Licence audits are hard mostly when you cannot show what is installed where and under which right. This article covers licence metrics, a proof-of-licence file and regular reconciliation.
The vendor of a piece of software you use may ask, on the basis of the licence agreement, whether what you have installed and use matches the rights you have bought. When businesses struggle with such a request, the problem is usually not a deliberate breach but being unable to show what is installed where and under which right. Being ready for an audit means being able to produce that picture before anyone asks.
How does a licence audit arrive?
A licence audit is a review of your software use carried out by the vendor, or by a firm acting on its behalf, under the audit clause in the agreement. It does not always arrive under the name "audit". A formal notice letter, an email titled "licence review", a self-assessment form you are asked to fill in, or usage figures requested during a renewal discussion can all lead to the same place. Some products already collect usage data in their own management consoles.
Read the audit clause in the agreements for your key software in advance: How often can the vendor request an audit, how much notice must it give, what data can it ask for, how is the charge calculated if there is a shortfall, and who bears the cost of the audit? These details shape how you respond when a request comes in.
When a request arrives, don't rush to send data. Clarify in writing which products, which companies and which period are in scope. Have one person handle all correspondence with the vendor and keep a copy of every file sent. Where the agreement needs interpreting, its terms and the applicable legislation should be the basis, and legal advice should be sought where necessary.
Where do gaps usually come from?
Misunderstanding the licence metric
Not all software counts the same thing. One product is licensed per user, another per device; for server software, the number of processor cores is a common metric. When the licence metric, meaning what the licence is counted against, is misunderstood, the numbers don't add up even if the quantity purchased looks right.
| Licence metric | What is counted? | Common mistake |
|---|---|---|
| Named user | Every person the licence is assigned to | One account being shared by several people |
| Device | Every device the software is installed on or accessed from | Forgotten installations on old or spare computers |
| Processor core | Physical or virtual cores on the server | Not counting the other servers a virtual machine can run on |
| Concurrent use | Sessions open at the same time | Missing peak use in busy periods such as month-end |
| Access licence | Every user or device connecting to the server software | Assuming the server licence also covers those who connect |
Editions and terms of use
Home or student editions, and software offered free for personal use only, often do not permit commercial use. Expired trial versions and programs an employee has installed on a company computer under their own personal licence are also common findings. Licences that come with a computer (OEM licences) are usually tied to the device they were first installed on and may not be transferable when the device is replaced. Fonts, plug-ins and design templates are also subject to licence terms and are among the items most often left out of the inventory.
Virtualisation, test and standby environments
Moving a server to a virtual machine, copying it for testing, or keeping a standby copy at a second site for disaster recovery can change your licence position. Under some licence models, every physical server a virtual machine can run on must be counted. Some grant a separate right for standby environments, others don't. So check the agreements for the products involved before making infrastructure changes.
Open-source software
Open-source software is often free of charge, but it is not unlicensed. When it is used only within the company, obligations are generally limited. If you distribute software to customers as part of your own product, terms such as including the licence text or sharing source code may apply. Record which open-source components you use and where.
Build a proof-of-licence file
In an audit, the question "do you have the right to use this software?" is answered with documents. A product key or an installation file may not count as proof of entitlement on its own. Proof of licence is the set of documents that together show the product, version, quantity, licence metric and licence holder: the agreement or licence certificate, the reseller's invoice, the entitlement record in the vendor's online portal, an export from the subscription management console, and, for licences that came with a computer, the device's invoice.
Gather these documents in one place by product and summarise each product on a single line: product, version, quantity, metric, purchase date, supplier, the company holding the licence and the renewal date. In cases such as a change of company name, a merger or shared use across group companies, which legal entity the licence was bought for becomes especially important. Also make sure the administrator account for vendor portals is not tied to an employee's personal email address.
Compare what is installed with what you own
At the heart of preparation is licence reconciliation: comparing, for each product, the number in use with the number of rights you own. The usage side comes from installed-software lists on computers, the server and virtualisation platform, assigned users in subscription consoles and the user directory. The entitlement side comes from your proof-of-licence file.
Where a product comes up short, the options are clear: remove unused installations, reassign a spare licence if the agreement allows it, or buy the missing licences. Surpluses are valuable information too; reducing quantities at renewal can protect the budget. Reconciling a few months before major renewals lets you close gaps in a calm period and go into negotiations with the right numbers.
Hastily removing installations after an audit request arrives does not erase past use and can create inconsistencies with your records. Don't delete or alter records; establish the current position as it is and, where necessary, seek legal advice on how the agreement applies.
Make compliance part of daily work
A significant share of licence gaps comes from uncontrolled installation. If users' everyday accounts don't have administrator rights and software is installed from an approved list or through a request, less software goes unrecorded. Note the licence model of each product on the approved list so that whoever installs it can record the licence assignment at the same time.
For products licensed per user, reclaiming the licence of an employee who leaves makes reconciliation easier and reduces unnecessary purchases. When a device is retired, note whether the licence on it can be moved to another device. Buying licences through a single purchasing channel also reduces the risk of different departments buying the same product from different places and leaving it unrecorded.
Once a year, run a small internal rehearsal: For a product chosen at random, how long does it take you to bring together the usage count and the proof of licence? If the answer is a few hours, a real audit request will be met with far less stress.
Checklist
- Has the audit clause in the agreements for key software been read?
- Is the licence metric for each product (user, device, core, concurrent use, access) known?
- Is proof of licence kept in one place, by product, with the licence-holding company recorded?
- Are installed software and assigned subscriptions regularly compared with the rights owned?
- Have home, student, trial and personally licensed programs been removed from company devices?
- Has the licence position of virtualisation, test and standby environments been checked?
- Is software installed from an approved list or through a request process?
- If an audit request arrives, is it clear that scope will be confirmed in writing and who will handle correspondence?