Why it happens
Tools get bought one at a time by whoever needs them, often on a company card. The person who signed up moves on. The contract has a notice period, commonly 30 to 90 days before the renewal date, and that deadline passes without anyone knowing it existed.
Step 1: Build the vendor list
Pull twelve months of card statements and accounts payable records, and ask each team lead what they use. For every vendor, record:
- What it is used for and which team uses it
- The internal owner
- Annual cost and how it is billed
- Contract start date, renewal date and notice period
- Number of seats paid for and number in use
- Whether it holds customer or employee data
Step 2: Build the renewal calendar
For each contract, put the notice deadline on a shared calendar, not the renewal date. Add a reminder well before it, so there is time to review usage and talk to the vendor.
Step 3: Review before each deadline
- Is it still being used, and by how many people?
- Does another tool you already pay for do the same job?
- Has the price changed?
- Keep, reduce seats, renegotiate or cancel?
Step 4: Control how new vendors are added
A short intake step is enough: who is the owner, what does it cost, when does it renew, and does it touch sensitive data. Add the answer to the list before the purchase is approved.
The same list does double duty
If you are working toward SOC 2, you will need a list of vendors and evidence that you review the important ones. A maintained vendor list covers both.
We build the vendor list, run the renewal calendar and handle the vendor conversations. See vendor management.