IT renewal teardown worksheet

The charge nobody owns

Your predecessor, a board member, a department head or someone who left in 2022 signed the contract. The charge still lands every month. Nobody can name the users, show what it does or say what stops if you cancel.

Put the contract, invoice, console usage, owner and control evidence for each charge into one row. A controller, CFO, executive director or solo IT director can do it in about six hours, over three sittings. Write “unknown” wherever the record is blank.

What a teardown is

A teardown examines each recurring charge against five facts. What does the contract say, and what is the product used for? Is it actually running, what else you own does the same job, and what would leaving cost?

This worksheet will never say twelve tools is too many. Twelve may be right, and eighteen may be defensible in a regulated firm with three offices. It gives no target share of revenue, since no such number survives scrutiny.

It will not push you to cut, either. A product stays when the evidence supports it. A documented keep is worth as much as a cancellation, since you will not argue it again next year.

You need evidence to cut and evidence to keep.

Three sittings

1. Find everything, in about two hours. Judge nothing, and just build the list.
2. Record contracts and usage, in about three hours. This is the real work. Write “unknown” where you cannot answer, and move on.
3. Decide, in about an hour. Give each line one of six decisions, one owner and one date.

Finish the finding step completely first. A teardown that starts from “the tools we know about” only covers the spending already visible.

Part 1: Find every recurring charge

Charges hide in more places than the accounts show. Work all nine sources, since each catches what the others miss.

#	Source	What to pull	What it catches	What it misses
1	Accounts payable	13 months of vendor activity, sorted by recurrence	Invoiced subscriptions, maintenance and support contracts	Card payments and items under a coding threshold
2	Card and ACH statements	13 months, including every line under $500	Small SaaS charges buried in “subscriptions” or “office expense”	Cards you do not control
3	Expense claims	13 months, searched for “subscription”, “annual”, “renewal”, “plan” and “license”	Subscriptions on personal cards	Tools nobody expenses because they are free today
4	Identity provider app list	Every connected and assigned app	Every tool set up with SSO	Tools that never used SSO
5	Public DNS and MX records	The full zone, including TXT records	Mail provider, mail security, marketing tools and every SaaS verification record	Tools needing no DNS change
6	OAuth grants in Microsoft 365 or Google Workspace	Apps with access, grant dates and who granted them	Tools staff connected to company data without a purchase order	Tools with no access to cloud data
7	Marketplace receipts	AWS, Azure, Google Cloud, Apple and Google Play line items	SaaS billed as one opaque line in a cloud bill	Vendors billed directly
8	Vendor mail	Payables and shared mailboxes searched for “renewal”, “auto-renew”, “invoice”, “receipt” and “subscription”	Renewals nobody passed to finance	Mail sent to a departed person’s mailbox
9	Department heads	”List every tool your team uses that we pay for, and any you think is free”	The gap between what is paid for and what is used	Nothing, if you ask everyone

Pull 13 months, not 12. A yearly charge from 12.5 months ago falls outside a 12-month pull and is the likeliest to renew unnoticed.

Match payables against SSO

Cross the identity provider’s app list with the payables and card lists. Three cases appear.

Case	What it means
In SSO and on an invoice	Normal, so go on to the worksheet
In SSO, with no invoice	Either truly free, or someone else pays. That is the hidden subscription, often a personal card claimed as a meal or office cost. Ask the person named in the OAuth grant
On an invoice, missing from SSO and the app list	Often a tool nobody has opened in a year, and often one with standing access to your data

Check one more thing once. Does each subscription’s account recovery address still exist?

If password resets go to a closed mailbox, you cannot cancel without a vendor support case. Find that out before a renewal, not during one.

Part 2: Sheet 1, contract terms

One row per recurring charge. Fill it from the contract and invoice, never from memory or the vendor’s website.

Line	Vendor	Product	Yearly cost	Billing frequency	Term end	Auto-renews	Renewal length	Notice days	Notice method	Decision date	Seats billed	Owner	Where the contract is
1
2
3

• Yearly cost. Annualise everything billed separately, including platform fees, seats, support tiers, overages and setup still being paid off.
• Term end. Take it from the order form. If the form gives a start date and length, work out the end date and write it.
• Auto-renewal and renewal length. It is nearly always yes, but write it anyway to make yourself look. A one-year contract renewing into three years is a different deal from one renewing yearly.
• Notice period. The days before term end by which you must give notice to stop renewal, often 30 to 90. Some contracts need notice before the final quarter begins.
• Notice method. It may be email to a named address, a portal ticket, certified mail or a legal address. A cancellation sent the wrong way was never sent.
• Owner. A named person, never a department. If no name fits, record that as a finding.
• Where the contract is. The file path or system holding the signed order form. Most organisations cannot find a third of theirs.

Work out the decision date

This is the most valuable step in the whole worksheet, and it is clerical.

1. Use the order form, not the proposal. The proposal is marketing, and the order form is what was signed.
2. Follow the incorporated terms. Most one-page order forms incorporate a master agreement or online terms. The term, renewal and notice language sits there under a heading such as “Term and Termination”. Vendors update linked terms, so save a dated PDF of today’s version.
3. Diary the decision date. Take the term end, subtract the notice period, then subtract fourteen days of working room. Put it in a shared calendar with the owner’s name in the title. Windows get missed when people diary the renewal date instead.
4. If the terms are missing, ask in writing. “Please confirm our term end date, renewal length, the notice needed to prevent renewal, and the notice method.” Keep the reply as your record.

Then sort by decision date, earliest first. Anything due within 60 days goes first whatever its size, since only those lines lose options by waiting.

Part 3: Sheet 2, use and evidence

One row per line, matched to Sheet 1 by number.

Line	Need or control served	Seats billed	Accounts that exist	Active in 90 days	Proof it works	Proof date	Overlaps with line	Integration cost	Exit cost, known	Exit cost, staff hours	Exit cost, unknown	What the adviser earns
1
2

Write the control served first

Write one sentence on what the product does for the organisation. Phrase it as an obligation or business need, not a product category.

“Endpoint security” is weak. “Detects and isolates attacks on 196 devices, and answers the EDR question on our insurance form” is strong. “Holds the evidence package our auditor needs in November” beats “compliance platform”.

If nobody can write the sentence, the line is in trouble. Write “unknown” and settle it in the decision step.

Seats billed against people using them

Take three numbers from three places. Seats billed comes from the invoice, not the contract or the console. Accounts that exist come from the admin console’s user export.

Active in 90 days comes from that export, filtered by last activity. Thirty days is too short for seasonal or quarterly work.

Then look for five patterns.

Pattern	How it shows	What to do
Disabled accounts still billed	The console shows them disabled, but the invoice count is unchanged	Reconcile at renewal, since many vendors bill provisioned seats
Leavers never removed	Last activity before a known departure	Remove them now, for security as much as cost
Shared accounts	”frontdesk”, “scanner” or “info”	Decide whether each is needed, and who owns it
Seats for a finished project	A block created on one date and never used since	A candidate for reduction
Growth the invoice missed	More active accounts than seats billed	Fix it before the vendor’s audit clause does

Check the true-down rules before planning a cut. Many contracts allow fewer seats only at renewal, with notice. Some forbid cuts during a committed term, and a few allow cuts only to a stated floor.

A licence is not a control

A licence is a permission. A control is something that operates, and the gap between them is where “is it even working” lives.

Ask one question that is hard to fake. Can someone show an artefact from the product itself, dated within 90 days, showing it did something?

Product	Proof that it works	Proof of nothing
Endpoint detection	Enrolled devices against all known devices, with dated detections or policy changes	A licence count
Backup	A restore test showing what, when, how long and who checked	A green job dashboard
Email security	A block or quarantine report for a named period, with volumes	The vendor’s global catch rate
MFA	The policy export, with scope and every exclusion	One user’s sign-in screenshot
Logs or SIEM	Volume by source, and when a person last looked and what they did	Logs being collected
Vulnerability scanning	The latest dated scan, with fix status	A licensed, scheduled scanner
Compliance or GRC platform	The current evidence package and the last login date	The rollout plan

Write the artefact and its date in the sheet, or “no evidence on record”. That is a real finding, and the most useful one this worksheet produces.

A missing artefact does not prove a tool is idle. It proves nobody checked. And a tool running perfectly while serving no named control can still be retired.

Two tools doing one job

Overlap is common and not always waste. Two products can cover one category at different depths for good reason.

It becomes waste when the second serves no control the first does not already meet. Compare the control sentences, never the product categories.

Common pair	The question that settles it
Your mail platform’s filtering and a separate mail gateway	Run both for 30 days and compare what each caught that the other missed
Built-in endpoint protection and a purchased detection product	Does either deliver triaged alerts to a person?
Identity provider MFA and a standalone MFA product	Is there a system the identity provider cannot cover, and is it still used?
Vendor-included SaaS backup and a third-party SaaS backup	Compare retention, deletion protection and restore detail against your actual duty
Two remote support tools	Which does the IT firm use, which do staff use, and is either needed?
A password manager and the identity provider’s vault	Which holds the credentials that matter, including emergency accounts?
A VPN and the product bought to replace it	Was the VPN ever switched off?

The last pair is the most common overlap of all. A replacement is bought, the move stalls at eighty percent, and the organisation pays for both indefinitely. Look for it by name.

Integration cost

Record what it took, or would take, to fit the product in. That covers SSO, directory sync, log forwarding, ticketing, agent rollout and the staff hours spent. High integration cost argues against replacing a product that works, and against adding one that duplicates it.

Part 4: Price the exit

Exit cost is guessed more than any other figure, and wrongly both ways. Vendors overstate it at renewal, and annoyed buyers understate it. Split it into three columns, as a board memo does: known dollars, staff hours and unknowns.

Part	Where the number comes from
Remaining committed term	The order form. Eight months into a 36-month term is contractual, so check it first
Early exit fee	The termination clause. Some have none, and some charge all remaining fees
Data export	Whether you can export, in what format, and how long before deletion. Ask in writing and keep the answer
Retention duty	Records you must keep need a new home that meets the duty
Integration teardown	SSO, directory sync, log forwarding, ticketing hooks and removing agents from every device
Paying for both	The overlap period, usually 30 to 90 days, so budget for it
Migration and retraining	Staff hours, outside help and retraining time for each person. Be honest, since internal hours come out of someone’s week
Bundle effects	Removing a discounted product may raise the price of the rest. Ask for unbundled prices
The control gap during the move	What covers the control while you switch, and for how long. It has no dollar figure, so describe it under unknowns

A single exit number with no breakdown is an opinion. Three columns make it a finding that survives a budget meeting.

Part 5: Who earns money from the renewal

Every line has a recommender, such as an IT provider, broker, consultant, reseller or someone inside with a preference. Record how that party is paid on the line. Ask in writing, plainly.

For each product on the attached list, please state what your firm earns from our purchase or renewal. Please cover margin, commission, rebates, market development funds, partner tier credit, referral fees and any other compensation. Please give the approximate amount or percentage.

Record the answer, the date and who gave it.

A paid recommendation can be entirely right, and this column is not an accusation. It changes the burden of proof. A recommender paid on the purchase needs an independently stated requirement before the line moves on.

Rebates and partner tier credits are usually invisible to buyers and often the largest part. Ask for them by name, since someone can truthfully deny “commission” while earning a tier rebate.

A firm with no vendor income loses nothing by saying so in writing. A refusal to answer is itself an answer, so record it.

Part 6: Running things past their support date

Some recurring costs are not subscriptions. They are the cost of running something past its support date, and each gets its own line and decision.

Windows 10 support ended on 14 October 2025, with no more help, updates or security fixes. Commercial Extended Security Updates start at US$61 per device in year one and double each year.

That doubling matters for a budget. A device on ESU costs more each year on a known curve. You can compare that directly with replacing or repurposing it.

Field	Entry
Devices on Windows 10
Devices enrolled in ESU
ESU cost in year one
ESU cost in year two, doubled
ESU cost in year three, doubled again
Devices that can be replaced, with cost
Devices that cannot be replaced, why, and the controls around them
Owner and target date

Use the same layout for any unsupported item. Examples are an old business app, a firewall past its last firmware, an ageing server or an unpatched phone system. These items also appear on insurance forms and client questionnaires, so the work gets reused.

Part 7: Sheet 3, the decision

Every line gets one of six decisions, including the lines you keep.

Decision	Use it when	The row must hold
Keep	The control sentence is written, evidence is current, use matches billing, and nothing you own does the job	The evidence, its date and the next review date
Renegotiate	The product earns its place, but the price, term, seat minimum, auto-renewal or notice terms do not	The terms you want changed, the decision date and your walk-away point
Reduce	The product earns its place at a lower quantity or tier	The target quantity, the true-down rule and the notice date
Replace	The control is still needed, but this product fails it or something owned meets it	The control to keep, the replacement, the overlap period and the exit cost line
Retire	The control is no longer needed, or something already paid for meets it	Evidence it is covered or unneeded, and who accepted any remaining risk
Defer for evidence	You cannot decide because the evidence does not exist yet	What evidence, who produces it and by when, before the decision date

The last decision carries the whole sheet. A defer without named evidence, an owner and a date is a renewal with extra paperwork.

Each deferred line needs a trigger that will actually fire, dated before the contract decision date. If that is impossible, deferral is not available, and you must decide on the evidence you have.

Line	Vendor	Decision	Reason in one sentence	Evidence relied on	Owner	Action date	Yearly effect	Reviewed by

Part 8: Four worked decisions

This example is fictional. Every number is illustrative, not a benchmark. The firm is a 90-person professional services firm with two offices, one IT person and an outsourced provider.

Line 12, endpoint detection and response

Field	Entry
Yearly cost	$34,200
Term end, notice and decision date	31 March 2027, 60 days, 15 January 2027
Control served	Detects and isolates attacks on 196 laptops and servers. Answers the EDR question on the insurance form and two client questionnaires
Seats billed, accounts and active in 90 days	196, 196 and 191. The gap is 3 spare laptops in storage and 2 meeting room machines
Proof it works	A console coverage report 12 days old, and three detections in 90 days, each with a ticket and closing note. The policy changed six weeks ago
Overlap	Built-in antivirus is present, but it sends no triaged alerts to the provider, and the purchased product does
Exit cost	$0 termination, 60 staff hours, and an unknown gap in detection during a move
What the adviser earns	The provider confirmed in writing in June 2026 that it earns a 12% margin on this renewal

Keep. The control sentence is written, the evidence is current and independent, and the seats reconcile. The margin is recorded and changes nothing, since the evidence came from the console, not the provider. Review again in December 2026, before the January decision date.

Line 27, password manager

Field	Entry
Yearly cost	$8,400 for 140 seats
Term end, notice and decision date	1 November 2026, 45 days, 3 September 2026
Control served	Stores shared credentials for 31 client portals and the identity provider’s emergency account
Seats billed, accounts and active in 90 days	140, 118 and 84
Proof it works	The vault log shows daily use by 6 teams. The emergency entry was opened and resealed in a documented May 2026 test. Cuts are allowed only at renewal, with 45 days’ notice, to a floor of 50 seats

Reduce. Cut to 95 seats, saving about $2,700 a year in this illustration. The product works and the evidence is strong, but the seat count dates from a 2023 headcount. Notice must go by 3 September, or 140 seats renew for a year.

Line 31, a second email security gateway

Field	Entry
Yearly cost	$11,900
Term end, notice and decision date	15 February 2027, 30 days, 2 January 2027
Control served	Attachment and link filtering on inbound mail, bought in 2021
Proof it works	A 90-day quarantine report shows 31 messages held
Overlap	A 2024 mail platform upgrade added attachment detonation and link rewriting, already paid for. A review of the 31 held messages found all 31 also flagged by the included tier
Exit cost	$0, 12 staff hours to change mail routing and MX, and no material unknowns

Retire. Retire it at term end, after a documented 30-day side-by-side check across a full period. The controller owns that check. It saves $11,900 a year in this illustration.

A tier upgrade bought three years later made the older purchase redundant. Nobody re-examined it, because nothing forced them to.

Line 44, compliance evidence portal

Field	Entry
Yearly cost	$19,500
Term end, notice and decision date	1 December 2026, 60 days, 18 September 2026
Control served	Unknown. Bought in 2024 for a client-driven audit, and its owner left in 2025
Seats, accounts, activity and proof	25 billed, 25 existing and 0 active, with the last login 14 months ago. The library holds 40 documents, all from 2024
Relevant fact	An audit is set for November 2026

Defer for evidence. The evidence needed is the auditor’s written answer on whether the package must come through this platform or as files. The controller owns it, due 5 September 2026, before the 18 September decision date.

If files will do, the line becomes retire that day. If the platform is required, it becomes keep, with a named owner before renewal.

The four together

Line	Decision	Yearly effect, illustrative
12, endpoint detection	Keep	$0
27, password manager	Reduce	($2,700)
31, mail gateway	Retire	($11,900)
44, compliance portal	Defer, settled by 5 September	$0 to ($19,500)

Four lines gave four outcomes and not one purchase, the usual shape of a first teardown. The savings came from a drifted seat count and a product made redundant by one already owned. The largest line was kept because the evidence supported it.

Part 9: Where to start

• Work the nearest decision dates first. Handle anything within 60 days this week, whatever its size.
• Take the free cuts before buying. Seat true-downs, removing leavers and retiring a product replaced by one you own need no capital.
• Chase the “no evidence on record” rows. Ask each owner for the artefact by a date. Most resolve in two weeks, and the rest are telling you something.
• Write the keeps down properly. A documented keep stops next year’s argument. It also answers much of a client questionnaire and the insurance form’s controls section.
• Set the calendar. Every line gets a decision date in a shared calendar with a named owner. This habit prevents more waste than any buying policy.
• Ask your renewal adviser one question. After you present the teardown, ask which lines they would have flagged and why they did not. The answer shows what kind of relationship you have.

Keep each row with the renewal approval

This worksheet is general guidance on examining recurring IT costs and contract terms. It is not legal or accounting advice, and it does not interpret your contracts.

Termination rights, auto-renewal enforcement and notice rules vary by contract wording and state. Have counsel review any termination or non-renewal notice before you send it. That matters most where an early exit fee or multi-year commitment is at stake.

SBK will give a second opinion on one renewal. Call (718) 407-4169.