Software Licence Compliance: What Happens When Vendors Audit You

Software vendor audits are more common than most IT leaders realise. Large software vendors — Microsoft, Oracle, SAP, IBM, Adobe — have dedicated licence compliance teams whose sole job is to identify under-licensed customers and recover revenue. A formal audit letter is not a routine administrative exercise; it can result in significant financial exposure if your records aren't in order.

What Triggers an Audit

Audits are often triggered by factors you don't control: a change in your company size (detected through public data), an acquisition or merger, industry sampling, or simply a sales team looking for upsell opportunities. Being a well-managed customer doesn't protect you from being selected.

What Auditors Look For

Auditors want to reconcile your licence entitlements (what you've purchased) against your licence deployments (what's actually installed or in use). Discrepancies in your favour are fine; discrepancies against you result in a true-up invoice for the difference, plus potential penalties.

Staying Audit-Ready

Maintain a continuously updated record of your licence entitlements (purchasing records) and your licence deployments (active users per tool). The gap between these two numbers is your compliance risk. For SaaS tools, active user counts are typically available in admin consoles and should be reviewed quarterly.

Responding to an Audit Letter

If you receive a formal audit notification from a software vendor, the first step is to engage legal counsel — even for audits that feel routine. Audit letters often contain broad rights of access and information disclosure obligations that shouldn't be agreed to without review. Legal can negotiate the scope of the audit, the timeline, the format of evidence requested, and whether the audit can be conducted by the customer's own team against a defined evidence standard rather than by a vendor-appointed third party.

Do not provide raw access to your IT systems. Negotiate with the auditor to provide specific, scoped evidence: licence entitlement records, user count reports, and deployment logs for the specific products in scope. Providing broader access than requested is a common mistake that can surface issues outside the original audit scope.

On-Premise vs SaaS Licence Compliance

On-premise software licence compliance is significantly more complex than SaaS compliance. On-premise products often have complex licence metrics — processor core counts, virtual machine density, Named User Plus licences with active user thresholds — that require specialised Software Asset Management expertise to interpret correctly. SaaS compliance is simpler: the metric is almost always named users or seats, and the authoritative count is available from the vendor's admin console. If you have a significant on-premise estate alongside SaaS, ensure your SAM programme covers both, as the on-premise risk profile is typically much higher.

Licence Entitlement Records as a Business Asset

Your collection of licence entitlement records — purchase orders, contracts, confirmation emails, licence keys — is a business asset that needs to be systematically maintained, not scattered across email inboxes and file shares. Create a central entitlement repository (a folder in your document management system, linked from your ITAM platform) where every entitlement document is stored, tagged by vendor and product, and accessible to the team responsible for licence management. When a vendor audit arrives, being able to produce clean entitlement records within hours rather than days is the difference between a manageable process and an expensive fire drill.