Maintain a single list of every tool the business uses — SaaS, internal apps, business-critical spreadsheets, AI tools, scripts, automations. A spreadsheet is fine. The act of keeping it up to date is half the audit.
How to use this: The bracketed items like [Company Name] are placeholders — replace them with your own details. Edit the wording to suit your business. This is a starter, not legal advice.
Columns
Use these columns as a starting point:
| Field | Meaning |
|---|---|
| Name | Tool's display name. |
| Category | SaaS, internal app, spreadsheet, script, AI. |
| Owner | Named person responsible. |
| Backup owner | Who picks it up if owner leaves. |
| What it does | One sentence. |
| Data it touches | Customer / Employee / Financial / None. |
| Who has access | Number of users; admin count. |
| Approved? | Yes / No / Under review. |
| Renewal date | If applicable. |
| Notes | Risks, dependencies, plans. |
Example rows
| Name | Category | Owner | Data | Approved? | Notes |
|---|---|---|---|---|---|
| Microsoft 365 | SaaS | Andy | All | Yes | Tenant-wide MFA on. |
| Xero | SaaS | Sam | Financial | Yes | Cyber Essentials cert. |
| CRM access spreadsheet | Spreadsheet | Priya | Customer | Yes | Should migrate to HubSpot. |
| ChatGPT (free) | AI | Mark | Should be: none | NO | Move to Copilot. |
| Power Automate flow #14 | Internal app | Priya | Financial | No | One-person dependency. |
How often to review
- Whole register: quarterly.
- Approved? = No rows: monthly.
- When a person leaves: their owned rows, before they go.
Tips for adoption
- Start it today. An incomplete register is more than 90% of SMEs have.
- Use it before procurement decisions.
- When someone leaves, work this register before you close the laptop.