Your SaaS stack is a liability — how to audit it in one afternoon

Technology adoption in professional services firms has a predictable pattern. An individual discovers a useful tool — a project management app, a document sharing service, a scheduling tool — and starts using it. It spreads to the team. Within six months it is embedded in workflows, processing client data, and generating costs that appear on a dozen different credit card statements from a dozen different employees. Nobody in IT or compliance approved it. Nobody knows it exists. And nobody has a DPA with the vendor.

Repeat this pattern forty or fifty times and you have the typical SMB SaaS stack in 2026: a sprawling collection of tools that individually seem harmless, collectively represent a significant data exposure, and nobody has a complete picture of. The 2025 Zylo SaaS Management Index found the average 500-person company manages 269 SaaS applications — but employees self-report using significantly more tools than IT knows about, because a substantial portion of SaaS adoption happens outside any procurement or approval process.

For law firms, accounting practices, financial advisers, and consultancies — firms that handle client confidential data, personal financial data, or regulated information — this is not an operational inconvenience. It is a compliance and security liability that is growing every month that the inventory is left unmade.

This article gives you a practical, one-afternoon process for auditing your SaaS stack, scoring the risk of each tool, and making rational decisions about consolidation and remediation. You don’t need a security team. You need a spreadsheet, a few hours, and the willingness to ask uncomfortable questions.

Step 1: Build the inventory (60 minutes)

The first step is the most important and the most frequently skipped: getting a complete list of every SaaS tool your firm actually uses, not just the ones IT knows about. These are different lists. Getting to the real list requires checking in more places than most people expect.

Compile everything into a spreadsheet. For each tool, record: tool name, vendor, primary user or owner, estimated number of users at your firm, monthly cost (if known), and a brief description of what it’s used for. Don’t worry about risk scoring yet — just get everything into one place first.

Step 2: Classify by data type (30 minutes)

Not all SaaS tools are equally risky. A subscription to a read-only market data feed is materially different from a CRM containing client contact details, matter notes, and financial positions. The risk of a given tool is driven primarily by what data it processes. Your job in this step is to classify each tool on your inventory by the most sensitive data type it touches.

Add the tier classification to each row in your inventory. This step takes 30 minutes for most firms. The output tells you which tools carry meaningful compliance obligations and which can be deprioritised. Focus your remaining effort on Tier 1 and Tier 2 tools.

Step 3: Risk-score each Tier 1 and Tier 2 tool (45 minutes)

For each tool in Tier 1 or Tier 2, answer four questions. Each question is scored as a risk indicator: if the answer is “no” or “unknown”, the tool has an unresolved risk that requires action.

Each “no” or “unknown” answer is a gap. A Tier 1 tool with three or four “no” answers is a high-priority remediation item. Record the score for each tool. You now have a risk-ranked list of your SaaS estate that prioritises action based on actual exposure rather than vendor size or monthly cost.

Common findings at this stage include: a widely used document sharing tool with no DPA, an AI writing assistant that has been granted access to staff email accounts and processes client correspondence, and a project management tool used to track client matters that has never had an access review. These are not unusual — they are the norm in most professional services firms that have not previously conducted this audit.

Step 4: Consolidate and remediate (ongoing)

The output of your afternoon audit is a prioritised action list. The actions fall into three categories: remediate (get the DPA signed, do the access review, document the transfer mechanism), replace (this tool processes sensitive data but can’t pass the four-question test — find an alternative), or remove (this tool is not essential and the risk outweighs the benefit).

The consolidation opportunity is significant. Most firms that complete this audit discover they have multiple tools performing overlapping functions — two document sharing platforms, three project management tools, four different ways of tracking client interactions. Each is a separate vendor relationship, a separate DPA to maintain, a separate access review to run, a separate breach notification chain to manage.

Consolidating from 40 tools to 20 does not just reduce cost — it halves your DPA maintenance burden, halves your access review scope, halves the number of breach notification chains you need to manage, and halves the number of integrations that can fail, leak data, or be exploited. The security benefit of consolidation is often larger than the cost saving.

The platform consolidation case is strongest for the cluster of tools that professional services firms use most intensively: client relationship management, internal messaging, document management, project and matter tracking, invoicing, and time recording. These are the tools most likely to contain Tier 1 data. They are also the tools where a consolidated, compliance-grade platform — with a single DPA, unified RBAC, shared audit trail, and one access review — delivers the most risk reduction per tool replaced.

Building the ongoing practice: from one-time audit to continuous posture

A one-afternoon audit is a starting point, not a destination. SaaS stacks grow continuously — new tools are adopted, integrations are added, staff change roles and accumulate access. The audit you conduct today will be materially incomplete within 12 months unless you build a lightweight ongoing practice around it.

The minimum viable ongoing practice has three components. First, a procurement gate: any new SaaS tool that processes personal data requires a DPA to be in place before it is adopted, not after. This gate does not need to be bureaucratic — most reputable vendors have a standard DPA available on request or on their website. The gate is simply the habit of asking the question before signing up, not after.

Second, a quarterly access review for all Tier 1 and Tier 2 tools. This is a 30-minute exercise per tool: pull the user list, cross-reference against current staff, deprovision anyone who has left or changed roles. Quarterly is the minimum cadence that most regulators consider adequate. Monthly is better for tools that process financial or health data.

Third, a vendor security notification subscription: sign up for breach and status notifications from every Tier 1 vendor. Most provide these via email or RSS. When a vendor notifies you of a security incident, you have at most 72 hours to assess whether client personal data was affected and notify your data protection authority. You cannot meet that timeline if you learn about an incident from a news article three days later.

These three practices — procurement gate, quarterly access review, breach notification subscription — are sufficient to maintain a defensible compliance posture for a small professional services firm operating a rationalised SaaS stack. They require no dedicated security staff and no specialist tooling. They require only the discipline to make them routine.