How to find software your team bought with their own cards

Software spend reaches a person before it reaches the company when a purchase is small, urgent and easy. Nobody is hiding anything; the tool solved a problem on Tuesday and the receipt went into an expense claim on Friday. That is also why the books show it as a one-line reimbursement to a person, not as a software vendor.

• Personal card, reimbursed: the charge never touches a company account, and the bill your books carry is the employee's name or a line in an expense claim.
• Personal card, never reimbursed: the employee absorbs it. Your books show nothing, and the tool still holds company data. These are found only by asking and by reading admin consoles.
• Free trial that converted: the card was entered once, and the first renewal landed on whichever card was used. Check the trial's end date in the employee's email, not only the statement.
• A team or department card: one card per department is a good control, and it also means the descriptor sits inside a lump of that team's spend. Read it line by line.
• App-store billing: mobile and desktop store purchases appear under the store's name, not the app's, so a vendor report groups them with nothing useful.

Start where the money is already recorded. In Xero, employees can submit claims from a receipt photo in the Xero Me app, approvers approve or decline them, and per Xero's page an approved claim becomes a bill you pay from the bank account (Xero says reimbursements can also go out in a payroll run or as a batch payment). That makes the approved claims themselves the list: every line is a purchase a person made for the company. See finding software in Xero for the report that totals it by contact, and filter the contacts for people, not vendors.

In QuickBooks Online, Intuit's help page covers reimbursing an employee through payroll with a reimbursement pay type, which keeps the payment out of the vendor report entirely. If you reimburse another way, such as a manual expense with the employee as payee, the same rule applies: the payee is a person. Run the transaction list for the last twelve months, filter to employee payees, and read the memo and attached receipts. Finding software in QuickBooks shows the vendor report this complements.

What to write down for each line: the date, the amount, who paid, the merchant name on the receipt, what it was for, and whether it recurs. If a receipt is a one-time amount, look for the same merchant in the next three months of that person's claims. Renewals often arrive as a second, differently named claim.

Reimbursed spend leaves a second trace: the payment to the employee in your bank feed. A reimbursement that is a round multiple of a typical monthly price, repeated, is worth opening. Then do the card and bank pass from the forgotten subscriptions guide for anything on the company card, so the two lists can be merged.

The consoles catch the tools that never cost anything, and the ones nobody reimbursed. In Google Workspace, an admin with the Service Settings privilege can go to Menu > Security > Access and data control > API controls, open Manage App Access, and View list under Accessed apps. Per Google's help page the list shows each app's name, type, ID, verification status, access level, number of users and requested services, can be downloaded as CSV, and details typically appear 24 to 48 hours after authorization. Each app can be set to Trusted, Limited, Specific Google data or Blocked.

In Microsoft 365, the equivalent is the Entra admin center. Per Microsoft's page, sign in as at least a Cloud Application Administrator, go to Entra ID > Enterprise apps > All applications, pick an app and open Permissions. The Admin consent tab shows what was granted for the whole organization and the User consent tab shows what individuals granted. Microsoft notes that user-consent grants cannot be revoked in the portal; that takes Graph or PowerShell.

Sort either list by number of users. An app with one user and broad data access deserves a conversation; an app with forty users is already a standard and needs an owner and a price.

Billing email is the one signal that follows the tool, not the card. Ask an admin to search the shared finance or billing mailbox for words like receipt, invoice, subscription, renewal and trial ending. Do not read employees' personal mail, and do not search anyone's inbox beyond what your own policy and the people involved are comfortable with. Employee accounts and the data inside them deserve care.

Then ask. The goal of the message is to learn what job each tool does, not who broke a rule. Something like this, sent to everyone, not to suspects:

"We are tidying up software spend and I want to learn what you use to get work done, not to check up on anyone. If you have bought, expensed or signed up for any tool for work in the last year, even a free one, reply with its name, what it is for, who else uses it, roughly what it costs and whether it holds customer or financial data. Nobody is in trouble. Tools that help are likely to stay; the goal is to put them on the company account so you stop fronting the cost."

Follow up one-on-one for anything that holds customer or financial data. If a person paid out of pocket and was never reimbursed, offer to settle that first. It is a good way to show the exercise is not about penalizing initiative.

Put every find on one sheet with these columns: tool, who uses it, job, annual cost, billing owner, data it holds, and the suite you already pay for that might do it. Then each row gets one of three outcomes. The columns come from the software spend audit checklist; it is the same sheet with the person who bought it added.

The sweep fades unless there is an easy path next time. A short rule works better than a long one: anything with a recurring charge, or any tool people sign into with a company account, gets a name on a shared list. Under a set dollar amount that you choose, a manager can approve it on the spot; above it, one person looks. Our software approval policy guide has a one-page version to adapt.

Pair the policy with a company card for software and a recurring review. The vendor register and renewal calendar turns the sheet you just built into the thing you check each quarter, and the ops stack for ten people shows what a small team can reasonably standardize.

Once you have vendor names and annual costs, paste them into the free audit. It matches names to the apps we cover and ranks them, in your browser, and sends nothing out of it. A connected version that reads your books directly is planned (see /savings) and is not open yet; the steps above need neither.