The tools nobody bought: auditing unsanctioned software in UK professional firms

Ask a partner in a mid-sized accountancy practice which systems the firm relies on and you will get a list. Ask the personal tax team the same question and you will get a different list, with several items the partner has never heard of. Somewhere between the two sits a spreadsheet holding the only reliable record of work in progress, and a subscription bought on a company card by someone who had a deadline and no time to raise a ticket.

None of this is sabotage. It is a rational response to a mismatch: the business needs an answer this week, and the central function is designed to deliver a controlled answer next quarter. Treating the resulting estate as a disciplinary matter wastes the one piece of intelligence it contains, which is an accurate picture of where the firm's real operating model has drifted ahead of its sanctioned one.

Why the spreadsheet keeps winning

Unsanctioned tools cluster around three gaps. The first is speed: a professional who needs to reconcile a client's records before a filing deadline will not wait for a change request. The second is specificity: general-purpose systems rarely model the way a particular practice actually sequences its work, so people build the missing twenty per cent themselves. The third is usability, which is often the same complaint wearing a different coat.

Regulated firms add a fourth pressure. Client confidentiality, legal privilege, retention obligations and anti-money-laundering record-keeping all mean that an unapproved tool is not merely untidy, it can be a reportable problem. That raises the stakes without changing the underlying cause.

Start with the data, not the inventory

A software discovery scan will give you an install list. It will not tell you what matters. The productive starting point is a short programme of conversations, four to six sessions across the functions that carry the most client-facing work, framed around three questions.

• Which files or systems would you be lost without if they disappeared tomorrow?
• Where does client data go between the moment it arrives and the moment the engagement closes?
• What do you export out of the main system, and why?

The answers produce a data-flow map rather than a shopping list, and that distinction matters. A tool that sits entirely inside the firm's tenancy and processes no client data is a different animal from a browser extension that receives a client's bank statements. Same category of unsanctioned, entirely different consequence.

Triage on two axes

Score each discovered tool on business value and on risk, and resist the temptation to average the two into a single number. Value is a judgement about time saved, work won, or quality improved. Risk is a judgement about confidentiality, retention, availability and regulatory exposure, informed by the firm's obligations under UK GDPR and its sector regulator.

That produces four recognisable groups.

High value, low risk. These are usually the easiest wins: a scheduling tool, a document comparison utility, a survey platform. Absorb them. Add them to the supported list, put them on a corporate contract where the volume justifies it, and give the team that found them the credit.

High value, high risk. The awkward middle, and generally where the most interesting finds sit: a matter-management database built in Access, a client portal running on a partner's personal cloud account. These need to be brought inside the tent rather than shut down. That means a named owner in IT, a data protection assessment, a contract, and a migration path to something supportable. Set a date and be honest about it.

Low value, high risk. Retire these, but never by simply switching access off on a Friday. Identify what the tool actually does for its users, provide a substitute that covers eighty per cent of the need, and publish a cut-off with support available in the weeks before it.

Low value, low risk. Leave them alone, or sweep them up at the next licence review. Not every harmless local habit needs a project.

Converting offenders into supported services

The commercial argument for absorption is straightforward. Every unsanctioned tool is a supplier relationship the firm is not managing, a renewal it cannot see, and a departure risk sitting with whichever individual happens to administer it. Bringing the useful ones into the supported estate converts invisible spend into visible spend and invisible dependency into managed dependency.

In practice this means a lighter procurement route for small tools: a short intake form, a decision within ten working days, and a published list of what is already approved so nobody rebuilds it. Firms that fail to offer a fast lane should expect the workaround to reappear within a quarter.

Keep the register alive

An audit is a snapshot, and snapshots age quickly. Keep a register with owner, data classification, contract status and review date, and revisit it each quarter alongside the software renewal calendar. Two further habits help: brief new joiners on the approved list during induction, and ask leavers to hand back administrative access to anything they subscribed to.

The wider point is cultural. Shadow IT is a signal about responsiveness, and the audit is only worth doing if the firm is prepared to hear that signal. Where the central function can demonstrate a fast, fair route to a yes, the population of unapproved tools tends to shrink on its own.