# IT renewal teardown worksheet

Decide every recurring IT charge from its terms, use, evidence and exit cost.

## The charge nobody owns

Your predecessor, a board member, a department head or someone who left in 2022 signed the contract. The charge still lands every month. Nobody can name the users, show what it does or say what stops if you cancel.

Put the contract, invoice, console usage, owner and control evidence for each charge into one row. A controller, CFO, executive director or solo IT director can do it in about six hours, over three sittings. Write "unknown" wherever the record is blank.

## What a teardown is

A teardown examines each recurring charge against five facts. What does the contract say, and what is the product used for? Is it actually running, what else you own does the same job, and what would leaving cost?

This worksheet will never say twelve tools is too many. Twelve may be right, and eighteen may be defensible in a regulated firm with three offices. It gives no target share of revenue, since no such number survives scrutiny.

It will not push you to cut, either. A product stays when the evidence supports it. A documented keep is worth as much as a cancellation, since you will not argue it again next year.

**You need evidence to cut and evidence to keep.**

## Three sittings

1. **Find everything, in about two hours.** Judge nothing, and just build the list.
2. **Record contracts and usage, in about three hours.** This is the real work. Write "unknown" where you cannot answer, and move on.
3. **Decide, in about an hour.** Give each line one of six decisions, one owner and one date.

Finish the finding step completely first. A teardown that starts from "the tools we know about" only covers the spending already visible.

## Part 1: Find every recurring charge

Charges hide in more places than the accounts show. Work all nine sources, since each catches what the others miss.

| # | Source | What to pull | What it catches | What it misses |
|---|---|---|---|---|
| 1 | Accounts payable | 13 months of vendor activity, sorted by recurrence | Invoiced subscriptions, maintenance and support contracts | Card payments and items under a coding threshold |
| 2 | Card and ACH statements | 13 months, including every line under $500 | Small SaaS charges buried in "subscriptions" or "office expense" | Cards you do not control |
| 3 | Expense claims | 13 months, searched for "subscription", "annual", "renewal", "plan" and "license" | Subscriptions on personal cards | Tools nobody expenses because they are free today |
| 4 | Identity provider app list | Every connected and assigned app | Every tool set up with SSO | Tools that never used SSO |
| 5 | Public DNS and MX records | The full zone, including TXT records | Mail provider, mail security, marketing tools and every SaaS verification record | Tools needing no DNS change |
| 6 | OAuth grants in Microsoft 365 or Google Workspace | Apps with access, grant dates and who granted them | Tools staff connected to company data without a purchase order | Tools with no access to cloud data |
| 7 | Marketplace receipts | AWS, Azure, Google Cloud, Apple and Google Play line items | SaaS billed as one opaque line in a cloud bill | Vendors billed directly |
| 8 | Vendor mail | Payables and shared mailboxes searched for "renewal", "auto-renew", "invoice", "receipt" and "subscription" | Renewals nobody passed to finance | Mail sent to a departed person's mailbox |
| 9 | Department heads | "List every tool your team uses that we pay for, and any you think is free" | The gap between what is paid for and what is used | Nothing, if you ask everyone |

Pull 13 months, not 12. A yearly charge from 12.5 months ago falls outside a 12-month pull and is the likeliest to renew unnoticed.

### Match payables against SSO

Cross the identity provider's app list with the payables and card lists. Three cases appear.

| Case | What it means |
|---|---|
| In SSO and on an invoice | Normal, so go on to the worksheet |
| In SSO, with no invoice | Either truly free, or someone else pays. That is the hidden subscription, often a personal card claimed as a meal or office cost. Ask the person named in the OAuth grant |
| On an invoice, missing from SSO and the app list | Often a tool nobody has opened in a year, and often one with standing access to your data |

Check one more thing once. Does each subscription's account recovery address still exist?

If password resets go to a closed mailbox, you cannot cancel without a vendor support case. Find that out before a renewal, not during one.

## Part 2: Sheet 1, contract terms

One row per recurring charge. Fill it from the contract and invoice, never from memory or the vendor's website.

| Line | Vendor | Product | Yearly cost | Billing frequency | Term end | Auto-renews | Renewal length | Notice days | Notice method | **Decision date** | Seats billed | Owner | Where the contract is |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | | | | | | | | | | | | | |
| 2 | | | | | | | | | | | | | |
| 3 | | | | | | | | | | | | | |

- **Yearly cost.** Annualise everything billed separately, including platform fees, seats, support tiers, overages and setup still being paid off.
- **Term end.** Take it from the order form. If the form gives a start date and length, work out the end date and write it.
- **Auto-renewal and renewal length.** It is nearly always yes, but write it anyway to make yourself look. A one-year contract renewing into three years is a different deal from one renewing yearly.
- **Notice period.** The days before term end by which you must give notice to stop renewal, often 30 to 90. Some contracts need notice before the final quarter begins.
- **Notice method.** It may be email to a named address, a portal ticket, certified mail or a legal address. A cancellation sent the wrong way was never sent.
- **Owner.** A named person, never a department. If no name fits, record that as a finding.
- **Where the contract is.** The file path or system holding the signed order form. Most organisations cannot find a third of theirs.

### Work out the decision date

This is the most valuable step in the whole worksheet, and it is clerical.

1. **Use the order form, not the proposal.** The proposal is marketing, and the order form is what was signed.
2. **Follow the incorporated terms.** Most one-page order forms incorporate a master agreement or online terms. The term, renewal and notice language sits there under a heading such as "Term and Termination". Vendors update linked terms, so save a dated PDF of today's version.
3. **Diary the decision date.** Take the term end, subtract the notice period, then subtract fourteen days of working room. Put it in a shared calendar with the owner's name in the title. Windows get missed when people diary the renewal date instead.
4. **If the terms are missing, ask in writing.** "Please confirm our term end date, renewal length, the notice needed to prevent renewal, and the notice method." Keep the reply as your record.

Then sort by decision date, earliest first. Anything due within 60 days goes first whatever its size, since only those lines lose options by waiting.

## Part 3: Sheet 2, use and evidence

One row per line, matched to Sheet 1 by number.

| Line | Need or control served | Seats billed | Accounts that exist | Active in 90 days | Proof it works | Proof date | Overlaps with line | Integration cost | Exit cost, known | Exit cost, staff hours | Exit cost, unknown | What the adviser earns |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | | | | | | | | | | | | |
| 2 | | | | | | | | | | | | |

### Write the control served first

Write one sentence on what the product does for the organisation. Phrase it as an obligation or business need, not a product category.

"Endpoint security" is weak. "Detects and isolates attacks on 196 devices, and answers the EDR question on our insurance form" is strong. "Holds the evidence package our auditor needs in November" beats "compliance platform".

If nobody can write the sentence, the line is in trouble. Write "unknown" and settle it in the decision step.

### Seats billed against people using them

Take three numbers from three places. **Seats billed** comes from the invoice, not the contract or the console. **Accounts that exist** come from the admin console's user export.

**Active in 90 days** comes from that export, filtered by last activity. Thirty days is too short for seasonal or quarterly work.

Then look for five patterns.

| Pattern | How it shows | What to do |
|---|---|---|
| Disabled accounts still billed | The console shows them disabled, but the invoice count is unchanged | Reconcile at renewal, since many vendors bill provisioned seats |
| Leavers never removed | Last activity before a known departure | Remove them now, for security as much as cost |
| Shared accounts | "frontdesk", "scanner" or "info" | Decide whether each is needed, and who owns it |
| Seats for a finished project | A block created on one date and never used since | A candidate for reduction |
| Growth the invoice missed | More active accounts than seats billed | Fix it before the vendor's audit clause does |

Check the true-down rules before planning a cut. Many contracts allow fewer seats only at renewal, with notice. Some forbid cuts during a committed term, and a few allow cuts only to a stated floor.

### A licence is not a control

A licence is a permission. A control is something that operates, and the gap between them is where "is it even working" lives.

Ask one question that is hard to fake. Can someone show an artefact from the product itself, dated within 90 days, showing it did something?

| Product | Proof that it works | Proof of nothing |
|---|---|---|
| Endpoint detection | Enrolled devices against all known devices, with dated detections or policy changes | A licence count |
| Backup | A restore test showing what, when, how long and who checked | A green job dashboard |
| Email security | A block or quarantine report for a named period, with volumes | The vendor's global catch rate |
| MFA | The policy export, with scope and every exclusion | One user's sign-in screenshot |
| Logs or SIEM | Volume by source, and when a person last looked and what they did | Logs being collected |
| Vulnerability scanning | The latest dated scan, with fix status | A licensed, scheduled scanner |
| Compliance or GRC platform | The current evidence package and the last login date | The rollout plan |

Write the artefact and its date in the sheet, or "no evidence on record". That is a real finding, and the most useful one this worksheet produces.

A missing artefact does not prove a tool is idle. It proves nobody checked. And a tool running perfectly while serving no named control can still be retired.

### Two tools doing one job

Overlap is common and not always waste. Two products can cover one category at different depths for good reason.

It becomes waste when the second serves no control the first does not already meet. Compare the control sentences, never the product categories.

| Common pair | The question that settles it |
|---|---|
| Your mail platform's filtering and a separate mail gateway | Run both for 30 days and compare what each caught that the other missed |
| Built-in endpoint protection and a purchased detection product | Does either deliver triaged alerts to a person? |
| Identity provider MFA and a standalone MFA product | Is there a system the identity provider cannot cover, and is it still used? |
| Vendor-included SaaS backup and a third-party SaaS backup | Compare retention, deletion protection and restore detail against your actual duty |
| Two remote support tools | Which does the IT firm use, which do staff use, and is either needed? |
| A password manager and the identity provider's vault | Which holds the credentials that matter, including emergency accounts? |
| A VPN and the product bought to replace it | Was the VPN ever switched off? |

The last pair is the most common overlap of all. A replacement is bought, the move stalls at eighty percent, and the organisation pays for both indefinitely. Look for it by name.

### Integration cost

Record what it took, or would take, to fit the product in. That covers SSO, directory sync, log forwarding, ticketing, agent rollout and the staff hours spent. High integration cost argues against replacing a product that works, and against adding one that duplicates it.

## Part 4: Price the exit

Exit cost is guessed more than any other figure, and wrongly both ways. Vendors overstate it at renewal, and annoyed buyers understate it. Split it into three columns, as a board memo does: known dollars, staff hours and unknowns.

| Part | Where the number comes from |
|---|---|
| Remaining committed term | The order form. Eight months into a 36-month term is contractual, so check it first |
| Early exit fee | The termination clause. Some have none, and some charge all remaining fees |
| Data export | Whether you can export, in what format, and how long before deletion. Ask in writing and keep the answer |
| Retention duty | Records you must keep need a new home that meets the duty |
| Integration teardown | SSO, directory sync, log forwarding, ticketing hooks and removing agents from every device |
| Paying for both | The overlap period, usually 30 to 90 days, so budget for it |
| Migration and retraining | Staff hours, outside help and retraining time for each person. Be honest, since internal hours come out of someone's week |
| Bundle effects | Removing a discounted product may raise the price of the rest. Ask for unbundled prices |
| The control gap during the move | What covers the control while you switch, and for how long. It has no dollar figure, so describe it under unknowns |

A single exit number with no breakdown is an opinion. Three columns make it a finding that survives a budget meeting.

## Part 5: Who earns money from the renewal

Every line has a recommender, such as an IT provider, broker, consultant, reseller or someone inside with a preference. Record how that party is paid on the line. Ask in writing, plainly.

> For each product on the attached list, please state what your firm earns from our purchase or renewal. Please cover margin, commission, rebates, market development funds, partner tier credit, referral fees and any other compensation. Please give the approximate amount or percentage.

Record the answer, the date and who gave it.

A paid recommendation can be entirely right, and this column is not an accusation. It changes the burden of proof. A recommender paid on the purchase needs an independently stated requirement before the line moves on.

Rebates and partner tier credits are usually invisible to buyers and often the largest part. Ask for them by name, since someone can truthfully deny "commission" while earning a tier rebate.

A firm with no vendor income loses nothing by saying so in writing. A refusal to answer is itself an answer, so record it.

## Part 6: Running things past their support date

Some recurring costs are not subscriptions. They are the cost of running something past its support date, and each gets its own line and decision.

Windows 10 support ended on 14 October 2025, with no more help, updates or security fixes. Commercial Extended Security Updates start at US$61 per device in year one and double each year.

That doubling matters for a budget. A device on ESU costs more each year on a known curve. You can compare that directly with replacing or repurposing it.

| Field | Entry |
|---|---|
| Devices on Windows 10 | |
| Devices enrolled in ESU | |
| ESU cost in year one | |
| ESU cost in year two, doubled | |
| ESU cost in year three, doubled again | |
| Devices that can be replaced, with cost | |
| Devices that cannot be replaced, why, and the controls around them | |
| Owner and target date | |

Use the same layout for any unsupported item. Examples are an old business app, a firewall past its last firmware, an ageing server or an unpatched phone system. These items also appear on insurance forms and client questionnaires, so the work gets reused.

## Part 7: Sheet 3, the decision

Every line gets one of six decisions, including the lines you keep.

| Decision | Use it when | The row must hold |
|---|---|---|
| **Keep** | The control sentence is written, evidence is current, use matches billing, and nothing you own does the job | The evidence, its date and the next review date |
| **Renegotiate** | The product earns its place, but the price, term, seat minimum, auto-renewal or notice terms do not | The terms you want changed, the decision date and your walk-away point |
| **Reduce** | The product earns its place at a lower quantity or tier | The target quantity, the true-down rule and the notice date |
| **Replace** | The control is still needed, but this product fails it or something owned meets it | The control to keep, the replacement, the overlap period and the exit cost line |
| **Retire** | The control is no longer needed, or something already paid for meets it | Evidence it is covered or unneeded, and who accepted any remaining risk |
| **Defer for evidence** | You cannot decide because the evidence does not exist yet | **What evidence, who produces it and by when,** before the decision date |

The last decision carries the whole sheet. A defer without named evidence, an owner and a date is a renewal with extra paperwork.

Each deferred line needs a trigger that will actually fire, dated before the contract decision date. If that is impossible, deferral is not available, and you must decide on the evidence you have.

| Line | Vendor | Decision | Reason in one sentence | Evidence relied on | Owner | Action date | Yearly effect | Reviewed by |
|---|---|---|---|---|---|---|---|---|
| | | | | | | | | |

## Part 8: Four worked decisions

**This example is fictional.** Every number is illustrative, not a benchmark. The firm is a 90-person professional services firm with two offices, one IT person and an outsourced provider.

### Line 12, endpoint detection and response

| Field | Entry |
|---|---|
| Yearly cost | $34,200 |
| Term end, notice and decision date | 31 March 2027, 60 days, 15 January 2027 |
| Control served | Detects and isolates attacks on 196 laptops and servers. Answers the EDR question on the insurance form and two client questionnaires |
| Seats billed, accounts and active in 90 days | 196, 196 and 191. The gap is 3 spare laptops in storage and 2 meeting room machines |
| Proof it works | A console coverage report 12 days old, and three detections in 90 days, each with a ticket and closing note. The policy changed six weeks ago |
| Overlap | Built-in antivirus is present, but it sends no triaged alerts to the provider, and the purchased product does |
| Exit cost | $0 termination, 60 staff hours, and an unknown gap in detection during a move |
| What the adviser earns | The provider confirmed in writing in June 2026 that it earns a 12% margin on this renewal |

**Keep.** The control sentence is written, the evidence is current and independent, and the seats reconcile. The margin is recorded and changes nothing, since the evidence came from the console, not the provider. Review again in December 2026, before the January decision date.

### Line 27, password manager

| Field | Entry |
|---|---|
| Yearly cost | $8,400 for 140 seats |
| Term end, notice and decision date | 1 November 2026, 45 days, 3 September 2026 |
| Control served | Stores shared credentials for 31 client portals and the identity provider's emergency account |
| Seats billed, accounts and active in 90 days | 140, 118 and 84 |
| Proof it works | The vault log shows daily use by 6 teams. The emergency entry was opened and resealed in a documented May 2026 test. Cuts are allowed only at renewal, with 45 days' notice, to a floor of 50 seats |

**Reduce.** Cut to 95 seats, saving about $2,700 a year in this illustration. The product works and the evidence is strong, but the seat count dates from a 2023 headcount. Notice must go by 3 September, or 140 seats renew for a year.

### Line 31, a second email security gateway

| Field | Entry |
|---|---|
| Yearly cost | $11,900 |
| Term end, notice and decision date | 15 February 2027, 30 days, 2 January 2027 |
| Control served | Attachment and link filtering on inbound mail, bought in 2021 |
| Proof it works | A 90-day quarantine report shows 31 messages held |
| Overlap | A 2024 mail platform upgrade added attachment detonation and link rewriting, already paid for. A review of the 31 held messages found all 31 also flagged by the included tier |
| Exit cost | $0, 12 staff hours to change mail routing and MX, and no material unknowns |

**Retire.** Retire it at term end, after a documented 30-day side-by-side check across a full period. The controller owns that check. It saves $11,900 a year in this illustration.

A tier upgrade bought three years later made the older purchase redundant. Nobody re-examined it, because nothing forced them to.

### Line 44, compliance evidence portal

| Field | Entry |
|---|---|
| Yearly cost | $19,500 |
| Term end, notice and decision date | 1 December 2026, 60 days, 18 September 2026 |
| Control served | Unknown. Bought in 2024 for a client-driven audit, and its owner left in 2025 |
| Seats, accounts, activity and proof | 25 billed, 25 existing and 0 active, with the last login 14 months ago. The library holds 40 documents, all from 2024 |
| Relevant fact | An audit is set for November 2026 |

**Defer for evidence.** The evidence needed is the auditor's written answer on whether the package must come through this platform or as files. The controller owns it, due 5 September 2026, before the 18 September decision date.

If files will do, the line becomes retire that day. If the platform is required, it becomes keep, with a named owner before renewal.

### The four together

| Line | Decision | Yearly effect, illustrative |
|---|---|---|
| 12, endpoint detection | Keep | $0 |
| 27, password manager | Reduce | ($2,700) |
| 31, mail gateway | Retire | ($11,900) |
| 44, compliance portal | Defer, settled by 5 September | $0 to ($19,500) |

Four lines gave four outcomes and not one purchase, the usual shape of a first teardown. The savings came from a drifted seat count and a product made redundant by one already owned. The largest line was kept because the evidence supported it.

## Part 9: Where to start

- **Work the nearest decision dates first.** Handle anything within 60 days this week, whatever its size.
- **Take the free cuts before buying.** Seat true-downs, removing leavers and retiring a product replaced by one you own need no capital.
- **Chase the "no evidence on record" rows.** Ask each owner for the artefact by a date. Most resolve in two weeks, and the rest are telling you something.
- **Write the keeps down properly.** A documented keep stops next year's argument. It also answers much of a client questionnaire and the insurance form's controls section.
- **Set the calendar.** Every line gets a decision date in a shared calendar with a named owner. This habit prevents more waste than any buying policy.
- **Ask your renewal adviser one question.** After you present the teardown, ask which lines they would have flagged and why they did not. The answer shows what kind of relationship you have.

## Keep each row with the renewal approval

This worksheet is general guidance on examining recurring IT costs and contract terms. It is not legal or accounting advice, and it does not interpret your contracts.

Termination rights, auto-renewal enforcement and notice rules vary by contract wording and state. Have counsel review any termination or non-renewal notice before you send it. That matters most where an early exit fee or multi-year commitment is at stake.

SBK will give a second opinion on one renewal. Call (718) 407-4169.

Sources

- Microsoft Windows 10 end of support and ESU records, accessed August 2026

---

SBK Consulting · Version 1.0, August 2026 · https://sbkconsultants.com/resources/it-renewal-teardown-worksheet/