4 Misconceptions About Software Audits

Some years ago I shared Debra Brandt’s piece at Express Metrix on four common misconceptions about software audits, drawn from her firm’s survey. The four beliefs she tested are still the ones I hear from customers today. The vendors and the stakes have changed, so here is my own view of each, from the other side of many audits.

In short

• “Only big companies get audited.” No. Audits follow triggers, such as a merger, a hardware refresh or a pause in buying, not company size.
• “Only Microsoft audits.” No. Oracle, IBM, SAP, Broadcom for VMware, Adobe and Autodesk all audit, and Oracle’s audits are among the most expensive.
• “We understand our contracts, so we are compliant.” Understanding the contract is half the job. Deployments drift, and virtualisation and cloud change the count without anyone signing anything.
• “An audit is inevitable, so there is nothing to do.” Audits may come, but their cost is decided before they start: by your own records, your contracts and how you respond.

Misconception 1: Only the really big companies get audited

Large enterprises are audited more often because the revenue potential is larger, but smaller organisations are not safe. Audits follow triggers. With Oracle, the common ones are no new purchases for two or three years, a new sales representative, a merger or acquisition, a hardware refresh, a move to VMware, a decision to certify rather than renew a ULA, and growth that is going to other vendors’ products. A 500-person company with Oracle on VMware is a more likely audit target than a much larger one with a tidy estate.

Misconception 2: Only Microsoft will audit us

Microsoft audits, but it is far from alone. Oracle, IBM and SAP audit their enterprise customers routinely, and Oracle’s licensing team works directly with its sales team, so findings turn into purchase proposals. Since Broadcom bought VMware, its customers have faced new licensing terms and compliance letters. Adobe and Autodesk audit design and engineering users. The vendor most likely to audit you is the one where you have the largest gap between what you run and what you own, and for many enterprises that is Oracle.

Misconception 3: If we understand our contracts, we are compliant

Understanding the contract is necessary, not sufficient. Compliance depends on matching it to what is actually deployed, and deployments change every day: a DBA enables a management pack, a virtual machine moves to a new host, a team spins up a larger cloud instance, a developer installs Oracle Java. None of these involves a contract, and all of them change the licence count. The hardest part of compliance is not reading the agreement. It is reconciling what is installed and used with what is owned, continuously. That is what an effective licence position, kept up to date, is for.

Misconception 4: An audit is only a matter of time, so there is nothing we can do

An audit may well come. Its cost is decided long before. Organisations that know their own position, keep their contracts and deployment records in order and handle vendor requests formally settle for far less than those that meet an audit unprepared. In our experience, a clear licence position also makes an audit less likely: a vendor looking for revenue focuses where it expects to find a gap.

What helps most:

• Run your own count before the vendor does, at least once a year and before every renewal. Our guide to running an Oracle licence self-audit sets out the steps.
• Keep every contract and order, including those of acquired companies, in one place.
• Name one person to handle all licensing contact with each vendor, in writing.
• Take independent advice before sharing data or running a vendor’s scripts.

Questions we are asked about software audits

Why do software vendors audit their customers?

To protect and grow revenue. An audit finding is usually settled by a purchase, and often used to sell something the customer had declined.

Which software vendors audit most often?

Microsoft, Oracle, IBM and SAP audit enterprise customers routinely, and Broadcom has been active with VMware customers since its acquisition. Adobe and Autodesk audit design and engineering users.

Can a software audit be avoided?

Not always, but its likelihood and its cost can be reduced: keep your own licence position current, keep contracts in order, and handle every vendor request formally.

What should I do when I receive an audit letter?

Acknowledge it, name one owner, read the audit clause in your contract and take advice before agreeing the scope or sharing any data. For Oracle, our audit defense page explains the process.

Debra Brandt’s original article was published by Express Metrix. If you are facing an audit from any of these vendors, talk to us before you reply.