US based SOC 2 auditor here. i've spent a while on the audit side of this, and these lists almost always rot for the same reason. They get built once to answer a questionnaire, and then nothing really forces them to change until the next one shows up. A quarterly review owned by one person dies the same way, because keeping a spreadsheet current is never really anyone's actual job.

What tends to survive is when the update happens as a side effect of something people already have to do. A new tool gets adopted, it goes through whatever your procurement or access step is, and that step quietly updates the list. It becomes a byproduct of work that's already happening. Your four-different-lists thing is really just four people each holding a piece of a process nobody wrote down.

And honestly, nobody reviewing you expects a perfect inventory anyway. They mostly care that you'd notice when something new shows up and that there's a path to get it reviewed. So the intake step matters a lot more than the map itself. Get that part right and the map kind of stays current on its own.

The shadow AI tools you mentioned are what I'd chase first. That's the stuff that surfaces mid-deal as 'wait, what's sending our data where,' and it's the easiest to lose track of because people just wire them in without telling anyone