A software license audit is a review that compares the software an organization has deployed and uses with what its licenses permit. Audits are often started by the software vendor or an auditor it appoints under audit rights in the license agreement, though organizations also run internal audits to check their own position. When an audit finds more use than licensed, the gap is usually settled by buying licenses, sometimes with back fees, which can be a large unbudgeted cost.
At a glance
- An audit compares entitlements (what you are licensed for) with deployment and use.
- Vendor audits rely on audit rights in the license agreement, which set notice, scope and frequency.
- Findings of under-licensing are usually settled by purchasing licenses, sometimes with back maintenance fees.
- Complex licensing tied to processors, virtualization or indirect use is a common source of findings.
- Good software asset management records make audits faster and findings easier to challenge.
What problem it solves
From the vendor’s side, an audit enforces the license agreement: it checks that customers pay for what they use. From the buyer’s side, an internal audit, or a well-run response to a vendor audit, establishes the real license position so the business pays for what it needs and not more.
The risk for buyers is that licensing rules are complex and change over time. Moving servers to virtual machines or the cloud, merging with another company, or letting other systems access a database can change what is owed without anyone noticing. An audit can surface years of drift at once. Knowing how audits work, and keeping records that show your position, turns an audit from a surprise bill into a reconciliation you can check and negotiate.
How it works
The audit clause. Most enterprise license agreements include a clause letting the vendor verify compliance. It usually sets how much notice the vendor gives, how often audits may happen, who may perform them, what data the customer must provide and who pays if a large shortfall is found.
Notice and scoping. The audit typically begins with a letter. The customer and auditor agree which products, entities and time period are in scope, and how data will be collected.
Data collection. The customer provides deployment data, often from discovery tools or scripts the auditor supplies, along with purchase records. Reviewing scripts and data before sharing them is a common precaution.
Reconciliation. The auditor compares deployment and use against entitlements, applying the vendor’s licensing rules. Findings depend heavily on how those rules are interpreted, for example how virtual machines, disaster recovery servers, test environments or per-user licensing are counted.
Findings and settlement. The customer reviews a draft report, challenges errors with its own records, and negotiates a settlement. Shortfalls are commonly resolved by buying licenses, which may be folded into a broader purchase. Some agreements instead reconcile use through a periodic true-up.
Prevention. Software asset management (SAM), as part of wider IT asset management, keeps entitlement and deployment records current so the organization knows its position before a vendor asks. For subscription software, SaaS management platforms track users and spend. Our software asset management page covers tools and services that help.
When it matters for buyers
- When an audit letter arrives. Respond within the contractual timeline and agree scope in writing before sharing data.
- Before infrastructure changes. Virtualization, cloud migrations and new integrations can change licensing; check first.
- After a merger or acquisition. Combined entities may hold licenses that don’t transfer or that overlap.
- Before a renewal or large purchase. Knowing your position lets you resolve gaps on your terms.
- When rightsizing. An internal audit can show unused licenses you can retire.
Questions to ask vendors
- What audit rights does our agreement give you: notice, frequency, scope, and who performs the audit?
- Which products, entities and time periods are in scope?
- What data collection tools will be used, and can we review them before running them?
- How will virtual, cloud, test and disaster recovery environments be counted?
- How are shortfalls priced, and are back maintenance fees involved?
- Can findings be resolved through a forward purchase or true-up instead of a penalty?
- Will we see draft findings and have time to respond before they are final?
How it differs from a true-up
A true-up is a scheduled reconciliation the contract builds in, often annually, where added use, reported by the customer or metered by the provider, is billed on pre-agreed terms. A software license audit is a verification exercise that may happen with notice under the audit clause, and its findings are often priced less favorably and open to dispute. Contracts with a regular true-up can reduce the chance of large audit findings, but they don’t remove the vendor’s audit rights.