This form is designed to help organisations of any size and in any jurisdiction conduct a rigorous annual audit of their software subscriptions, SaaS licences and service renewals. Complete every section as accurately as possible. Mandatory questions are marked and must be answered before submission. Where a question includes follow-up prompts, additional detail will be requested automatically based on your answer. All information gathered here supports cost control, licence compliance, security assurance and informed renewal decision-making.
Tip: gather the latest vendor invoices, contracts, renewal notices and usage reports before you begin. If a figure is an estimate, provide your best approximation and note the assumption in the final notes section.
Has a subscription or software renewal audit been conducted by your organisation before?
Please summarise the key findings and outcomes of the previous audit.
What prompted this audit, and what do you hope to achieve from it?
Will the results of this audit be used to make binding renewal or cancellation decisions within the next 90 days?
By what date must the renewal decisions be finalised?
Provide the details of the organisation and the person accountable for completing and submitting this audit.
Organisation/company name
Department or business unit responsible for this audit
Primary contact person
Job title/role of primary contact
Email address
Phone number
Alternate contact person (if any)
Approximate number of employees in the organisation
Number of departments or cost centres included in this audit
Which area of the organisation owns software subscription decisions?
Central IT
Finance/Procurement
Individual departments (decentralised)
Shared ownership between IT and Finance
External managed service provider
Other:
Is an external auditor or third-party consultant involved in this review?
Please provide the name of the external party and their scope of work:
Defining the scope and methodology ensures the audit is repeatable, comparable year over year, and that conclusions can be traced back to reliable data sources.
Audit reference/ID code
Audit period start date
Audit period end date
Date this form was completed
What type of audit is this?
Full inventory audit
Targeted/sample-based audit
Renewal-focused review
Cost optimisation review
Compliance-driven review
Post-incident review
Other:
What are the primary objectives of this audit? (select all that apply)
Reduce overall subscription spend
Identify unused or underused licences
Eliminate duplicate or overlapping tools
Ensure licence and contractual compliance
Strengthen security and data protection posture
Improve vendor performance and support
Prepare for upcoming renewals
Support budgeting and forecasting
Satisfy internal or external audit requirements
What is the target cost reduction you aim to achieve?
Which compliance obligations or internal policies are you aiming to satisfy?
Which methods were used to collect subscription data? (select all that apply)
Automated SaaS/software asset discovery tool
Finance and expense report analysis
Departmental surveys or interviews
Vendor invoices and contracts
Manual spreadsheet tracking
Identity provider/single sign-on logs
Corporate card and payment records
Other
Please describe the other data collection method used:
How complete is the inventory captured in this audit?
90–100% (near complete)
75–89%
50–74%
25–49%
Less than 25% (early stage)
Were departmental budget holders consulted during the audit?
How many departments or budget holders were consulted?
Why were budget holders not consulted, and what is the plan to involve them?
Record every active subscription, licence and recurring software service. Include shadow IT purchases, free-tier tools with paid upgrades, browser extensions with recurring fees, and services billed to individual departments or corporate cards.
Total number of active subscriptions and software licences identified
How many of these are self-service or 'shadow IT' purchases made outside central procurement?
How many subscriptions are on a monthly rolling plan rather than an annual term?
Does the organisation maintain a central software asset register?
How frequently is the central register updated?
Continuously/in real time
Monthly
Quarterly
Annually
Only when a problem arises
What are the main obstacles preventing a central register from being maintained?
Are free or freemium tools with potential paid upgrades included in the inventory?
How many freemium tools have been identified as potential upgrade candidates?
Software & Subscription Inventory Register
Application / Service Name | Vendor / Provider | Category | Licences / Seats Purchased | Licences Actively Used | Billing Cycle | Auto-Renew Enabled | Next Renewal Date | Annual Cost | ||
|---|---|---|---|---|---|---|---|---|---|---|
A | B | C | D | E | F | G | H | I | ||
1 | Project Management Suite | Northwind Software | Collaboration | 120 | 96 | Annual | Yes | $26,400.00 | ||
2 | Cloud Storage for Teams | Skyvault | Storage | 200 | 182 | Monthly | Yes | $9,600.00 | ||
3 | Design & Prototyping Tool | Pixelworks | Creative | 25 | 11 | Annual | $7,500.00 | |||
4 | ||||||||||
5 | ||||||||||
6 | ||||||||||
7 | ||||||||||
8 | ||||||||||
9 | ||||||||||
10 |
Mapping renewal dates, notice periods and decision deadlines prevents unwanted auto-renewals and creates negotiating leverage. A renewal decision should ideally begin 90 days before the notice deadline.
Earliest upcoming renewal date in the portfolio
Number of subscriptions with automatic renewal enabled
Number of renewals due within the next 90 days
Are renewal reminders or alerts configured for every subscription?
How far in advance are renewal reminders issued?
7 days before
14 days before
30 days before
60 days before
90 days before
More than 90 days before
How does the organisation currently track renewal deadlines, and what improvements are planned?
What is the most common notice period required to cancel without penalty?
No notice required
7 days
14 days
30 days
60 days
90 days
More than 90 days
Varies significantly by contract
Please describe the range of notice periods across your contracts.
Has the organisation ever been unintentionally auto-renewed or charged a penalty for a missed notice deadline?
Please describe the incident(s) and the financial impact.
Is there a documented renewal approval workflow with defined lead times?
How many days before the notice deadline must the approval request be submitted?
I agree that establishing a renewal approval workflow should be a priority action from this audit.
Quantify the total cost of ownership of the subscription portfolio, including base fees, usage overages, support tiers, implementation costs, taxes and internal administration effort. Compare current spend with the budget available for the coming period.
Total annual spend on subscriptions and software
Budget allocated for software and subscriptions for the upcoming year
Percentage of the total IT budget spent on subscriptions (%)
Largest single subscription by annual cost
Reporting currency used throughout this form
Has total subscription spend increased compared with the previous audit period?
What were the main drivers of the increase?
What measures contributed to keeping spend stable or reducing it?
Do you anticipate a price increase at renewal from any vendor?
What is the average expected price increase (%)?
How are subscription payments made?
Centrally by IT or Finance
By individual departments
A mix of central and departmental
Primarily via corporate cards
Through a reseller or managed partner
How do you reconcile and control corporate card subscription payments?
Are there any subscriptions paid for but no longer allocated to a cost centre?
How many orphaned or unallocated subscriptions have been identified?
Spend Analysis by Cost Centre
Cost Centre / Department | Current Annual Cost | Proposed Annual Cost | Variance | Change (%) | Commentary | ||
|---|---|---|---|---|---|---|---|
A | B | C | D | E | F | ||
1 | Information Technology | $125,000.00 | $118,000.00 | -$7,000.00 | -5.60 | Consolidation of two collaboration tools planned | |
2 | Marketing | $48,000.00 | $52,000.00 | $4,000.00 | 8.33 | Additional analytics seats required for new campaign team | |
3 | Human Resources | $22,000.00 | $22,000.00 | $0.00 | 0.00 | No change expected | |
4 | $0.00 | 0.00 | |||||
5 | $0.00 | 0.00 | |||||
6 | $0.00 | 0.00 | |||||
7 | $0.00 | 0.00 | |||||
8 | $0.00 | 0.00 | |||||
9 | $0.00 | 0.00 | |||||
10 | $0.00 | 0.00 |
Low utilisation is the most common source of wasted subscription spend. Assess how well each tool is adopted, whether purchased seats are being used, and whether users are actually benefiting from the capabilities they pay for.
What proportion of purchased licences are actively used across the portfolio?
More than 90%
75–90%
50–74%
25–49%
Less than 25%
Unknown — not measured
Estimated number of unused or dormant licences across the portfolio
Estimated annual cost of unused or dormant licences
Is licence utilisation reviewed on a regular schedule?
How often is licence utilisation reviewed?
Monthly
Quarterly
Twice a year
Annually
Only at renewal time
I agree that establishing a regular licence utilisation review should be a priority action.
Is there a formal process to reclaim and reallocate unused licences?
Please describe the reclaim process and how effective it has been.
What prevents unused licences from being reclaimed today?
Are employees able to request new software without an approval gate?
What controls exist to prevent uncontrolled software purchases?
Which tools are considered business-critical and must not be interrupted? (select all that apply)
Email and calendar
Collaboration and messaging
Project and task management
Customer relationship management
Finance and accounting
Data storage and backup
Security and identity management
Development and DevOps tooling
Design and creative tools
Analytics and business intelligence
None are considered critical
Which project management tool is business-critical?
Which CRM platform is business-critical?
Please rate your level of agreement with the following statements about usage and adoption.
Strongly disagree | Disagree | Neutral | Agree | Strongly agree | |
|---|---|---|---|---|---|
Users have received adequate training on the software they use | |||||
The features purchased are actually being used by teams | |||||
Licence tiers match the real needs of users | |||||
Usage data is available and reliable enough for decision making | |||||
Duplicate tools are being used by different teams for the same purpose |
Overall, how satisfied are you with the current software portfolio?
Renewals are not only a financial decision. Evaluate whether vendors deliver on their commitments, respond effectively to issues, and provide value that justifies continued partnership.
Total number of vendors in the subscription portfolio
Have you experienced significant support or service issues in the past 12 months?
Please describe the issues, the vendors involved, and how they were resolved.
How would you rate your overall support experience with vendors?
Do you consolidate purchases with a small number of strategic vendors?
How many strategic vendors account for the majority of spend?
What are the barriers to consolidating vendor relationships?
Do any vendors provide a named account manager or dedicated support contact?
Which vendors provide dedicated account management?
Has any vendor been acquired, merged, or changed its pricing model during the audit period?
Please describe the change and its impact on cost, service or roadmap.
Please rate the following aspects of vendor performance.
Reliability and uptime of the service | |
Responsiveness and quality of technical support | |
Transparency of pricing and billing | |
Quality of product updates and roadmap communication | |
Willingness to negotiate and accommodate requirements | |
Onboarding and migration support |
Which vendor relationship challenges have you encountered? (select all that apply)
Unexpected price increases
Slow or unhelpful support
Contractual inflexibility
Poor product roadmap alignment
Difficulty obtaining usage or billing data
Vendor lock-in concerns
Delays in invoicing or billing errors
Lack of a named contact
None encountered
Please detail the price increases experienced and how they were handled.
Please describe the billing or invoicing problems encountered.
How confident are you in your current vendor relationships going into the next renewal cycle?
Review the contractual position for each significant agreement. Focus on renewal mechanics, price protection, service commitments, exit provisions and data rights. Note that this form is jurisdiction-neutral: apply the legal and regulatory requirements relevant to your own organisation and location.
Which contractual provisions are present in your current agreements? (select all that apply)
Fixed term with defined end date
Automatic renewal clause
Price increase cap or price protection
Service level agreement (SLA)
Uptime or availability commitment
Data ownership and portability clause
Termination for convenience
Termination for cause
Penalties for early termination
Minimum spend or volume commitment
Audit rights for the vendor
None of the above
What is the typical price increase cap agreed (%)?
What is the largest minimum spend commitment currently in place?
Are all contracts and renewal notices stored in a central, searchable repository?
Where are contracts stored?
Contract lifecycle management system
Document management system
Shared network drive
Secure cloud storage
Physical files
I agree that centralising contract storage should be a priority action from this audit.
What is the longest contract term currently in place?
Monthly/rolling
6 months
12 months
24 months
36 months
More than 36 months
Have any evergreen or perpetual auto-renewal clauses been identified?
How many contracts contain evergreen or perpetual auto-renewal clauses?
Do any contracts include minimum spend or volume commitments?
Please list the commitments and their expiry dates.
Are there clear clauses covering data ownership, data return and portability at exit?
Please summarise the data return provisions (formats, timeframes, costs).
I agree that strengthening data portability clauses should be addressed at the next renewal.
Are contractual obligations and renewal milestones actively tracked against agreed service levels?
How are service levels monitored?
Automated monitoring and reporting
Manual review by IT
Vendor-supplied reports reviewed quarterly
Only reviewed when issues occur
Has legal or procurement review been completed for the highest-value agreements?
Who signed off the legal or procurement review?
Upload the most relevant contract, renewal notice or price schedule (optional)
Every subscription that stores, processes or transmits organisational data introduces risk. Assess vendor security posture, access controls, data handling practices and the evidence available to demonstrate compliance with the standards your organisation must meet.
Which security or compliance assurances do you require from software vendors? (select all that apply)
Independent security certification (e.g. ISO 27001, SOC 2)
Regular penetration testing evidence
Data processing agreement
Defined data residency/hosting location
Encryption in transit and at rest
Sub-processor transparency
Vulnerability disclosure programme
Business continuity and disaster recovery plan
Cyber insurance evidence
No formal requirements currently
Which certifications are required?
Which data residency or hosting locations are acceptable to your organisation?
Has a security review been performed for each critical vendor within the last 12 months?
How many critical vendors have been reviewed in the last 12 months?
Which critical vendors still require a security review, and by when will this be completed?
Do any subscriptions process personal, sensitive or confidential data?
What categories of data are processed by third-party software? (select all that apply)
Employee/HR data
Customer contact data
Financial or payment data
Health or wellbeing data
Children's data
Intellectual property and trade secrets
Authentication credentials
Other confidential business data
Are data processing agreements in place with all relevant vendors?
How many data processing agreements are currently in place?
I agree that completing data processing agreements must be prioritised before the next renewal.
Is single sign-on (SSO) enforced for all critical applications?
What percentage of applications are integrated with your identity provider (%)?
Which critical applications are not yet integrated with single sign-on?
Is multi-factor authentication enforced across all subscription services?
Are offboarding processes effective at revoking software access when people leave?
On average, how long does it take to revoke access after a leaver is reported?
What gaps exist in the offboarding and access revocation process?
Has the organisation experienced any security, privacy or compliance incident linked to third-party software in the past 24 months?
Please describe the incident, its impact and the remedial action taken.
Please rate your agreement with the following security and compliance statements.
Strongly disagree | Disagree | Neutral | Agree | Strongly agree | |
|---|---|---|---|---|---|
Vendor security documentation is readily available and up to date | |||||
Access permissions within software are reviewed regularly | |||||
Data shared with third-party tools is minimised to what is necessary | |||||
Compliance obligations are clearly mapped to each subscription | |||||
Security requirements are built into the procurement process | |||||
Exit and data deletion procedures are documented and testable |
Identify the risks associated with the subscription portfolio — financial, operational, contractual, security and reputational — and evaluate the mitigations in place. Score likelihood and impact consistently so risks can be compared and prioritised.
Is there a documented exit strategy for each critical vendor?
How many critical vendors have a documented exit strategy?
I agree that developing exit strategies for critical vendors should be a priority action.
Are backups of data held in third-party systems performed regularly?
How frequently are third-party data backups performed?
Continuously
Daily
Weekly
Monthly
Ad hoc
What would be the impact of permanent data loss in a third-party system?
Has a business impact assessment been completed for the most critical subscriptions?
When was the most recent business impact assessment completed?
What would be the business impact if the largest subscription were unavailable for 24 hours?
Negligible — workarounds exist
Minor inconvenience
Moderate disruption to one team
Major disruption across multiple teams
Severe — organisation-wide operational failure
Please describe the potential consequences and any contingency arrangements in place.
Is there a risk that a key vendor could cease operating or discontinue the product?
Which vendors present this risk and what mitigation is planned?
Are there concentration risks from relying heavily on a single vendor or platform?
What is the annual spend with the single largest vendor?
Subscription Risk Register
Application/Vendor | Risk Description | Likelihood | Impact | Risk Score | Mitigation Owner | ||
|---|---|---|---|---|---|---|---|
A | B | C | D | E | F | ||
1 | Enterprise CRM platform | Vendor acquisition may change licensing terms and support model | 0 | Head of IT Procurement | |||
2 | Cloud storage service | Data residency requirements may not be met after planned migration | 0 | Data Protection Officer | |||
3 | Legacy reporting tool | Single developer dependency and no supported upgrade path | 0 | Head of Analytics | |||
4 | 0 | ||||||
5 | 0 | ||||||
6 | 0 | ||||||
7 | 0 | ||||||
8 | 0 | ||||||
9 | 0 | ||||||
10 | 0 |
Overlapping tools inflate cost, fragment data and increase security exposure. Identify where capabilities are duplicated and where consolidation, tier changes or alternative solutions could deliver savings without harming productivity.
Number of overlapping or duplicate tools identified
Estimated annual savings available from consolidation
Where have duplications been identified? (select all that apply)
Communication and messaging
Video conferencing
File storage and sharing
Project and task management
Document editing and office suites
Design and creative tools
Analytics and reporting
Customer support and ticketing
Marketing automation
No significant duplication found
Which communication tools overlap, and which would you standardise on?
Which project management tools overlap across teams?
Are there opportunities to move from individual licences to enterprise or pooled licensing?
What is the estimated value of the enterprise licensing opportunity?
Would the organisation consider open-source or lower-cost alternatives at renewal?
What factors would influence the switch to an alternative? (select all that apply)
Total cost of ownership
Migration effort and downtime
Feature parity
Security and support availability
User acceptance and training needs
Integration with existing systems
Vendor stability and longevity
What prevents the organisation from considering alternative solutions?
Are any subscriptions being paid for at a higher tier than users actually require?
How many subscriptions could be downgraded to a lower tier?
Please rank the following rationalisation opportunities in order of priority (1 = highest priority).
Reclaim unused licences | |
Consolidate overlapping tools | |
Downgrade over-specified licence tiers | |
Renegotiate pricing with key vendors | |
Replace tools with lower-cost alternatives | |
Move to enterprise/pooled licensing | |
Eliminate unapproved shadow IT purchases |
For each significant subscription, record a clear renewal decision, the rationale behind it, the notice deadline and the expected financial impact. Decisions should reflect usage evidence, vendor performance, security posture and strategic importance.
What is the overall approach for the next renewal cycle?
Renew all existing subscriptions as-is
Renew selectively and consolidate
Aggressively reduce the portfolio
Expand and invest in new capabilities
Defer decisions pending further analysis
What is the target annual saving from consolidation?
Which areas of the portfolio are targeted for reduction and why?
Which new capabilities are being considered for investment?
How many subscriptions do you intend to cancel at renewal?
How many subscriptions do you intend to downgrade to a lower tier?
How many subscriptions do you intend to upgrade or expand?
Projected net change in annual subscription spend after decisions
Are any renewal decisions dependent on a pending internal project or approval?
Please describe the dependency and the expected decision date.
Renewal Decision Register
Application / Service | Renewal Decision | Rationale | Notice Deadline | Estimated Cost Impact | Approval Obtained | ||
|---|---|---|---|---|---|---|---|
A | B | C | D | E | F | ||
1 | Project Management Suite | Renew | High adoption across all teams and competitive pricing | $0.00 | |||
2 | Design & Prototyping Tool | Downgrade | Only 11 of 25 seats actively used; move to a lower tier | -$3,000.00 | |||
3 | Legacy Reporting Tool | Cancel | Functionality replaced by the analytics platform already licensed | -$5,200.00 | |||
4 | |||||||
5 | |||||||
6 | |||||||
7 | |||||||
8 | |||||||
9 | |||||||
10 |
Approaching renewals strategically — with usage data, market benchmarks and clear alternatives — consistently produces better commercial outcomes than accepting the first renewal quote.
Which cost optimisation strategies do you plan to use? (select all that apply)
Benchmark against market alternatives
Negotiate multi-year agreements for discounts
Consolidate to fewer vendors for volume discounts
Remove unused seats before renewal
Renegotiate payment terms
Request price protection or an increase cap
Competitive tender/request for proposal
Purchase through a reseller or aggregator
Switch to annual billing for a discount
No specific strategy planned
What discount level are you targeting for a multi-year commitment (%)?
Which reseller or partner do you work with?
Will you benchmark prices against market alternatives before each major renewal?
Which sources or tools will you use for benchmarking?
Do you plan to negotiate multi-year agreements in exchange for discounts?
What safeguards will you require in exchange for a longer commitment?
What are the reasons for avoiding multi-year commitments?
Target overall reduction in subscription spend (%)
Renewal approval threshold requiring senior sign-off
Who holds final approval authority for renewals above the threshold?
Is there a documented negotiation playbook or standard set of terms requested from vendors?
Please upload the negotiation playbook or standard terms document (optional)
I agree that developing a negotiation playbook should be a priority action.
What are the key negotiation levers you intend to use in upcoming renewals?
Renewal decisions affect real teams. Collect structured feedback from budget holders and end users so that cost decisions do not inadvertently damage productivity or morale.
Was feedback collected from end users or budget holders as part of this audit?
How many people responded to the feedback request?
How will stakeholder input be gathered before final renewal decisions are made?
Please rate stakeholder satisfaction with the software supporting each business function.
Communication and collaboration tools | |
Project and workflow management tools | |
Finance and administrative systems | |
Customer-facing systems | |
Data, analytics and reporting tools | |
IT service management and support tools |
How likely are stakeholders to recommend the current toolset to a peer organisation? (0 = not at all likely, 10 = extremely likely)
How do stakeholders feel about the amount of software they are asked to use day to day?
What feedback themes have emerged from stakeholders? (select all that apply)
Too many tools to switch between
Insufficient training or onboarding
Missing features or capabilities
Slow performance or reliability issues
Difficulty getting support
Concerns about tools being removed
Satisfaction with the current toolset
Requests for new tools or integrations
Which tools cause the most switching or duplication problems?
Which new tools or integrations have been requested?
Please summarise the most important stakeholder feedback and how it should influence renewal decisions.
Convert the audit into measurable outcomes. Every action should have a clear owner, a realistic completion date, a priority level and a defined measure of success.
Summarise the top three findings from this audit.
Total estimated annual savings identified by this audit
Total estimated cost of implementing the recommended actions
Are the resources required to implement the action plan available?
Who will coordinate delivery of the action plan?
What resources or support are needed to deliver the action plan?
Audit Action Plan
Action Item | Owner | Priority | Target Completion Date | Status | Expected Saving | ||
|---|---|---|---|---|---|---|---|
A | B | C | D | E | F | ||
1 | Compile a complete inventory of all active subscriptions including shadow IT | IT Asset Manager | High | In progress | $0.00 | ||
2 | Reclaim and reallocate unused licences across all departments | Departmental Budget Holders | High | Not started | $14,500.00 | ||
3 | Consolidate overlapping collaboration tools into a single platform | Head of IT | Medium | Not started | $22,000.00 | ||
4 | Implement automated renewal reminders for all subscriptions | IT Procurement | High | In progress | $0.00 | ||
5 | |||||||
6 | |||||||
7 | |||||||
8 | |||||||
9 | |||||||
10 |
Target date by which all actions should be completed
Date of the next scheduled subscription audit
Will the findings of this audit be reported to executive leadership or a governance board?
Which forum or committee will receive the findings, and on what date?
How will the findings be communicated and to whom?
Will the results be used to update the organisation's software procurement policy?
Which aspects of the procurement policy are likely to change?
By signing below, the reviewer confirms that the information provided is accurate to the best of their knowledge and that supporting documentation is retained in accordance with the organisation's own record-keeping requirements.
I confirm that the information provided in this audit is accurate and complete to the best of my knowledge.
I agree to retain supporting documentation (invoices, contracts, usage reports) for future audits.
I confirm that any estimates provided have been clearly identified as estimates.
Additional notes, caveats or assumptions
Signature of auditor/reviewer
Does this audit require a second reviewer or countersignature?
Please provide the name and role of the second reviewer:
Analysis for Annual Subscription & Software Renewal Audit Form | Complete SaaS Renewal Review Template
Important Note: This analysis provides strategic insights to help you get the most from your form's submission data for powerful follow-up actions and better outcomes. Please remove this content before publishing the form to the public.
The Annual Subscription & Software Renewal Audit Form is an exceptionally comprehensive and well-structured instrument designed to support organisations of any size and jurisdiction in conducting a rigorous annual review of their software subscriptions, SaaS licences and recurring service renewals. Its greatest strength lies in its breadth and depth: the form covers every critical dimension of subscription management, from initial inventory capture and cost analysis through to usage utilisation, vendor performance, contract governance, security and compliance, risk assessment, rationalisation opportunities, renewal decision-making, negotiation strategy, stakeholder feedback and a formal action plan with sign-off. This end-to-end coverage ensures that no aspect of the subscription portfolio is overlooked and that the audit produces actionable, measurable outcomes rather than a mere snapshot. The inclusion of structured data tables (inventory register, spend analysis by cost centre, risk register, renewal decision register and action plan) provides a powerful mechanism for capturing granular, tabular data that can be directly translated into operational dashboards and executive reports. The form also demonstrates strong design principles through its use of conditional follow-up logic, where additional detail is requested only when relevant based on the respondent's answer, thereby reducing cognitive load while ensuring data completeness where it matters most.
From a weaknesses perspective, the sheer volume and depth of the form — spanning 16 major sections with well over 100 individual questions and sub-questions — may present a significant barrier to completion, particularly for smaller organisations or individuals completing the form without substantial preparation. The form's own tip to gather invoices, contracts, renewal notices and usage reports before beginning is wise, but the time investment required could still lead to abandonment or incomplete responses. Additionally, while the form is jurisdiction-neutral and universally applicable, some organisations may find certain sections (such as the detailed security and compliance review or the contract governance section) more relevant than others, and there is no built-in mechanism to skip or collapse sections that may not apply. The mandatory field strategy is well-calibrated overall, with critical identification, financial and decision-making fields correctly marked as required, but the conditional mandatory follow-ups (such as the incident description fields) could benefit from clearer guidance on the level of detail expected. Despite these considerations, the form represents a best-in-class template for subscription and software renewal auditing that balances comprehensiveness with logical structure and practical utility.
Has a subscription or software renewal audit been conducted by your organisation before?
This question serves as a critical contextual anchor for the entire audit. By establishing whether this is a first-time audit or a recurring exercise, the form can calibrate expectations, benchmark against previous findings and identify trends over time. For organisations conducting their first audit, the follow-up question about what prompted the audit and what they hope to achieve captures the motivating drivers — whether cost pressure, compliance requirements, vendor issues or strategic transformation — which provides valuable context for interpreting the results. For repeat auditors, the request to summarise previous findings creates continuity and enables year-over-year comparison, which is one of the most valuable aspects of any audit programme.
The design choice to make this question mandatory is excellent, as it fundamentally shapes how the rest of the form should be interpreted. A first-time audit will naturally have more gaps and unknowns, while a mature audit programme should show improvement in key metrics. The conditional follow-up logic is particularly effective here: the 'yes' branch asks for previous findings and outcomes, while the 'no' branch asks for motivations and objectives. This ensures that the response is always meaningful regardless of the answer, and it avoids asking irrelevant questions.
From a data collection perspective, this question generates qualitative narrative data that provides essential context. The placeholder example in the 'yes' follow-up — referencing specific numbers of unused licences and monetary savings — is an excellent touch that sets expectations for the level of detail desired. This helps ensure that respondents provide concrete, quantifiable information rather than vague generalisations.
From a user experience standpoint, this is an ideal opening question: it is simple to answer (a binary yes/no), it immediately engages the respondent in reflective thinking about their organisation's audit maturity, and it signals that the form values both historical context and forward-looking objectives. The low cognitive load of this question helps build momentum before the more detailed sections that follow.
Will the results of this audit be used to make binding renewal or cancellation decisions within the next 90 days?
This question introduces a critical dimension of urgency and decision-making timeline into the audit. By asking whether the results will drive binding decisions within 90 days, the form acknowledges that subscription renewals operate on fixed contractual timelines and that audit findings must be actionable within those windows. This is particularly important given that many SaaS contracts require 30–90 days' notice to cancel without penalty, meaning that an audit completed too late may not influence the current renewal cycle.
The conditional follow-up requesting the specific date by which renewal decisions must be finalised is mandatory when the answer is 'yes', which is a smart design choice. This date becomes a critical deadline that should inform the prioritisation of all subsequent audit activities and action items. It also helps stakeholders understand the time pressure under which decisions are being made.
From a data quality perspective, this question helps distinguish between audits conducted for informational or benchmarking purposes versus those that are operationally urgent. This distinction affects how the findings should be weighted and how quickly the action plan needs to be executed. The question also implicitly encourages organisations to plan their audits well in advance of renewal deadlines.
The user experience is smooth: the question is straightforward, and the conditional follow-up only appears when relevant. The 90-day timeframe is a sensible default that aligns with common contractual notice periods and procurement lead times. This question effectively sets the stage for the urgency and actionability of the audit.
Organisation/company name
This foundational identification question is essential for establishing the organisational context of the audit. It enables the audit to be filed, referenced and compared against previous and future audits for the same entity. In multi-entity or multinational organisations, the specific company name helps distinguish between different legal entities or business units that may have separate subscription portfolios and procurement processes. The mandatory status is entirely appropriate, as an audit without organisational identification is functionally useless for record-keeping and accountability purposes.
The placeholder example ('Acme Global Industries') is helpful in setting expectations for the format of the response. From a data collection perspective, this field generates simple text data that serves as a primary key for indexing and retrieval. Privacy considerations are minimal, as organisational names are generally not sensitive information, though in some contexts (such as competitive intelligence) the specific entity name might be considered confidential.
Department or business unit responsible for this audit
This question identifies the organisational unit with accountability for the audit process, which is crucial for understanding the governance structure around subscription management. Whether the audit is owned by IT Procurement, Finance, IT Asset Management or another function significantly affects the perspective, priorities and authority level of the respondents. A procurement-owned audit will naturally focus more on cost and contract terms, while an IT-owned audit may emphasise security and technical fit.
Making this field mandatory ensures that every audit has a clear organisational owner, which is essential for follow-up actions and accountability. The placeholder examples are well-chosen and reflect common organisational structures. This question also helps identify whether subscription management is centralised or distributed, which is a key maturity indicator.
Primary contact person
Identifying the individual accountable for completing and submitting the audit is essential for communication, clarification and follow-up. This person becomes the point of contact for any questions about the audit findings, action plan implementation or subsequent reviews. The mandatory status is appropriate and necessary for establishing clear accountability.
From a privacy perspective, this field collects personal data (a name), which should be handled in accordance with applicable data protection regulations. The form should ensure that contact information is stored securely and used only for audit-related purposes.
Job title/role of primary contact
While not mandatory, this field provides valuable context about the seniority and functional expertise of the person completing the audit. An IT Asset Manager will bring different insights than a Finance Director or a CIO. This information helps assess the credibility and completeness of the audit responses and can inform how the findings should be communicated to different audiences.
Email address
The email address is the primary communication channel for audit-related correspondence, including follow-up questions, findings distribution and action plan tracking. Making this mandatory is essential for ensuring that the audit can be effectively communicated and that stakeholders can be reached. From a data protection perspective, email addresses are personal data and should be handled accordingly.
Telephone number
Providing a phone number as optional is a good balance between accessibility and user burden. While email is the preferred communication channel for most audit-related matters, a phone number can be invaluable for urgent clarifications or time-sensitive renewal decisions. The international format placeholder is a thoughtful touch for a globally applicable form.
Alternate contact person (if any)
This optional field acknowledges that audit responsibilities may be shared or that the primary contact may be unavailable during critical decision windows. Having a backup contact ensures continuity and reduces the risk of communication gaps during time-sensitive renewal processes.
Approximate number of employees in the organisation
This mandatory numeric field provides essential context for benchmarking and scaling the audit findings. A 50-person startup and a 50,000-person enterprise will have vastly different subscription portfolios, cost structures and governance maturity. Employee count is a standard denominator for per-employee subscription costs, licence utilisation ratios and other key metrics that enable meaningful comparison across organisations and time periods.
The use of 'approximate' in the question text is a smart design choice that reduces the burden on respondents who may not have exact headcount figures readily available, while still capturing the order of magnitude needed for analysis.
Number of departments or cost centres included in this audit
This optional field helps assess the scope and granularity of the audit. An audit covering 2 departments is fundamentally different from one covering 50, and this information helps interpret the completeness and representativeness of the findings. It also provides context for the spend analysis by cost centre table later in the form.
Which area of the organisation owns software subscription decisions?
This question is critical for understanding the governance model around subscription management. Centralised ownership (IT or Finance) typically enables better visibility, standardisation and negotiating leverage, while decentralised ownership can lead to shadow IT, duplicate tools and fragmented spending. The options provided are comprehensive and cover the most common organisational models, including the increasingly prevalent shared ownership and managed service provider arrangements.
The conditional follow-up for 'Other' ensures that non-standard governance models are captured. This question directly informs the recommendations and action plan, as the optimal strategies for cost optimisation and consolidation will vary significantly depending on the decision-making structure.
Is an external auditor or third-party consultant involved in this review?
This question identifies whether the audit benefits from independent expertise or is conducted entirely internally. External auditors can bring objectivity, benchmarking data and specialised knowledge, but they also introduce additional cost and coordination requirements. The follow-up requesting the external party's name and scope of work provides transparency about the audit's independence and coverage.
Audit reference/ID code
While optional, an audit reference code is a best practice for document management and traceability. It enables the audit to be easily referenced in meeting minutes, action plans, procurement documents and subsequent audits. The placeholder example suggests a structured naming convention, which is helpful guidance for organisations that may not have an established convention.
Audit period start date and Audit period end date
These mandatory date fields define the temporal boundaries of the audit, which is essential for ensuring that the data collected is relevant and comparable. The audit period should align with the organisation's fiscal year or renewal cycle to maximise the utility of the findings. Having both start and end dates as mandatory ensures that the scope is clearly defined and that any data outside the period can be appropriately contextualised.
From a data quality perspective, these dates are critical for year-over-year comparison and trend analysis. They also help identify any gaps in coverage, such as subscriptions that were active for only part of the audit period.
Date this form was completed
This mandatory field establishes when the audit was finalised, which is important for assessing the timeliness and relevance of the findings. In fast-moving SaaS environments, data can become stale quickly, and knowing the completion date helps stakeholders judge whether the information is still current when making renewal decisions.
What type of audit is this?
This mandatory question categorises the audit's scope and intent, which fundamentally affects how the findings should be interpreted. A full inventory audit provides comprehensive coverage but requires significant effort, while a targeted or sample-based audit may be more practical but less complete. A renewal-focused review prioritises upcoming renewal decisions, while a compliance-driven review emphasises regulatory requirements. The options are well-designed and cover the most common audit types.
The conditional follow-up for 'Other' captures non-standard audit types. Making this mandatory ensures that every audit is properly categorised, which aids in benchmarking and comparison across different audit cycles.
What are the primary objectives of this audit? (select all that apply)
This multiple-choice question captures the strategic intent behind the audit, which shapes the prioritisation of findings and recommendations. The options are comprehensive, covering cost reduction, licence optimisation, compliance, security, vendor management, budgeting and governance objectives. The conditional follow-ups for cost reduction (target savings) and compliance (specific obligations) add valuable quantitative and qualitative detail.
This question is particularly effective because it forces respondents to articulate their goals upfront, creating a framework against which the audit's success can be measured. It also helps identify whether the audit is primarily financial, operational, compliance-driven or a combination.
Which methods were used to collect subscription data? (select all that apply)
Understanding the data collection methodology is essential for assessing the reliability and completeness of the audit findings. Automated discovery tools provide the most comprehensive coverage but may miss shadow IT, while manual tracking is prone to human error but can capture informal purchases. The options cover the full spectrum of data collection approaches, from automated tools to financial analysis to departmental surveys.
This question also reveals the organisation's level of investment in subscription management tooling and processes, which is a key maturity indicator. The conditional follow-up for 'Other' captures non-standard approaches.
How complete is the inventory captured in this audit?
This mandatory question is a critical data quality indicator. It honestly assesses the coverage of the audit, which directly affects the reliability of all subsequent findings and recommendations. An audit claiming 90–100% completeness provides much stronger evidence for decision-making than one at 50–74%. The graduated scale (90–100%, 75–89%, 50–74%, 25–49%, less than 25%) is well-designed to capture meaningful distinctions.
Making this mandatory is excellent because it prevents organisations from presenting incomplete data as comprehensive. It also highlights areas where improvement is needed in the next audit cycle.
Were departmental budget holders consulted during the audit?
This question assesses the collaborative nature of the audit and its alignment with organisational realities. Budget holders have direct knowledge of their team's software needs, usage patterns and pain points, and their input is essential for accurate inventory and meaningful renewal decisions. The conditional follow-ups are well-designed: 'yes' asks for the number consulted (quantifying the breadth of engagement), while 'no' asks for the reasons and the plan to involve them (addressing the gap).
Total number of active subscriptions and software licences identified
This mandatory numeric field is the headline metric of the entire inventory section. It establishes the scale of the subscription portfolio and provides a baseline for all subsequent analysis. The number of active subscriptions directly correlates with administrative overhead, security exposure, cost complexity and management effort. Making this mandatory ensures that every audit provides this fundamental metric.
The comprehensive paragraph preceding this section — which explicitly includes shadow IT, free-tier tools with paid upgrades, browser extensions with recurring fees and departmental purchases — is excellent guidance that helps ensure thoroughness in the inventory capture.
How many of these are self-service or 'shadow IT' purchases made outside central procurement?
Shadow IT is one of the most significant challenges in subscription management, representing uncontrolled spending, security risk and compliance exposure. This optional numeric field quantifies the extent of shadow IT within the portfolio, which is essential for understanding the true scale of the subscription landscape and the effectiveness of procurement controls.
How many subscriptions are on a monthly rolling plan rather than an annual term?
Monthly rolling plans offer flexibility but typically at a higher per-unit cost and with less negotiating leverage. This question helps identify opportunities for cost savings through annual commitments while also highlighting the proportion of the portfolio that can be adjusted quickly in response to changing needs.
Does the organisation maintain a central software asset register?
This mandatory question is a fundamental maturity indicator. A central register is the foundation of effective subscription management, enabling visibility, control, compliance and cost optimisation. Without one, organisations are essentially managing their subscription portfolio blind. The conditional follow-ups are excellent: 'yes' asks about update frequency (assessing the register's currency and reliability), while 'no' asks about obstacles (identifying barriers to improvement).
Are free or freemium tools with potential paid upgrades included in the inventory?
Freemium tools represent a growing category of software that can quickly become a cost liability when teams upgrade to paid tiers. This question ensures that these tools are captured in the inventory, even if they don't currently generate direct costs. The follow-up asking for the number of potential upgrade candidates helps identify future cost exposure.
Software & Subscription Inventory Register (Table)
This table is the centrepiece of the inventory section and provides a structured, granular capture of every subscription in the portfolio. The columns are excellently designed: application name and vendor provide identification, category enables grouping and analysis, licences purchased versus actively used immediately reveals utilisation gaps, billing cycle informs cash flow planning, auto-renew status highlights risk of unwanted renewals, next renewal date enables proactive management and annual cost provides the financial baseline.
The example rows are particularly helpful, demonstrating the expected level of detail and showing realistic scenarios (such as the design tool with only 11 of 25 seats used). This table directly feeds into the cost analysis, usage assessment and renewal decision sections, making it one of the most data-rich elements in the entire form.
Earliest upcoming renewal date in the portfolio
This mandatory date field identifies the most urgent renewal deadline, which drives the timeline for the entire audit and action plan. If the earliest renewal is in 30 days, the audit must be completed and decisions made within that window. This field creates a natural sense of urgency and helps prioritise the audit's outputs.
Number of subscriptions with automatic renewal enabled
Auto-renewal clauses are one of the most common sources of unwanted subscription costs. This optional numeric field quantifies the exposure to unintentional renewals and helps identify where proactive management is most needed. Combined with the renewal date information, this enables targeted intervention before auto-renewal deadlines.
Number of renewals due within the next 90 days
This field provides a near-term workload assessment for the renewal management process. A large number of imminent renewals requires immediate attention and may overwhelm the available decision-making capacity. The 90-day window aligns with common notice periods and procurement lead times.
Are renewal reminders or alerts configured for every subscription?
This mandatory question assesses a fundamental control mechanism for renewal management. Without reminders, organisations are vulnerable to missed deadlines, unwanted auto-renewals and lost negotiating opportunities. The conditional follow-ups are well-designed: 'yes' asks about the lead time (assessing whether reminders provide sufficient preparation time), while 'no' asks about current tracking methods and planned improvements.
What is the most common notice period required to cancel without penalty?
Notice periods are a critical contractual term that directly affects the organisation's ability to make timely renewal decisions. This question helps identify the planning horizon required for each renewal and highlights any contracts with unusually long notice periods that may require early attention. The 'Varies significantly' option with its follow-up captures the complexity of managing diverse contract terms.
Has the organisation ever been unintentionally auto-renewed or charged a penalty for a missed notice deadline?
This question captures historical incidents that demonstrate the real-world consequences of inadequate renewal management. The mandatory follow-up requesting incident details and financial impact ensures that the full cost of process failures is documented. These incidents provide compelling evidence for investing in better renewal management processes and tools.
Is there a documented renewal approval workflow with defined lead times?
This question assesses the maturity of the renewal decision-making process. A documented workflow with defined lead times ensures that renewals are reviewed, approved and actioned systematically rather than reactively. The conditional follow-ups are excellent: 'yes' asks for the lead time (assessing the workflow's practicality), while 'no' includes a checkbox agreement to establish one as a priority action — a clever design that builds commitment to improvement.
Total annual spend on subscriptions and software
This mandatory currency field is the headline financial metric of the audit. It establishes the total cost of the subscription portfolio and provides the baseline against which all cost optimisation efforts are measured. Making this mandatory ensures that every audit provides this fundamental financial data point, which is essential for budgeting, benchmarking and executive reporting.
Budget allocated for software and subscriptions for the upcoming year
This mandatory field enables comparison between current spend and future budget, highlighting potential gaps or surpluses. If current spend exceeds the allocated budget, urgent cost optimisation is needed. If there is headroom, there may be opportunities for strategic investment. This comparison is essential for financial planning and renewal decision-making.
Percentage of the total IT budget spent on subscriptions (%)
This optional metric provides context for the subscription spend relative to overall IT investment. Industry benchmarks typically show SaaS spending as 30–50% of IT budgets and growing, so this figure helps assess whether the organisation's subscription spend is proportionate or excessive.
Largest single subscription by annual cost
Identifying the largest single subscription highlights concentration risk and the highest-value target for negotiation. This field helps focus attention on the subscriptions where even small percentage savings translate into significant absolute savings.
Reporting currency used throughout this form
This optional field is essential for a globally applicable form. It ensures that all monetary values are interpreted correctly and enables proper comparison and aggregation. The placeholder examples (USD, EUR, GBP, JPY) are helpful.
Has total subscription spend increased compared with the previous audit period?
This question captures the spending trend, which is a key indicator of subscription management effectiveness. The conditional follow-ups are excellent: 'yes' asks for the drivers of increase (identifying root causes such as headcount growth, new purchases or price uplifts), while 'no' asks for the measures that kept spend stable (capturing best practices). This creates a learning loop that improves future audit cycles.
Do you anticipate a price increase at renewal from any vendor?
Forward-looking price expectations are essential for budgeting and negotiation planning. The follow-up asking for the average expected increase provides a quantifiable input for financial forecasting. This question also signals to the organisation that price increases should be anticipated and prepared for rather than accepted passively.
How are subscription payments made?
Payment methods affect visibility, control and reconciliation of subscription costs. Centralised payment through IT or Finance provides the best visibility, while corporate card payments can be difficult to track and control. The conditional follow-up for corporate cards asks about reconciliation processes, which is a common pain point in subscription management.
Are there any subscriptions paid for but no longer allocated to a cost centre?
Orphaned subscriptions represent pure waste — costs incurred with no clear ownership or benefit. This question helps identify these 'ghost' subscriptions, which are common in organisations with decentralised purchasing or frequent organisational changes. The follow-up quantifies the extent of the problem.
Spend Analysis by Cost Centre (Table)
This table provides a structured comparison of current versus proposed spending by department, with calculated variance and percentage change columns. The inclusion of formula-driven columns (variance and change percentage) is excellent, as it automates calculations and reduces errors. The commentary column allows for qualitative context that numbers alone cannot convey. The example rows demonstrate realistic scenarios, including cost reductions through consolidation and increases due to new requirements.
Savings percentage calculation (Equation)
The inclusion of the savings percentage formula (using KaTeX rendering) provides transparency and consistency in how savings are calculated. This mathematical clarity ensures that all stakeholders use the same methodology, which is essential for credible reporting and comparison.
What proportion of purchased licences are actively used across the portfolio?
This mandatory question addresses the single most common source of wasted subscription spend: unused licences. The graduated scale from 'More than 90%' to 'Less than 25%' plus the 'Unknown' option captures the full spectrum of utilisation scenarios. Making this mandatory ensures that every audit addresses this critical issue. The 'Unknown' option is particularly important as it honestly reflects organisations that don't measure utilisation — which is itself a finding that should drive action.
Estimated number of unused or dormant licences and Estimated annual cost of unused or dormant licences
These optional fields quantify the waste in absolute and financial terms, making the business case for licence reclamation tangible. The word 'estimated' is appropriate as precise figures may not be available, but even approximate numbers provide compelling evidence for action.
Is licence utilisation reviewed on a regular schedule?
This question assesses the ongoing governance of licence utilisation, not just the point-in-time snapshot captured by the audit. Regular reviews enable proactive reclamation and reallocation, preventing waste from accumulating between annual audits. The conditional follow-ups are well-designed, with the 'no' branch including a checkbox agreement to establish regular reviews as a priority.
Is there a formal process to reclaim and reallocate unused licences?
Having a reclamation process is essential for converting the audit's findings into actual savings. Without a formal process, identified waste remains theoretical. The conditional follow-ups capture both the effectiveness of existing processes and the barriers to establishing them.
Are employees able to request new software without an approval gate?
This question assesses the control environment around software procurement. Uncontrolled software requests contribute to shadow IT, duplicate tools and security exposure. The follow-up asking about existing controls helps identify the balance between user empowerment and governance.
Which tools are considered business-critical and must not be interrupted?
Identifying business-critical tools is essential for renewal prioritisation and risk management. These tools must be renewed reliably and cannot be subject to cost-cutting exercises that might disrupt operations. The conditional follow-ups for specific tool categories capture the actual products in use.
Matrix rating: Usage and adoption statements
This matrix rating captures nuanced perceptions of usage and adoption across five key dimensions: training adequacy, feature utilisation, licence tier appropriateness, usage data reliability and duplicate tool usage. The five-point Likert scale provides sufficient granularity for meaningful analysis while remaining easy to complete. These perceptions complement the quantitative data collected elsewhere in the form.
Overall satisfaction with the current software portfolio (Digit rating)
This 0–10 satisfaction score provides a single, easily comparable metric of overall portfolio health. It serves as a useful benchmark for year-over-year comparison and can be correlated with other findings to identify drivers of satisfaction or dissatisfaction.
Total number of vendors in the subscription portfolio
Vendor count is a key metric for assessing portfolio complexity and consolidation opportunities. A large number of vendors increases administrative overhead, security review burden and negotiating complexity. This optional field provides the denominator for vendor-related analysis.
Have you experienced significant support or service issues in the past 12 months?
Support quality is a critical factor in renewal decisions, particularly for business-critical tools. The mandatory follow-up requesting issue details ensures that significant problems are documented and can be factored into renewal decisions. The 'no' branch includes an emotion rating for overall support experience, providing a positive signal when no issues have occurred.
Do you consolidate purchases with a small number of strategic vendors?
Vendor consolidation can deliver volume discounts, simplified management and stronger negotiating leverage, but it also increases concentration risk. This question assesses the current consolidation strategy and its trade-offs. The follow-ups capture either the number of strategic vendors or the barriers to consolidation.
Do any vendors provide a named account manager or dedicated support contact?
Dedicated account management is a value-added service that can significantly improve the vendor relationship and negotiating position. This question identifies which vendors invest in the relationship beyond the transactional level.
Has any vendor been acquired, merged, or changed its pricing model during the audit period?
Vendor M&A activity and pricing model changes can have significant implications for cost, service quality and roadmap alignment. This question captures these disruptive events and their impact, which should be factored into renewal decisions and risk assessments.
Matrix star rating: Vendor performance aspects
This 5-star rating matrix evaluates six key dimensions of vendor performance: reliability, support quality, pricing transparency, roadmap communication, negotiation willingness and onboarding support. The star rating format is intuitive and provides granular, comparable data across vendors. This assessment directly informs renewal decisions and negotiation strategies.
Which vendor relationship challenges have you encountered?
This multiple-choice question captures common pain points in vendor relationships, from unexpected price increases to billing errors to lock-in concerns. The conditional follow-ups for price increases and billing problems capture specific details that can be used in negotiations or vendor scorecards.
Confidence in vendor relationships (Emotion rating)
This emotional assessment captures the subjective confidence level going into the next renewal cycle, which complements the objective performance ratings. High confidence suggests stable, productive relationships, while low confidence may signal the need for diversification or contingency planning.
Which contractual provisions are present in your current agreements?
This multiple-choice question provides a comprehensive inventory of contractual terms across the portfolio. The options cover the full spectrum of important provisions: fixed terms, auto-renewal, price protection, SLAs, data ownership, termination rights, penalties, minimum commitments and audit rights. The conditional follow-ups for price caps and minimum spend commitments capture quantitative details that directly affect financial planning.
This question is essential for understanding the contractual landscape and identifying gaps in protection or flexibility. It also informs the negotiation strategy by highlighting which terms are commonly present and which need to be added.
Are all contracts and renewal notices stored in a central, searchable repository?
This mandatory question assesses a fundamental governance control. Centralised contract storage enables effective renewal management, compliance verification and risk assessment. Without it, contracts may be scattered across email inboxes, shared drives and individual files, making it impossible to manage renewals proactively. The conditional follow-ups capture the storage location or include a checkbox agreement to centralise as a priority action.
What is the longest contract term currently in place?
Long contract terms provide price stability but reduce flexibility. This question helps assess the balance between commitment and agility across the portfolio. Very long terms (36+ months) may indicate lock-in that limits the organisation's ability to adapt to changing needs.
Have any evergreen or perpetual auto-renewal clauses been identified?
Evergreen clauses are particularly dangerous as they can lock organisations into perpetual renewals without conscious decision points. This question helps identify these clauses, which should be renegotiated or at minimum tracked with specific review dates. The follow-up quantifies the extent of the exposure.
Do any contracts include minimum spend or volume commitments?
Minimum commitments create financial obligations that must be factored into budgeting and renewal decisions. They also limit the organisation's ability to reduce spend if usage declines. The follow-up requesting a list with expiry dates enables proactive planning.
Are there clear clauses covering data ownership, data return and portability at exit?
This mandatory question addresses a critical aspect of vendor risk management. Data ownership and portability clauses determine whether the organisation can retrieve its data if the relationship ends, in what format, within what timeframe and at what cost. Without these clauses, organisations may face vendor lock-in or data loss at exit. The conditional follow-ups capture the specifics of existing provisions or include a checkbox agreement to strengthen them at renewal.
Are contractual obligations and renewal milestones actively tracked against agreed service levels?
Active SLA tracking ensures that vendors deliver on their commitments and that the organisation has evidence to support claims or negotiations. The follow-up captures the monitoring methodology, from automated to ad hoc.
Has legal or procurement review been completed for the highest-value agreements?
Legal review of high-value contracts is a risk management best practice that helps identify unfavourable terms, compliance gaps and negotiation opportunities. The follow-up captures who signed off, establishing accountability.
File upload: Contract, renewal notice or price schedule
This optional file upload enables respondents to attach supporting documentation, which enriches the audit record and provides evidence for the findings. Making it optional is appropriate, as not all respondents may have documents readily available or may have confidentiality concerns.
Which security or compliance assurances do you require from software vendors?
This multiple-choice question captures the organisation's security requirements for software vendors, covering certifications, penetration testing, data processing agreements, data residency, encryption, sub-processor transparency, vulnerability disclosure, business continuity and cyber insurance. The conditional follow-ups for specific certifications and data residency requirements capture important details. This question helps assess the maturity of the organisation's security procurement requirements.
Has a security review been performed for each critical vendor within the last 12 months?
This mandatory question addresses a fundamental security control. Regular security reviews of critical vendors help identify vulnerabilities, ensure compliance and maintain an up-to-date risk posture. The conditional follow-ups quantify the coverage ('yes') or identify gaps and remediation timelines ('no').
Do any subscriptions process personal, sensitive or confidential data?
This question identifies the data sensitivity exposure of the subscription portfolio. Subscriptions processing personal or sensitive data require enhanced security controls, data processing agreements and compliance measures. The follow-up captures the specific data categories processed.
Are data processing agreements in place with all relevant vendors?
Data processing agreements (DPAs) are a legal requirement in many jurisdictions when personal data is shared with third parties. This question assesses compliance with these requirements. The conditional follow-ups quantify existing DPAs or include a checkbox agreement to prioritise completing them.
Is single sign-on (SSO) enforced for all critical applications?
SSO is a key security control that centralises authentication and access management. This question assesses SSO coverage across the portfolio, which affects both security posture and user experience. The follow-ups capture the percentage of SSO-integrated applications or identify gaps.
Is multi-factor authentication enforced across all subscription services?
MFA is one of the most effective security controls against unauthorised access. This mandatory question ensures that every audit addresses MFA coverage, which is a baseline security expectation in most compliance frameworks.
Are offboarding processes effective at revoking software access when people leave?
Ineffective offboarding leads to orphaned accounts, wasted licences and security exposure. This question assesses the timeliness and completeness of access revocation. The follow-ups capture the average revocation time or identify specific gaps.
Has the organisation experienced any security, privacy or compliance incident linked to third-party software in the past 24 months?
Historical incidents provide evidence of actual risk realisation and help prioritise security improvements. The mandatory follow-up requesting incident details ensures comprehensive documentation. This question directly links the security review to real-world outcomes.
Matrix rating: Security and compliance statements
This matrix captures perceptions across six security dimensions: documentation availability, access review practices, data minimisation, compliance mapping, procurement integration and exit procedures. These perceptions complement the factual data collected elsewhere and help identify cultural and process gaps.
Is there a documented exit strategy for each critical vendor?
This mandatory question addresses a critical aspect of business continuity. Exit strategies ensure that the organisation can transition away from a vendor if needed, whether due to performance issues, vendor failure, cost concerns or strategic changes. Without documented exit strategies, organisations face significant disruption risk. The conditional follow-ups quantify coverage or include a checkbox agreement to develop strategies.
Are backups of data held in third-party systems performed regularly?
Data backup is a fundamental resilience control. This question assesses backup practices for data stored in SaaS and third-party systems, where the organisation may have limited control over data protection. The follow-ups capture backup frequency or assess the impact of potential data loss.
Has a business impact assessment been completed for the most critical subscriptions?
Business impact assessments quantify the consequences of subscription unavailability, which informs risk prioritisation and continuity planning. The follow-up captures when the most recent assessment was completed.
What would be the business impact if the largest subscription were unavailable for 24 hours?
This scenario-based question forces respondents to think concretely about operational dependency on their largest subscription. The graduated scale from 'Negligible' to 'Severe' captures the full spectrum of impact. The mandatory follow-up for 'Severe' impact ensures that contingency arrangements are documented.
Is there a risk that a key vendor could cease operating or discontinue the product?
Vendor viability is a real risk, particularly for smaller or niche SaaS providers. This question identifies vendors at risk of discontinuation and prompts mitigation planning. The follow-up captures specific vendors and planned mitigations.
Are there concentration risks from relying heavily on a single vendor or platform?
Concentration risk — excessive dependence on one vendor — creates vulnerability to price increases, service disruptions and strategic changes. The follow-up quantifies the spend with the largest vendor, making the concentration tangible.
Subscription Risk Register (Table)
This table provides a structured risk assessment framework with likelihood and impact ratings (1–5 scale) and a calculated risk score (likelihood × impact). The formula-driven risk score column ensures consistency and comparability. The mitigation owner column assigns accountability. The example rows demonstrate realistic risk scenarios with clear ownership.
Number of overlapping or duplicate tools identified and Estimated annual savings available from consolidation
These optional fields quantify the redundancy problem and its financial impact. Duplicate tools waste money, fragment data and confuse users. Even approximate figures provide compelling evidence for consolidation initiatives.
Where have duplications been identified?
This multiple-choice question maps duplications to specific functional categories, enabling targeted consolidation planning. Communication and collaboration tools are the most common area of duplication. The conditional follow-ups capture specific overlapping tools and preferred standardisation targets.
Are there opportunities to move from individual licences to enterprise or pooled licensing?
Enterprise licensing often provides significant per-seat discounts and simplified management. This question identifies opportunities for licensing model changes. The follow-up quantifies the value of the opportunity.
Would the organisation consider open-source or lower-cost alternatives at renewal?
This question assesses openness to alternative solutions, which strengthens the negotiating position even if no switch is ultimately made. The conditional follow-ups capture the factors influencing a switch or the barriers to considering alternatives.
Are any subscriptions being paid for at a higher tier than users actually require?
Over-specified licence tiers are a common source of waste. This question identifies downgrade opportunities that can deliver savings without reducing functionality that users actually need.
Ranking: Rationalisation opportunities
This ranking question forces respondents to prioritise rationalisation opportunities, which is essential for focused action planning. The seven options cover the full spectrum of optimisation levers, from licence reclamation to vendor consolidation to shadow IT elimination. The ranking format ensures that resources are directed to the highest-impact activities first.
What is the overall approach for the next renewal cycle?
This mandatory question establishes the strategic direction for the renewal cycle, which frames all subsequent decisions. The options range from renew-all to aggressive reduction, reflecting different organisational postures. The conditional follow-ups capture specific targets and rationales for each approach. Making this mandatory ensures that every audit concludes with a clear strategic direction.
How many subscriptions do you intend to cancel/downgrade/upgrade at renewal?
These three numeric fields quantify the planned changes to the portfolio, providing a clear picture of the expected transformation. Together with the projected net spend change, they enable accurate financial forecasting.
Projected net change in annual subscription spend after decisions
This currency field provides the bottom-line financial impact of the renewal decisions, which is the key metric for executive reporting and budgeting.
Are any renewal decisions dependent on a pending internal project or approval?
Dependencies on internal projects or approvals can delay renewal decisions and create risk of missed deadlines. This question identifies these dependencies and prompts planning to manage them.
Renewal Decision Register (Table)
This table captures the granular renewal decision for each significant subscription, including the decision (renew, downgrade, cancel), rationale, notice deadline, cost impact and approval status. The example rows demonstrate realistic decision scenarios with clear rationales. This table is the operational output of the audit, translating findings into specific actions.
Which cost optimisation strategies do you plan to use?
This multiple-choice question captures the planned negotiation and optimisation approaches, covering benchmarking, multi-year discounts, consolidation, seat removal, payment terms, price protection, competitive tender, reseller partnerships and billing optimisation. The conditional follow-ups capture specific targets and partner details.
Will you benchmark prices against market alternatives before each major renewal?
This mandatory question addresses a fundamental negotiation best practice. Market benchmarking provides the evidence base for challenging vendor pricing and negotiating better terms. Making this mandatory signals that passive acceptance of renewal quotes is not acceptable.
Do you plan to negotiate multi-year agreements in exchange for discounts?
Multi-year commitments can deliver significant discounts but reduce flexibility. This question assesses the organisation's appetite for longer commitments. The conditional follow-ups capture either the safeguards required or the reasons for avoiding multi-year deals.
Target overall reduction in subscription spend (%)
This optional field sets a quantifiable target for cost reduction, which provides a clear success metric for the audit's recommendations.
Renewal approval threshold requiring senior sign-off and Who holds final approval authority?
These fields establish the governance framework for renewal decisions, ensuring appropriate oversight for significant commitments. Clear thresholds and approval authorities prevent unauthorised spending and ensure strategic alignment.
Is there a documented negotiation playbook or standard set of terms?
A negotiation playbook standardises the organisation's approach to vendor negotiations, ensuring consistency and capturing institutional knowledge. The conditional follow-ups include a file upload for the playbook or a checkbox agreement to develop one.
Key negotiation levers
This open-ended question captures the specific tactics and evidence the organisation plans to use in negotiations. The placeholder examples are excellent, showing concrete levers like usage data, competing quotes and multi-year commitments.
Was feedback collected from end users or budget holders as part of this audit?
This mandatory question ensures that stakeholder perspectives are incorporated into the audit. End users and budget holders have direct experience with the software portfolio and can identify issues that data alone cannot reveal. The conditional follow-ups capture response rates or plans for gathering input.
Matrix star rating: Stakeholder satisfaction by business function
This matrix captures satisfaction across six business function categories, providing a nuanced view of where the software portfolio is serving users well and where it is falling short. The star rating format is intuitive and comparable.
Net Promoter Score (0–10)
The NPS-style question provides a single, comparable metric of stakeholder advocacy for the current toolset. This is a widely understood benchmark that can be tracked over time.
Emotion rating: How do stakeholders feel about the amount of software?
This emotional assessment captures the subjective experience of software overload, which is a growing concern as tool proliferation increases. It complements the quantitative satisfaction data.
What feedback themes have emerged?
This multiple-choice question categorises stakeholder feedback into actionable themes, from tool switching fatigue to training gaps to feature requests. The conditional follow-ups capture specific details for the most impactful themes.
Summary of stakeholder feedback
This open-ended field allows for nuanced narrative capture of the most important feedback and its implications for renewal decisions. It ensures that qualitative insights are not lost in the structured data.
Summarise the top three findings from this audit
This mandatory field distils the audit's most important findings into a concise summary. The placeholder example demonstrates the expected format: numbered findings with specific, quantifiable impacts. This summary is the executive headline of the entire audit.
Total estimated annual savings and Total estimated cost of implementing actions
These currency fields quantify the return on investment of the audit and its recommended actions. The net benefit (savings minus implementation cost) is the key metric for justifying the audit programme to executive leadership.
Are the resources required to implement the action plan available?
This question assesses the feasibility of the action plan. Without adequate resources, even the best recommendations will not be implemented. The conditional follow-ups capture the coordination arrangements or the resource gaps.
Audit Action Plan (Table)
This table is the operational heart of the audit, converting findings into specific, owned, dated and prioritised actions. The columns — action item, owner, priority, target date, status and expected saving — provide everything needed for effective project management. The example rows demonstrate realistic actions with clear ownership and quantified savings.
Target date by which all actions should be completed
This mandatory date field sets the overall deadline for the action plan, creating accountability and urgency. It should align with the organisation's renewal cycle and strategic planning calendar.
Date of the next scheduled subscription audit
This optional field encourages continuous improvement by planning the next audit cycle. Regular audits (typically annual) are essential for maintaining visibility and control over the subscription portfolio.
Will findings be reported to executive leadership?
Executive visibility is essential for securing resources and driving organisational change. The conditional follow-ups capture the reporting forum and timeline or the communication plan.
Will results update the procurement policy?
This question links the audit findings to systemic process improvements, ensuring that the lessons learned are embedded in organisational policy rather than remaining one-off observations.
I confirm that the information provided is accurate and complete
This mandatory declaration establishes the respondent's accountability for the accuracy of the audit. It is a standard governance control that ensures the audit record carries appropriate weight and credibility.
I agree to retain supporting documentation
This mandatory commitment ensures that evidence is preserved for future audits, dispute resolution and compliance verification. Document retention is a best practice that supports the audit's long-term value.
I confirm that any estimates have been identified as estimates
This optional declaration promotes transparency about data quality, ensuring that stakeholders can distinguish between precise figures and approximations.
Additional notes, caveats or assumptions
This optional field captures important context that may affect the interpretation of the audit findings. The placeholder example about estimated usage figures is a good illustration of the type of caveat that should be documented.
Full name of signatory, Role/position of signatory, Signature and Date of signature
These mandatory sign-off fields provide formal authentication of the audit. The signature (whether physical or electronic) adds legal weight to the declaration. The date establishes when the audit was formally approved. Together, these fields create a complete audit trail with clear accountability.
Does this audit require a second reviewer or countersignature?
This optional question acknowledges that some organisations require dual sign-off for audit processes, particularly for high-value or compliance-critical reviews. The follow-up captures the second reviewer's details.
Mandatory Question Analysis for Annual Subscription & Software Renewal Audit Form | Complete SaaS Renewal Review Template
Important Note: This analysis provides strategic insights to help you get the most from your form's submission data for powerful follow-up actions and better outcomes. Please remove this content before publishing the form to the public.
Question: Has a subscription or software renewal audit been conducted by your organisation before?
Justification: This question is fundamentally crucial because it establishes the audit's historical context and maturity level. Without knowing whether this is a first-time or repeat audit, it is impossible to properly interpret the findings, benchmark progress, or identify trends. For first-time audits, the follow-up about motivations and objectives provides essential context for prioritising recommendations. For repeat audits, the summary of previous findings enables year-over-year comparison, which is one of the most valuable analytical capabilities of any audit programme. Making this mandatory ensures that every audit submission is properly contextualised from the outset.
Question: Organisation/company name
Justification: The organisation name is the primary identifier for the audit record and is absolutely essential for filing, retrieval, comparison and accountability. In multi-entity organisations, the specific company name distinguishes between different legal entities with separate subscription portfolios. Without this field, the audit would be anonymous and unusable for any practical purpose. This is a foundational data element that supports all subsequent analysis and reporting.
Question: Department or business unit responsible for this audit
Justification: Identifying the responsible department establishes clear organisational ownership and accountability for the audit process. This information is critical for follow-up communications, action plan coordination and understanding the perspective from which the audit was conducted. A procurement-owned audit will naturally emphasise cost and contracts, while an IT-owned audit may focus on security and technical fit. Making this mandatory ensures that every audit has a clear organisational home and point of escalation.
Question: Primary contact person
Justification: The primary contact is the individual accountable for the audit's completion and accuracy, and serves as the point of contact for all subsequent communications. Without a named contact, there is no one to clarify findings, provide additional data, or coordinate action plan implementation. This field is essential for establishing personal accountability and enabling effective two-way communication throughout the audit lifecycle.
Question: Email address
Justification: The email address is the primary communication channel for all audit-related correspondence, including follow-up questions, findings distribution, action plan tracking and notification of upcoming renewal deadlines. Without a valid email address, the audit team cannot effectively communicate with the respondent, which would severely undermine the audit's utility and the organisation's ability to act on the findings. This is a practical necessity for any collaborative audit process.
Question: Approximate number of employees in the organisation
Justification: Employee count is the standard denominator for benchmarking subscription metrics such as per-employee spend, licence utilisation ratios and portfolio complexity. Without this figure, it is impossible to meaningfully compare the organisation's subscription management maturity against peers or industry benchmarks. The use of 'approximate' appropriately reduces the burden while capturing the order of magnitude needed for analysis. This field is essential for contextualising all financial and operational data collected in the audit.
Question: Audit period start date
Justification: The audit period start date defines the temporal boundary of the review and is essential for ensuring data relevance and comparability. It establishes which subscriptions, contracts and financial data fall within scope. Without a clearly defined start date, the audit's coverage is ambiguous, and year-over-year comparisons become unreliable. This date is a foundational element of the audit's scope definition.
Question: Audit period end date
Justification: The audit period end date completes the temporal scope definition and is equally essential as the start date. Together, these dates establish the window of analysis and enable proper interpretation of all data collected. They also help identify any gaps in coverage and ensure that the audit captures a complete and consistent period. Without this date, the audit's temporal boundaries are undefined.
Question: Date this form was completed
Justification: The completion date establishes when the audit was finalised, which is critical for assessing the timeliness and current relevance of the findings. In fast-moving SaaS environments, data can become stale quickly, and stakeholders need to know how recent the information is when making renewal decisions. This date also supports audit trail integrity and document management.
Question: What type of audit is this?
Justification: Categorising the audit type is essential for proper interpretation of the findings and for benchmarking across different audit cycles. A full inventory audit, a targeted review and a compliance-driven audit have fundamentally different scopes, methodologies and expected outcomes. Making this mandatory ensures that every audit is properly classified, which aids in comparison, resource planning and setting appropriate expectations for the depth and coverage of the findings.
Question: How complete is the inventory captured in this audit?
Justification: This question is a critical data quality indicator that honestly assesses the coverage of the audit. It directly affects the reliability of all subsequent findings and recommendations — an audit claiming 90–100% completeness provides much stronger evidence than one at 50–74%. Making this mandatory prevents organisations from presenting incomplete data as comprehensive and highlights areas where improvement is needed. It also helps stakeholders calibrate their confidence in the audit's conclusions.
Question: Total number of active subscriptions and software licences identified
Justification: This is the headline metric of the inventory section and the fundamental unit of analysis for the entire audit. The total number of subscriptions directly correlates with cost, administrative overhead, security exposure and management complexity. Without this number, the audit lacks its most basic quantitative foundation. Making this mandatory ensures that every audit provides this essential baseline metric.
Question: Does the organisation maintain a central software asset register?
Justification: A central software asset register is the foundation of effective subscription management, enabling visibility, control, compliance and cost optimisation. This question assesses a fundamental maturity indicator that directly affects the organisation's ability to manage its subscription portfolio proactively. The conditional follow-ups capture either the register's currency (update frequency) or the barriers to establishing one. Making this mandatory ensures that every audit addresses this critical governance control.
Question: Earliest upcoming renewal date in the portfolio
Justification: The earliest renewal date drives the timeline and urgency of the entire audit and action plan. If the nearest renewal is imminent, decisions must be made quickly to avoid unwanted auto-renewals or missed negotiating opportunities. This date is essential for prioritising audit activities and ensuring that findings are delivered in time to influence renewal decisions. Without it, the audit cannot be properly sequenced against the organisation's renewal calendar.
Question: Are renewal reminders or alerts configured for every subscription?
Justification: Renewal reminders are a fundamental control mechanism that prevents missed deadlines, unwanted auto-renewals and lost negotiating leverage. This question assesses whether the organisation has basic renewal management controls in place. The conditional follow-ups capture the adequacy of reminder lead times or the current tracking methods and improvement plans. Making this mandatory ensures that every audit evaluates this critical operational control.
Question: Total annual spend on subscriptions and software
Justification: Total annual spend is the headline financial metric of the audit and the baseline against which all cost optimisation efforts are measured. Without this figure, the audit cannot quantify the financial stakes, measure savings, or compare against budgets and benchmarks. This is the single most important number in the financial analysis section and is essential for executive reporting, budgeting and renewal decision-making.
Question: Budget allocated for software and subscriptions for the upcoming year
Justification: The allocated budget enables comparison with current spend, highlighting potential gaps or surpluses that require action. If current spend exceeds the budget, urgent cost optimisation is needed; if there is headroom, there may be opportunities for strategic investment. This comparison is essential for financial planning and for setting realistic targets for the renewal cycle. Without the budget figure, the audit's financial analysis lacks the forward-looking dimension needed for effective planning.
Question: What proportion of purchased licences are actively used across the portfolio?
Justification: Licence utilisation is the single most common source of wasted subscription spend, and this question directly addresses it. The graduated scale captures meaningful distinctions in utilisation levels, while the 'Unknown' option honestly reflects organisations that don't measure this metric — which is itself a finding. Making this mandatory ensures that every audit confronts the utilisation question, which is essential for identifying cost savings and improving the return on subscription investments.
Question: Are all contracts and renewal notices stored in a central, searchable repository?
Justification: Centralised contract storage is a fundamental governance control that enables effective renewal management, compliance verification and risk assessment. Without it, contracts may be scattered across multiple locations, making it impossible to manage renewals proactively or verify contractual terms. This question assesses a critical maturity indicator and the conditional follow-ups capture either the storage methodology or a commitment to improvement. Making this mandatory ensures that every audit evaluates this essential control.
Question: Are there clear clauses covering data ownership, data return and portability at exit?
Justification: Data ownership and portability clauses determine whether the organisation can retrieve its data if a vendor relationship ends, in what format, within what timeframe and at what cost. Without these clauses, organisations face vendor lock-in, data loss risk and potential compliance violations. This question addresses a critical contractual risk that has significant legal, operational and financial implications. Making this mandatory ensures that every audit evaluates this essential protection.
Question: Has a security review been performed for each critical vendor within the last 12 months?
Justification: Regular security reviews of critical vendors are a fundamental security control that helps identify vulnerabilities, ensure compliance and maintain an up-to-date risk posture. Given that every SaaS subscription introduces potential security exposure, this question ensures that the audit addresses vendor security as a core concern. The conditional follow-ups quantify coverage or identify gaps and remediation timelines. Making this mandatory ensures that security review status is assessed in every audit.
Question: Is multi-factor authentication enforced across all subscription services?
Justification: Multi-factor authentication is one of the most effective security controls against unauthorised access and is a baseline expectation in most security and compliance frameworks. This mandatory question ensures that every audit addresses MFA coverage across the subscription portfolio, which is essential for maintaining an adequate security posture. Without MFA enforcement, the organisation is vulnerable to credential-based attacks that could compromise sensitive data stored in third-party systems.
Question: Is there a documented exit strategy for each critical vendor?
Justification: Exit strategies ensure that the organisation can transition away from a vendor if needed, whether due to performance issues, vendor failure, cost concerns or strategic changes. Without documented exit strategies, the organisation faces significant business continuity risk, particularly for business-critical subscriptions. This question addresses a fundamental risk management control, and making it mandatory ensures that every audit evaluates the organisation's preparedness for vendor transitions.
Question: What is the overall approach for the next renewal cycle?
Justification: This question establishes the strategic direction for the renewal cycle, which frames all subsequent decisions and actions. Whether the organisation plans to renew all subscriptions, consolidate selectively, aggressively reduce the portfolio or invest in new capabilities, this strategic posture determines how findings should be prioritised and what actions should be recommended. Making this mandatory ensures that every audit concludes with a clear strategic direction that guides implementation.
Question: Will you benchmark prices against market alternatives before each major renewal?
Justification: Market benchmarking is a fundamental negotiation best practice that provides the evidence base for challenging vendor pricing and negotiating better terms. Without benchmarking, organisations are at a significant disadvantage in renewal negotiations and risk accepting inflated prices. Making this mandatory signals that passive acceptance of renewal quotes is not acceptable and that data-driven negotiation is a core expectation of the subscription management process.
Question: Was feedback collected from end users or budget holders as part of this audit?
Justification: Stakeholder feedback is essential for ensuring that renewal decisions reflect the real-world experience of the people who use the software daily. Data alone cannot capture user satisfaction, workflow impact or emerging needs. This mandatory question ensures that every audit incorporates stakeholder perspectives, which is critical for making balanced decisions that optimise cost without harming productivity or morale. The conditional follow-ups capture response rates or plans for gathering input before final decisions.
Question: Summarise the top three findings from this audit.
Justification: This mandatory field distils the audit's most important findings into a concise, actionable summary that serves as the executive headline. Without this summary, stakeholders would need to review the entire form to understand the key takeaways. The placeholder example demonstrates the expected format: numbered findings with specific, quantifiable impacts. This summary is essential for executive communication, action planning and measuring the audit's value.
Question: Target date by which all actions should be completed
Justification: The overall action completion deadline creates accountability and urgency for implementing the audit's recommendations. Without a deadline, action items can languish indefinitely and the audit's value diminishes over time. This date should align with the organisation's renewal cycle and strategic planning calendar to maximise impact. Making this mandatory ensures that every audit produces a time-bound action plan with clear expectations for delivery.
Question: I confirm that the information provided in this audit is accurate and complete to the best of my knowledge.
Justification: This declaration establishes the respondent's formal accountability for the accuracy and completeness of the audit. It is a standard governance control that ensures the audit record carries appropriate weight and credibility for decision-making purposes. Without this declaration, the audit's findings could be challenged or disregarded. Making this mandatory ensures that every audit submission is formally attested by a responsible individual.
Question: I agree to retain supporting documentation (invoices, contracts, usage reports) for future audits.
Justification: Document retention is essential for supporting the audit's findings, enabling future verification and maintaining compliance with record-keeping requirements. This commitment ensures that evidence is preserved for dispute resolution, regulatory examination and subsequent audit cycles. Making this mandatory reinforces the importance of documentation discipline and ensures that the audit is supported by a complete evidence trail.
Question: Full name of signatory
Justification: The signatory's full name provides formal identification and accountability for the audit declaration. It creates a clear audit trail linking the completed form to a specific individual who has attested to its accuracy. Without this identification, the declaration lacks personal accountability and legal weight. This field is essential for governance, compliance and record-keeping purposes.
Question: Role/position of signatory
Justification: The signatory's role establishes their authority and competence to attest to the audit's accuracy. A signatory in an appropriate role (such as IT Asset Manager or Head of Procurement) lends credibility to the audit, while an inappropriate signatory may raise questions about the audit's rigour. This field is essential for assessing the audit's governance quality and for establishing clear organisational accountability.
Question: Signature of auditor/reviewer
Justification: The signature — whether physical or electronic — provides formal authentication of the audit declaration and creates a legally meaningful record of attestation. It transforms the audit from a simple data collection exercise into a formal governance document with accountability. Without a signature, the declaration lacks the formality and weight needed for executive decision-making and compliance purposes.
Question: Date of signature
Justification: The signature date establishes when the audit was formally approved and attested, which is essential for audit trail integrity and document management. It helps determine the currency of the findings and ensures that the audit record is properly sequenced within the organisation's governance timeline. This date is a critical element of the formal sign-off process.
The Annual Subscription & Software Renewal Audit Form employs a well-calibrated mandatory field strategy that appropriately prioritises critical identification, financial, governance and decision-making data while leaving supplementary and contextual fields optional. The distribution of mandatory fields across all 16 sections ensures that every section contributes essential data to the audit record, preventing any section from being skipped entirely. The mandatory fields are concentrated in areas where data quality is most critical: organisational identification, audit scope definition, financial baselines, inventory completeness, renewal timelines, security controls, strategic direction and formal sign-off. This approach strikes an effective balance between data completeness and user burden, as the mandatory fields are generally quick to answer (dates, numbers, yes/no questions, short text fields) while the more time-intensive fields (tables, open-ended narratives, matrix ratings) are mostly optional.
However, several strategic improvements could enhance the mandatory field strategy. First, the form contains conditional mandatory follow-ups (such as the incident description fields triggered by 'yes' answers to security incident, auto-renewal incident and support issue questions) that are appropriately mandatory when triggered but could benefit from clearer guidance on expected detail levels to prevent incomplete responses. Second, consider making the "Reporting currency used throughout this form" field mandatory, as all monetary values throughout the form depend on correct currency interpretation, and an ambiguous currency could render the entire financial analysis unreliable. Third, the "Total annual spend on subscriptions and software" and "Budget allocated" fields are correctly mandatory, but the related field "Percentage of the total IT budget spent on subscriptions (%)" could be made conditionally mandatory (required when both total spend and IT budget are known) to enable benchmarking. Fourth, for forms completed by larger organisations, consider implementing section-level progress indicators and the ability to save partial responses, as the sheer volume of mandatory fields across 16 sections may lead to abandonment if the form cannot be completed in a single session. Finally, the Declaration & Sign-Off section's mandatory fields are exemplary — they create a complete, accountable audit trail — but consider adding an optional field for the signatory's digital certificate or authentication method to strengthen the legal weight of the electronic signature in jurisdictions where this is relevant.
To configure an element, select it on the form.