Finance asked me to explain a 22 percent jump in software spend last quarter. Nobody bought anything new. No department upgraded a plan. The money just vanished into a pile of recurring charges that had been quietly growing since January.
I found the culprit in about an hour. It wasn't a rogue purchase or a vendor price hike. It was orphaned accounts, people who had switched teams or left the company entirely, still holding paid seats on eleven different platforms. Sales reps who moved to marketing three months ago were still billing against the sales tool. Two contractors who finished their contracts in the spring were still active users on the design suite.
That's the real story behind most software bills that creep upward. Every join and every move creates a chain of entitlements nobody tracks. When you finally look at it closely, the fix usually isn't another spreadsheet. It's tighter access provisioning tools that tie seats to actual roles instead of leaving them floating after someone changes jobs. Provisioning just means granting and revoking access. Most companies are decent at the granting part. They are terrible at the revoking part, and that gap is where the money goes.
Where the Money Actually Leaks
Picture the Tuesday morning when a support agent gets promoted to team lead. She gets new permissions in the ticketing system, a higher-tier plan in the analytics dashboard, and admin rights on two internal tools. Nobody remembers to strip her old queue permissions or her old plan. She keeps both. That's a small overspend. Multiply it by two hundred employees over a year and you have a line item that makes your CFO want to schedule a meeting.
Departed employees are the bigger problem. When someone leaves, their accounts don't always close on the same day. A finance team member who leaves in March might still have an active license in June because the deprovisioning step lives with whoever remembered, not with a system that enforces it. The U.S. Bureau of Labor Statistics tracks how often people change roles across the economy, and the numbers make clear that job movement is a constant, not an event you can handle manually. With that much churn, no HR manager is going to catch every stale account by hand.
Then there's the shadow layer. Someone spins up a free trial, forgets to cancel, and now it's a monthly charge on a corporate card that nobody questions because it's small. Small charges add up faster than big ones because nobody audits them.
The Two Types of Provisioning You're Actually Choosing Between
Manual provisioning means a human sits down and creates accounts one by one, usually following a checklist. Automated provisioning connects your HR system to your directory and the apps downstream, so a new hire shows up on day one with the right access already in place. There's also a middle option where you build your own scripts and hope nothing breaks. I've watched three companies try that route. Two of them ended up back on a vendor tool within eighteen months.
The right choice depends on your headcount and how fast your org chart changes. Under fifty people with a stable team, manual might hold up. Over that, you're gambling that nobody forgets a step during a busy onboarding week. I'd take the automated route even at thirty people, because the cost of one missed revocation is usually higher than the monthly fee.
What Good Provisioning Actually Buys You
Beyond the savings, you get something less visible: a clean audit trail. The National Institute of Standards and Technology publishes access control guidance for exactly this reason. Knowing who had access to what, and when, is the difference between a fast answer during an audit and a week of digging through old emails.
You also get faster onboarding. A new hire who can log in on day one and reach every tool they need doesn't spend their first week waiting on IT tickets. That's not a perk. It's the difference between a productive first month and a wasted one.
And you get fewer security gaps. Every dormant account is a door someone forgot to lock. The Society for Human Resource Management covers how much of a company's risk sits with people-related processes, and access is one of those processes most often left half-finished. Departed employees with live credentials are the kind of problem that looks like a small IT nuisance until something bad happens.
So how do you know if you have a problem? Here's the quick test I run.
- Pull a list of active licenses and match it against your current employee roster.
- Count the accounts that don't match a current employee.
- Look at how long the oldest orphaned account has been active.
- Check whether your HR system talks to your directory at all.
If step three turns up something older than ninety days, you're leaving money on the table every single cycle.
A Simple Routine That Keeps Seats Clean
You don't need a massive project to start. Pick one system, usually your directory, and wire it to your HR records so a termination date triggers a revocation automatically. Then set a monthly review where you spot-check twenty random accounts against their roles. It takes an hour and catches most of what's drifting.
The trick is making revocation the default, not an afterthought. I've seen teams leave a "deactivate anyway" rule in place so that if nobody responds within a set window, the account shuts off. That one setting recovered more budget than any negotiation I've sat through.
Before You Blame the Vendor
It's tempting to point at rising list prices, and sure, those exist. But most of the bloat I've seen lived inside our own mess. Vendors bill for what's active. If we never told them an account was dead, that's on us.
Start with the roster match. Fix the leaks you find. Then decide whether a provisioning tool earns its place in your stack. My bet is you'll find the money before you spend any of it.
