money and holds data, creates dependencies, and moves personal information into places outside the map — which is why a shadow tool holding customer records is a live problem for where personal data actually lives in your estate rather than merely a budget line.

The instinct to treat both as indiscipline and ban them is what makes the second problem invisible instead of solved.

Why shadow IT exists, honestly

Nobody buys a second product to be difficult. Software appears outside the sanctioned estate for four reasons, and three of them are the organisation's fault rather than the buyer's.

The official route was slower than the deadline. A request that takes six weeks to approve, against a need that exists on Thursday, has already decided the outcome.

The sanctioned tool genuinely does not do it. Sometimes the alternative is better for the job. This is worth hearing rather than overruling, because a department that found a better tool has done free evaluation work.

Nobody knew the sanctioned tool could do it. Very common, and it is an internal communication failure, not a procurement one. A large share of shadow purchases duplicate capability the company already pays for.

It cost less than the approval threshold. Modern software is bought at a price that clears every control designed for capital expenditure. Thirty-five dollars a month is invisible to any policy written for purchases above a limit, and forty of them is a real number.

Notice that only the last one is about controls being weak. The other three are about controls being slow or capability being unknown, and no amount of policy fixes those.

Find it from the money, not from the network

There is a category of tooling that discovers software by scanning devices and traffic. It is useful in a large estate and it is rarely the fastest route for a mid-market company, because the definitive record already exists in accounting.

Export twelve months of transactions across the company cards, the bank and the expense claims. Filter for recurring charges — anything appearing three or more times at a similar amount is a subscription, regardless of what the merchant name looks like. Then add three sources the ledger misses: the app store charges on company mobile plans, anything billed annually that will therefore only appear once, and reimbursed personal subscriptions hiding inside expense claims.

This takes an afternoon and it finds nearly everything, because software has to be paid for and payment leaves a record. Network scanning finds what is running; the ledger finds what is renewing, and the renewal is the thing that costs money.

For each line, four columns: what it is, who owns it, how many people use it, and when it renews. The third column is the one that requires asking, and asking is fine — this exercise should not be conducted as an investigation, because a team that thinks it is being audited will not tell you about the tool that matters.

What to do with what you find

Sort every line into four outcomes. Most estates land roughly in these proportions.

Cancel. Nobody uses it, or the person who needed it has gone. Do this immediately, but check first whether it holds data — a cancelled account with the only copy of something is a worse outcome than the subscription.

Right-size. The commonest and largest saving. Seats above headcount, an edition nobody uses the features of, a storage tier set for a peak that ended. Reclaiming these requires nothing but a list of leavers reconciled against a list of accounts, and it is the one line item where the saving is certain before you start.

Consolidate. Two products doing one job. Worth doing and slower than it looks, because the migration cost is real and the decision is political. Do it at the renewal date of the one you intend to drop, not before.

Adopt. The shadow tool that is genuinely better, or that fills a real gap. Bring it inside: a company account rather than a personal one, an owner, a renewal date in the register, a named person who can get the data out. This outcome is the one that makes the whole exercise safe to repeat, because it proves the process is not a hunt.

The account ownership point deserves emphasis on its own. A subscription in an individual's name, on their card, with their email as the recovery address, is a business dependency held by a person who can resign. This is the single most common serious finding, and it is fixed in an hour per account.

The two controls that stop it recurring

Almost every company that does this once does it again three years later, having gained the same amount of waste back. Two things prevent that, and neither is a policy document.

Leaver de-provisioning that includes subscriptions. The offboarding checklist covers email and the main system, and stops there. It should list every product with named seats, and the seat should be reclaimed rather than merely disabled — a disabled account is frequently still a paid one, which is a distinction most administrators do not know their vendor makes.

A renewal calendar with an owner per line. Every subscription has a date on which it silently becomes another year of commitment. A single list, reviewed quarterly by one person, converts every one of those from an accident into a decision — and it belongs alongside the other dates that arrive whether anybody is watching or not.

What does not work is raising the approval barrier. Tightening procurement on thirty-dollar purchases produces more shadow IT, not less, because the need does not disappear when the route does. A fast, low-friction way to register a small purchase — not approve it, register it — gets far better coverage than a control people route around.

The part that is not about money

The saving is what gets the exercise funded and it is usually the smaller benefit.

The larger one is that you now know what the company runs on. Which tool holds the customer list. Which spreadsheet produces the number the board sees. Which account is in a former employee's name. Which product is the only place a certain document exists. That knowledge is what makes every subsequent decision — a migration, an integration, a data request, a disaster — tractable instead of exploratory, and it is the same reason knowing which system is authoritative for a given fact is worth more than any individual system.

An estate nobody has mapped is not merely wasteful. It is one where the answer to any question that matters begins with several weeks of finding out, and where mapping it is a normal part of an independent look at what is actually running.

The short version

Software waste and shadow IT arrive together and need opposite treatment: the first is money to reclaim, the second is capability to bring inside.

Find both from the accounting ledger rather than the network — twelve months of card, bank and expense transactions, filtered for anything recurring, plus the annual charges that appear only once. Four columns per line: what, who owns it, how many use it, when it renews. Sort into cancel, right-size, consolidate, adopt, and move every personal-name subscription onto a company account before anything else.

Then make it stick with two mechanisms rather than a policy: subscriptions on the leaver checklist with seats reclaimed rather than disabled, and a renewal calendar with a named owner reviewed quarterly. Do not tighten the approval threshold — that produces more shadow IT and less visibility, and visibility, not the saving, is what the exercise is actually for.