The complete list of your ICT suppliers is in accounts payable. Start the register there, not in IT.

Ask IT for the list of suppliers the organisation depends on and you will get the list of suppliers IT knows about. It will be a good list. It will also be a list of the things installed by people who tell IT what they install.

The purchase ledger has no such gap. Every supplier that has ever been paid is in accounts payable, because that is the one system in the building nobody can route around: no invoice, no money. Start there and your first pass is complete on the day you begin, and wrong in ways you can see. Start in the asset inventory and it is incomplete in ways you cannot.

What this gets you, and the three things it does not

It gets you a defensible list of who you pay, what for, and who inside the building owns the relationship. Call that the spine. Every register any instrument asks for is the spine plus fields, and the fields are the cheap part.

It does not tell you whether you could survive losing any of them. Criticality is a judgement made by people in a room after the list exists. The list is the input to that conversation and gets mistaken for its output about once a quarter.

It does not satisfy any particular instrument. DORA's register of information has a prescribed structure — templates, identifiers, relationship types — and I have not opened the implementing standard for this piece, so nothing below is authoritative for it. NIS2, the AI Act and the record of processing you already keep each want a different cut. The spine turns each of those into a mapping exercise rather than a fresh discovery exercise, and discovery is where the months go.

And it does not stay accurate. It is a photograph of a fortnight in procurement. Anything sold to you as a living register is being sold to you.

Before you start

Three things, none of them software.

Read access to the purchase ledger, with the ability to export twenty-four months to a spreadsheet yourself. Asking finance to run it for you adds four days and one misunderstanding about what a supplier is.

A named person in finance who will answer a question the same week. You will have about nine.

And a decision, taken before you open anything, that the first version ships incomplete. Registers fail to exist because somebody insisted on getting one right the first time.

Two or three days of one person's time at a couple of hundred staff, spread across a fortnight because of step six. Six weeks if the first decision anybody makes is to buy a tool, which is not a criticism of tools: it is that a tool imposes a schema on the day you know least about what you are inventorying.

The steps

1. Export twenty-four months of paid invoices by supplier, with amounts. Twenty-four rather than twelve, because annual licences renew once a year and a twelve-month window shows each one exactly once or not at all depending on where you happen to cut.

2. Collapse the rows to one line per legal entity. The trap is on this line: the same vendor appears three times under three trading names, and one of those three is a reseller. Keep the reseller separate rather than merging it, because who you contract with and whose software it is are two questions and the register will eventually ask you both.

3. Strike out everything that is not ICT. Coffee, cleaning, the lawyers. Do this fast and accept that you will do it badly; step six gives it back to you. Keep the struck rows in a second tab rather than deleting them, because we considered it and excluded it is an answer to a supervisor and it is not in here is not.

4. Put a person's name against each remaining line. A person, not a department, because departments do not renew contracts. Where nobody will accept the name, write "unowned" and keep moving. Unowned suppliers are the ones that renew silently, so that count is the most interesting number you will produce this week.

5. Add three columns and stop. What it does, in one line. Whether it touches personal data. Whether the business stops that same day without it. Three, because a register with fifteen columns in January is a register with fourteen empty columns in March, and an empty column is read as a false answer.

6. Send the struck list back to the owners and ask one question: what are we paying for that is not on here. Expenses claims, departmental cards, anything under the approval threshold. This is the step that takes the fortnight, and the step that finds the fourth-largest AI subscription in the company.

7. Freeze it, date it, and write the method on the first page. Where the data came from, what window, what was excluded and by whom. A file with a date and a method is a register. The same file without them is a rumour that gets quoted in a board pack anyway.

How to tell it worked

Pick three services you personally know are in use and look for them. If one is missing, the finding is not the supplier — it is the payment route it arrived by, and that route has others behind it.

Then ask your contact in finance to name a supplier she would expect to see. If she names one that is absent, you have not got the list you think you have.

The real test comes later and without warning. Somebody asks who processes payroll data, and you answer from the file, in under a minute, without ringing anyone.

How to undo it

The file itself reverses trivially, which is not the risk. The risk is that a photograph gets used as an assurance artefact, and the way back from that is not deletion. Deleting a register is the worst-looking act available to you afterwards.

If it is being over-read, restate the method and the date at the top and recirculate, rather than withdrawing the document. And when an owner disputes their name against a line, do not argue and do not quietly drop the row: mark it disputed, with the date. A register that loses the entries people object to is worse than no register, because it looks like one.

What comes next

Criticality, then exit, in that order, and both of them are conversations rather than spreadsheets. The spine is what turns do we use them into a lookup, which leaves only the question worth a meeting.

None of the instruments has yet asked you the harder one, which is what your suppliers depend on in turn. Three of the lines you produce this week resolve to the same two data centres, and nothing in the ledger will tell you which three.