Software Audit Checklist: What to Do Before, During and After a License Audit

A software audit checklist sets out what to have ready before a publisher audits your license use, what to do in the first weeks after the letter arrives, and how to close the audit on figures you have checked. It applies to Oracle, Microsoft, IBM, Red Hat and Broadcom VMware audits alike, because the risk is the same in each: the publisher’s figures become the settlement.

Below is the checklist we work through with clients, with the publisher rules that change each item.

In short

• Most of an audit is decided before the letter arrives, by whether you hold a current effective license position and the contracts behind it.
• Read the letter first. A formal audit is a written notice citing the audit clause in your contract. A friendly offer to help you understand licensing is not, but accepting one can lead to a formal notice.
• Validate every data set before it leaves your hands, so the publisher’s figures are never the only figures in the room.
• Expect months, not weeks. Typical Oracle audits run 4 to 9 months from formal notice to commercial settlement, and some stretch to 12 to 18.

Before an audit: what to keep ready

• A current effective license position for each major publisher. What you own against what your deployment needs, product by product. Our guide to the effective license position shows how to build one.
• A complete entitlement register. Contracts, ordering documents, purchase orders and each publisher’s portal records, including licenses bought by companies you acquired and licenses carried on old support contracts. Auditors rarely find these for you. See how to record software license entitlements.
• Discovery you trust. Every server, desktop and virtual host in scope, with the items that matter most for licensing: Oracle Database options and packs, middleware features and Java.
• The evidence each publisher expects. The rules differ, and so does the proof.
  • IBM: for sub-capacity pricing, ILMT running within 90 days of the first eligible deployment, reports at least quarterly kept for two years, and every VM manager connected. In IBM’s own example, an IBM MQ deployment priced at $56,000 becomes $132,000 when ILMT has no VM manager connection. See our guide to IBM sub-capacity licensing.
  • Red Hat: a subscription for every system and virtual instance running RHEL, whatever the version. Red Hat’s Enterprise Agreement lets Red Hat or its designee inspect your records while the agreement is in effect and for a year after; in the EMEA version of November 2021, you pay for the inspection if the underpayment exceeds 5%.
  • Broadcom VMware: a count of physical cores, with 16 cores licensed for every CPU even when it has fewer (Broadcom KB 313548).
  • Microsoft: which agreement and which product use rights apply to each product, and which licenses carry Software Assurance.
• Your audit clause, read in advance. Notice period, scope, who may carry out the audit and who pays for it. Read it in your own signed agreement, because wording differs between versions.
• One named owner. A single person who receives publisher correspondence and decides what is sent.

When the letter arrives: the first 30 days

The first 7 days and the next 30 days set the tone for the entire audit. In that window:

• Confirm what you have received. A formal audit cites the audit clause in your contract. An invitation to a license review is not an audit, and accepting it can open the way to one.
• Bring in your adviser before any data goes out. Data sent in a hurry is hard to correct later.
• Agree the scope in writing. Legal entities, products, locations, the period covered, the data format and the dates.
• Run your own discovery first. Before you run any data-collection script the auditor sends, find out what it collects and what it will show.
• Use one channel. Route every contact with the publisher and its auditors through your named owner.

During the audit

• Validate every data set before release, and keep a copy of everything you send.
• Rebuild the auditor’s position line by line against your own, and challenge findings that apply the rules wrongly.
• Add the entitlements the auditor missed. Acquired companies and old support contracts are the usual gaps.
• Keep compliance and purchasing apart. At Oracle, the company’s own FAQ calls its License Management Services team “the only group within Oracle authorized to review and confirm your compliance status.” Agree the compliance figures before you discuss any purchase.

After the report: settle, then fix the cause

• Treat the report as the start of a negotiation. The length of an audit usually depends on how hard the publisher pushes and how prepared the customer is.
• Settle on figures you have checked, including the options for closing any gap: removing deployments, reusing licenses you already own, or buying only what remains.
• Fix the step that failed. A finding usually traces back to one stage of the software asset management process, most often discovery or the entitlement register. Put the next license position in the calendar.

Mistakes we see in software audits

• Sending raw data. Unvalidated scan output becomes the publisher’s evidence.
• Accepting the auditor’s position as the starting point. Build your own first, then compare.
• Losing entitlements. Licenses you own but cannot document count for nothing in a settlement.
• Starting when the letter arrives. By then the publisher sets the timetable.

Help with a software audit

Our software asset management services keep a validated license position for each publisher on a schedule, so an audit becomes a check of figures you already hold. When a letter has arrived, we provide Oracle audit support, help with Microsoft license audits, and IBM audit defense and Red Hat reviews.

Questions we are asked about software audits

What should be on a software audit checklist?

Before an audit: a current effective license position per publisher, a complete entitlement register, trusted discovery data, each publisher’s evidence (such as IBM’s ILMT reports), your audit clause and a named owner. After the letter: confirm it is a formal audit, agree the scope in writing, and validate every data set before it is released.

How long does a software audit take?

Months. Typical Oracle audits run 4 to 9 months from formal notice to commercial settlement, and some stretch to 12 to 18 months, depending on how hard the publisher pushes and how prepared the customer is.

Is a license review the same as an audit?

No. A formal audit is a written notice citing the audit clause in your contract. A license review is an invitation, often presented as help, but accepting it can lead to a detailed discussion and then a formal audit notice.

Can we prepare before we receive an audit letter?

Yes, and that is where most of the outcome is decided. A current effective license position, a complete entitlement register and the publisher’s required evidence turn an audit into a verification of figures you already hold.