The Register Nobody Owns: Quarterly Housekeeping for Unapproved SaaS in UK SMEs

Shadow SaaS rarely arrives as a deliberate act of defiance. It usually begins with a useful free trial, a departmental tool bought on a card, or an AI assistant added to a browser because it saves ten minutes a day. By the time IT is asked about it, the tool has a team of users, a renewal date and a set of exported documents that nobody has mapped. The result is not necessarily a breach; it is an estate that no one can describe accurately.

A shadow SaaS register is a modest response. It is not a full asset management platform, and it should not become an approval bureaucracy. It is a single list, reviewed quarterly, that records what is in use, who owns it, what data it touches and when it will be reviewed again. For a UK SME, a spreadsheet is usually sufficient. The discipline matters more than the software.

What belongs on the register

Start with tools that hold company data or cost money, even small amounts. Include free trials that have moved beyond a single user, departmental project tools, AI assistants that accept uploaded documents, marketing and analytics services, and any application that connects to email or a finance system. Exclude the core platforms that are already under formal change control unless the register is being used as a complete application inventory.

A workable set of columns is: application name; business function; named owner; account administrator; approximate number of users; cost and renewal date; data classification; authentication method; integration points; free trial or paid; review date; and notes. Add a column for the route by which it was discovered, such as finance ledger, identity review or staff declaration. That last column helps identify which discovery method is working.

Data classification need not be elaborate. Three levels are enough for most SMEs: public, internal and confidential. The question is whether the tool receives customer lists, payroll details, contracts or other material that would matter if it were lost or exported. A project tool that holds only task titles is a different proposition from an AI assistant that has been fed board papers.

Finding the likely culprits without turning the office into a surveillance operation

The finance ledger is the first place to look. Search for recurring card payments, annual subscriptions and software names that do not match the approved list. Include expenses claims, because departmental purchases often arrive there rather than on the company card. Ask the person who reconciles the bank statement to flag anything that looks like software.

The second source is the browser and identity estate. If the firm uses a single sign-on provider or a password manager, review the applications that staff have connected. Do not read individual browsing histories. Instead, ask the identity administrator to export the list of third-party applications granted access to company accounts. This is a legitimate administrative check, and it is less intrusive than monitoring individuals.

The third source is a short staff declaration. Send a one-page form asking each team lead to list tools used by their team that are not on the current register. Make clear that the purpose is cost and data visibility, not punishment. People who fear discipline will hide the tools, and the register will be wrong.

Assign an owner, not a committee

Every entry needs one named owner. The owner is usually the person who uses the tool most or who signed up for it, not the IT manager. IT can advise on integration and authentication, but the business function must own the purpose and the data. For tools with no clear owner, mark them as orphaned and set a short review date. An orphaned tool is a candidate for removal or formal adoption.

Review dates should be realistic. A quarterly cycle is sufficient for most SMEs. Set the next review date at the point of entry, and use a simple status column: retain, review, migrate or retire. The status should be agreed with the owner, not imposed silently.

The 60-minute quarterly process

Keep the quarterly review short enough to survive a busy month. A 60-minute session with one facilitator and the relevant team leads is usually enough.

Minutes 0–10: Refresh the list. Add any new tools discovered through finance, identity or declarations. Remove tools that have been formally retired.

Minutes 10–30: Review the exceptions. Focus on orphaned entries, free trials nearing a paid renewal, tools holding confidential data without a named owner, and applications with no documented authentication method. Do not review every entry in detail.

Minutes 30–45: Confirm actions. For each exception, agree one action and one owner. Typical actions are to cancel a trial, move a tool under single sign-on, export and delete old data, or approve the tool formally and add it to the integration map.

Minutes 45–60: Update the record and set the next date. Record the decisions in the register, not in meeting notes. Publish a short summary to team leads. The summary should state what was retired, what was approved and what will be reviewed next.

Keep the register useful

A register that is never read is worse than no register because it creates false confidence. Link it to the renewal calendar so that finance sees a subscription before it renews. Link it to the integration map so that IT knows which tools connect to customer data. And keep the language plain: the register is there to answer who uses what, why, with what data and until when.

Shadow SaaS is not a moral failure. It is a predictable consequence of small teams solving problems quickly. The register simply brings those solutions into view, once a quarter, before the renewal notice or the departed employee makes the decision for you.