AI Tool Stack Audit: A Quarterly Review That Cancels What Nobody Uses and Keeps What Moves a Number
Most businesses have more AI subscriptions than AI workflows. A stack audit lists every tool, ties each to a measured workflow or to nothing, and decides. Here is the method, the sheet, and what to do with the result.
On this page
An AI tool stack audit is a quarterly review in which a business lists every AI tool and subscription it pays for or has connected, ties each one to a workflow with a measured number or admits it is tied to nothing, checks what data each tool can see and what it can write to, and decides what to keep, merge or cancel. Most businesses have more AI subscriptions than AI workflows. The audit is how that ratio gets corrected, and it usually pays for itself in the first hour.
Direct Answer
Run an AI tool stack audit every quarter: inventory every tool, assign each to one of the five stack layers, map it to a measured workflow or mark it unmapped, check its data terms and permissions, name its owner, and decide. Tools with a workflow and a moving number stay. Tools that duplicate another at the same layer merge. Tools mapped to nothing are cancelled unless someone commits to a workflow and a baseline within the quarter. The first audit takes half a day and finds duplicates and dormant subscriptions; every audit after takes an hour.
Key Takeaways
- One row per tool. Layer, workflow, number, data, permissions, owner, decision.
- A tool without a measured workflow is a cost, not a capability.
- Duplicates at the same layer merge. Dormant subscriptions cancel.
- Data terms and permissions are audited with the same rigour as cost.
What does the audit sheet look like?
| Column | What goes in it | Why it matters |
|---|---|---|
| Tool | Name and plan | The inventory |
| Layer | Model access, workflow tool, inbox and CRM connection, retrieval, evaluation | Reveals duplicates |
| Workflow | The specific workflow it runs, or “none” | Ties cost to purpose |
| Number | The baseline and current value for that workflow | Proves it moved something |
| Data terms reviewed | Date and by whom | Policy is a fact, not a feeling |
| Can see | Which systems and data it reads | Exposure |
| Can write | Which systems it can change, and whether approval is required | Risk |
| Owner | The person who administers and answers for it | Accountability |
| Decision | Keep, merge, cancel, or commit-by-date | The output |
The five layers come from best AI tools for business. IBM’s intelligent automation overview is a useful reference for the workflow column; a tool that is not part of any rule-plus-model workflow is rarely earning its subscription.
Why do businesses end up with more tools than workflows?
Because tools are bought when someone is excited and cancelled when someone is auditing, and auditing is rarer. A team member trials a tool, pays for a month, uses it twice, and the card keeps being charged. A second person, unaware, buys a different tool for the same job. Six months later there are three transcription tools, two writing assistants and a chatbot nobody remembers connecting to the website.
None of those are connected to a workflow with a number. That is the test. A tool that runs enquiry triage and moved time-to-first-reply from a day to an hour has a row with numbers in it. A tool that someone liked has a row with “none”. The audit does not need judgment for the second case. The measurement approach that makes the numbers meaningful is set out in AI workflow audit: why hours saved is the wrong score.
How to run an AI tool stack audit
- Find every tool. Card statements, expense reports, the browser extension list, connected apps in Google Workspace or Microsoft 365, integrations in the CRM. The connected-apps lists find the ones nobody pays for but that can still read data.
- Fill the layer column. Duplicates at the same layer appear immediately.
- Map each tool to a workflow. Ask the owner. If nobody owns it, that is the finding.
- Fill the numbers. Baseline and current, for the workflow. If there is no baseline, write that.
- Check data terms and permissions. For each tool: what it can see, what it can write, whether writes require approval, and when someone last read the terms. The NIST AI Risk Management Framework is a structure for this if the business wants one. For tools that connect to systems through an API, the permissions are visible in the integration’s scope; OpenAI’s function calling guide describes the model side of what such a connection can do.
- Decide per row. Keep with a workflow and a number. Merge duplicates. Cancel unmapped tools, or set a commit-by date for someone to build the workflow and record a baseline.
- Write the decisions with a date and put the next audit in the calendar.
What an AI tool stack audit is not
It is not a cost-cutting exercise. It usually cuts cost, but the point is that every remaining tool is tied to a workflow someone owns and measures. A stack of three tools with numbers is stronger than twelve without.
It is not a one-time cleanup. The reason the sheet exists is that the second audit takes an hour.
And it is not only about subscriptions. Free tools with broad permissions to the CRM are audited with the same rows, because the exposure is the same whether or not a card is charged. The ongoing cost of the workflows that survive is covered in AI automation cost: what an AI workflow actually costs after it goes live.
Summary
An AI tool stack audit lists every tool, assigns it a layer, ties it to a measured workflow or to nothing, checks data terms and permissions, names an owner, and decides: keep, merge, cancel, or commit by a date. The first pass takes half a day and finds the duplicates and the dormant subscriptions; every quarter after takes an hour. What survives is a stack where every tool has a number and an owner. The wider library is under AI tools; if you want the audit run against your workflows with me, that is workflow discovery.
Frequently asked questions
What is an AI tool stack audit?+
A quarterly review that lists every AI tool and subscription the business pays for, ties each to a workflow with a measured number or to nothing, checks data terms and permissions, and decides what to keep, merge or cancel.
How long does an AI tool audit take?+
Half a day the first time, mostly finding the subscriptions. An hour each quarter after that, because the sheet already exists.
What is the most common finding?+
Two or more tools doing the same job, and at least one paid subscription nobody has opened in a month. Both are cancelled or merged in the first audit.
What should we check besides cost?+
Whether each tool is connected to a workflow with a baseline, what data it can see, what it can write to, who administers it, and whether the current terms are ones the business has read.
What should the audit produce?+
A sheet with one row per tool: layer, workflow, measured number, data terms reviewed, permissions, owner, decision. And a short list of decisions with a date.
Sources
- AI Risk Management Framework: NIST
- What is intelligent automation?: IBM
- Function calling: OpenAI
