--- title: "The dependency audit: what switches your company off in 24 hours" url: "https://barbairians.com/blog/the-dependency-audit-what-switches-you-off-in-24-hours" description: "A one-day exercise for an owner. List every service, account, key and model the company cannot run without, who holds each one, and which have no way out." --- # The dependency audit: what switches your company off in 24 hours October 20, 2026·4 min read·BarbAIrianS Monday, a little after eight. The dispatcher at a regional haulage company opens the routing tool and gets a login page she has never seen. The account was registered years ago by a contractor who no longer works there, the card on file expired, and the vendor suspended the workspace over the weekend. Thirty drivers are standing in the yard with coffee. By ten the owner has found the contractor’s phone number. By noon he is on a support chat with a vendor in another time zone. The trucks leave at three, routed by hand from a printout of yesterday’s plan. Nothing was hacked. Nothing broke. One account that nobody owned simply stopped working. The cause is not the vendor and not the contractor. It is that nobody in the company had ever written down what the company runs on. Every system was adopted one at a time, each for a good reason, each by a different person, and the list that ties them together exists only in the heads of people who may or may not still be around. ## How the list goes missing **Every dependency was somebody’s sensible decision.** The accounting SaaS, the e-mail hosting, the API key in the integration, the model behind the chatbot. Each was chosen for a reason and each reason was fine. Nobody chose the sum, and the sum is what stops the trucks. **Ownership drifts to whoever clicked first.** The person who set up the domain, the payment account or the cloud project becomes its owner by default. When they leave, the ownership does not transfer; it just goes quiet until the day a renewal, a password reset or a security check needs them. **Keys look like configuration, not like assets.** An API key in a server file, a token in a spreadsheet, a certificate on a laptop. They are not in any register because they do not look like something worth registering. Yet one expired token can stop an entire integration. **Hosted models are the newest entry and the least visible.** The quoting assistant, the document classifier, the agent that reads incoming orders. Each one calls an endpoint somebody else can rename, reprice or retire. Few companies list that endpoint next to the ERP, although by now it may do more of the daily work. **The exit is assumed, never tested.** Everyone believes the data can be exported and the tool replaced. The belief is rarely checked, and the check only happens at the worst possible time: when the tool is already down or the price has already doubled. **The list sits in the IT corner.** When the question is raised at all, it is handed to the one person who manages the laptops. They produce a list of software. What the owner needs is a list of what stops the business, and that is a different document. ## What an owner should do instead **Take one day and make the list yourself.** Not the IT list. Walk through a normal day of the company, from the first order in the morning to the last invoice at night, and write down every external thing the day touches: service, account, key, model, domain, phone number. **Record three facts per line.** Who inside the company holds the credentials. What the exit path is: an export, a second supplier, a copy on your own metal, or nothing. And how long the company can operate without it before the loss becomes visible to a customer. **Name an owner for every line.** A person, not a department, and not the person who left. The owner’s job is small: know the password, know the renewal date, know the way out. **Separate the layers.** Hardware and hosting, models, data, orchestration. Sovereignty is a supply chain, and the audit is where you find out which links you actually control. A rented link is fine where a day’s outage would be a nuisance. It is not fine where the outage stops money coming in. **Put the list where the next renewal will see it.** The audit is not a one-off report. It is the document that sits next to every contract discussion, so that the exit cost is a number on the table rather than a surprise. We looked at how to price that cost in [your SaaS stack is a rental agreement](https://barbairians.com/blog/your-saas-stack-is-a-rental-agreement). ## The 24-hour test Take the list and ask one question of every line: if this stopped working at eight tomorrow morning, what would the company be doing at eight the morning after? Twenty-four hours is the frame of the exercise, not a figure from anywhere. It is long enough that a customer notices and short enough that nobody has time to improvise a replacement. Mark each line with one of three answers. We would be fine: there is a copy, a second supplier or a manual fallback. We would be slow: work continues, worse. We would be stopped: no order, no invoice, no delivery. Then look at the stopped lines and check their owner and exit columns. The result tells you something no vendor review does. Every line marked stopped that has no named owner or no exit path is where your company can be switched off by somebody else, for their reasons, on their schedule. That is the list to work from, and the model endpoints on it deserve the first look, because the contract behind them is the one most owners have never read. We take that contract apart in [the model contract: what not to sign](https://barbairians.com/blog/the-model-contract-what-not-to-sign-with-an-ai-vendor). Owners who have done this exercise and what they changed afterwards is the kind of story this podcast exists to record. What it is and who it is for is on the [home page](https://barbairians.com/). - dependency - vendor risk - exit cost - audit ## Keep reading - [AI factories in Europe: who will own the tokens](https://barbairians.com/blog/ai-factories-in-europe-who-owns-the-tokens) - [The model contract: what not to sign with an AI vendor](https://barbairians.com/blog/the-model-contract-what-not-to-sign-with-an-ai-vendor)