Most organisations have between four and nine technology vendors and a register that went stale in 2024. The fix is smaller than you think, and it is mostly about dates.
Ask a 150-person business how many technology vendors it has. The answer will be four or five. Then count the direct debits and it is fourteen.
The gap is not incompetence. It is that vendors are acquired one at a time, by different people, for good reasons, and nothing ever triggers a review of the whole set. Each addition is rational. The accumulation is not.
The three failures, in order of cost
Auto-renewal. The expensive one. A three-year contract with a ninety-day notice period renews because the reminder, if it existed, was set for the renewal date rather than for the deadline to give notice. You are now committed for another term at a price you did not negotiate.
Overlap. Two tools doing the same job because two departments bought independently. Typically a file sharing service and a collaboration suite, or two project tools, or three places people store passwords. The cost is not only the duplicate licence. It is that your data is now in two places and your policies apply to one.
Orphaned ownership. The person who selected the vendor has left. Nobody knows why the contract says what it says, nobody is confident enough to cancel it, and so it survives on the grounds that something might depend on it.
A register that survives contact
The reason most vendor registers die is that they were designed by somebody who enjoys registers. Forty columns, risk scores, a maturity rating. It is complete, it is admirable, and it is accurate for about five weeks.
The field that does most of the work is the owner, and it has to be a person. "Finance" does not get reminders and does not answer questions. A named individual does, and when they leave, the gap is visible.
The second most useful field is the one labelled "what breaks if this vendor stops tomorrow", because it is the only one that forces thought. Most entries will say something mild. Two or three will say something alarming, and those are your actual vendor risk, regardless of what any scoring model says.
Dates are the whole discipline
If you do nothing else: for every contract, put a reminder in a shared calendar at renewal date minus notice period minus thirty days.
That is it. That single habit prevents the most expensive failure mode, it costs ten minutes per contract to set up, and it does not require a register at all.
When the reminder fires, the question to the owner is deliberately blunt: would you buy this again today, at this price? Most of the time the answer is an immediate yes and the review takes four minutes. Occasionally it is a hesitation, and the hesitation is the signal.
Negotiating, briefly
Three things that move price, in rough order of effect.
Knowing the alternative. You do not need to be willing to switch. You need to know what switching would cost and what the competitor charges, and to be able to say so without bluffing. Vendors can tell the difference.
Timing. Most vendors have quarter and year ends and most give more ground near them. If your renewal falls awkwardly, ask to move it. A one-off short extension to align your renewal with their year end is usually granted and is worth having.
Term length. A longer term should buy a lower rate, and often does. It should also buy you a shorter notice period, and almost nobody asks for that. Ask.
What does not move price: explaining that your budget is tight. Every customer's budget is tight.
The questions that actually assess a vendor
Vendor risk questionnaires have grown to several hundred questions and the marginal value of questions 50 to 300 is close to zero. For a small or mid-sized business, five questions get you most of the signal.
Where is our data, and who can see it? Named countries, named categories of staff. A vendor who cannot answer this quickly has not thought about it.
What happens when we leave? Export format, how long you have, what it costs. Get this in writing at purchase, when you have leverage, not at exit when you have none.
What is your incident notification commitment? A timeframe and a route. "We will notify affected customers" without a number is not a commitment.
Do you have a current independent audit report? SOC 2 Type 2, ISO 27001, whatever fits their market. You do not have to read all 90 pages. Check it exists, check the date, and read the exceptions section, which is the only part that tells you anything.
Who else like us uses this? Not for the reference call, which will be positive. For whether they have customers of your size and shape at all.
Consolidation, carefully
The obvious response to fourteen vendors is to get to seven. Sometimes that is right. Two warnings.
Consolidating onto one platform reduces your vendor count and increases your concentration. If that platform has a bad year, you have fewer places to stand. This is a trade worth making knowingly rather than by default.
And the tool somebody is attached to is usually attached to for a reason you have not heard yet. Before you cut it, ask the owner what it does that the alternative does not. Sometimes the answer is nothing and it goes. Sometimes it is a workflow that holds up a function you did not know existed.
Where to start, if you are starting
An afternoon, in this order. Export twelve months of card and direct debit transactions and highlight anything that looks like software. That list is your real vendor inventory and it will contain surprises. Assign each one an owner by asking who uses it. Find the renewal date and notice period for the five largest by spend. Set the reminders.
That is most of the value, and it is one afternoon. The register, if you want one, can come later, once you know what belongs in it.
