Expense Audit: Finding Shadow IT in Your Financial Trail

What this method covers

Any shadow IT that leaves a financial trail through your corporate card issuer or expense reimbursement platform. That includes departmental SaaS subscriptions paid on corporate cards without IT review, personal-card SaaS subscriptions that were later reimbursed, vendor invoices paid through accounts payable, and annual SaaS renewals accrued in financial subledgers. For paid SaaS, this method is the most complete source of truth outside of a SaaS management platform deployment.

The step-by-step method

1. Work with the finance team to pull 12 months of transaction data from the corporate card issuer and the expense platform. Include merchant name, MCC, date, amount, card-holder or submitter, and memo. Twelve months captures annual renewals.
2. Also pull vendor payments from accounts payable for the same period, filtered for category codes consistent with software or digital services, plus a keyword search for common SaaS vendor names.
3. First-stage filter: MCC 5734, 5817, 5815, 7372, 7379, plus a keyword list of known SaaS merchants. This gives you candidate transactions, typically several hundred to several thousand rows.
4. Second-stage validation: cross-reference candidate merchants against the SSO gap baseline, check each merchant against a SaaS vendor database (Crunchbase, G2), sample memo fields for business justification. Drop false positives.
5. Consolidate: merge all rows by merchant, summing annual spend. Count distinct card-holders or submitters to estimate user count.
6. Annotate: for each merchant, add data-classification estimate, department concentration, and whether the app appears on the approved catalog. Apps paid for but not on the catalog are the shadow IT gap from this method.
7. Add to the consolidated registry. Flag consolidation candidates (same app paid for by multiple card-holders separately) as a priority for procurement review.

Typical findings and benchmarks

Practitioner patterns from discovery sprints: the same SaaS tool often appears as 10 to 50 separate personal subscriptions before consolidation; annual shadow spend surfaced by expense audit alone typically sits in the 1 to 3 percent of total IT spend range for partial-maturity mid-market organizations; the long tail of sub-$500 annual subscriptions often represents 40 to 60 percent of the distinct-app count but only 10 to 20 percent of the dollar spend.

These ranges are practitioner heuristics, not peer-reviewed benchmarks. They are offered as rough expectations to help you sanity-check your own results. Your numbers will depend on industry, company size, procurement maturity, and remote-work posture.

Blind spots

Free-tier SaaS leaves no financial trail; not visible here. Personal-card spend never reimbursed is not visible either (common for AI assistants bought by individual knowledge workers). Some SaaS purchases are buried in reseller invoices where the line-item detail is on a separate invoice; AP reconciliation often misses these. Non-SaaS shadow IT (browser extensions, local tools, open-source) is entirely out of scope for this method.

Output

Add detected apps to the consolidated shadow app registry from the discovery methods overview page. The annual-spend number from this method is the primary input to the observable spend cost category and feeds the board-ready exposure estimate on /measure-your-exposure.