As economic headwinds gained strength in 2022, many IT and procurement organizations mobilized to execute IT cost optimization exercises that would reduce spend, deliver hard-dollar savings, and establish a more efficient run rate for 2023 IT operations. Now, as we speed towards the second half of 2023, it’s clear these budgets are under attack from an unanticipated adversary: software license audits. And the cost risk is quite grave.
Failure to anticipate a software license audit is very risky, especially at a time when many enterprises are taking extreme cost-cutting measures to protect their bottom lines. Large enterprises must proactively identify which software estates are most vulnerable because unanticipated software license audits typically result in material penalty fees. That outcome can be exponentially worse when the software vendor is in the top tier of the organization’s IT spend. Penalties claimed by vendors like Microsoft, SAP, Oracle, and IBM are regularly 7 and 8 figures – not something anyone wants to have to tell the CFO….
How to Minimize Software License Audit Risk
IT leaders need to take extra precautions to fortify their budget and minimize the impact of software audit judgements. A powerful way to take the offensive is to conduct self-audits of the primary software vendors in your environment. Even if you have invested in a software asset management team and platform, having a third party reconcile your environment and execute a full license position assessment (LPA) is a critically important tactic. The LPA will quickly show vulnerabilities, point to actions you can take to remedy areas of non-compliance, and refine SAM platform configuration and processes to enhance ongoing SAM operations.
NPI recommends IT and SAM leaders take the following measures now:
- Identify those software vendors that present the greatest risk financially and that may be motivated to pursue an audit with your organization.
- Review your audit obligations and deployment complexity to assess probable compliance challenges.
- Utilize multiple system-generated data sources in addition to your SAM platform to identify data gaps and anomalies. These are the same tactics a third-party auditor will use to drive non-compliance findings and establish their view of your license position.
Assess Software Audit Readiness
There are a few other dynamics to keep in mind as you assess software license audit readiness. Most important is that software vendors – particularly legacy enterprise IT vendors – are auditing customers more frequently. As we’ve noted on this blog before, software vendors often turn to tried-and-true tactics to recover lagging profits during market volatility. Near the top of the list is increasing software license compliance audits. Why? Because it works, particularly during times when customers are taking a more cautious approach to spending.
One blind spot for many organizations are “backdoor” audits. These unofficial (but equally risky) audits can be difficult to spot and usually come in the form of an informal request for deployment environment data. Watchwords include “environment review,” “certification,” “measurement” and others. It’s critical for procurement, ITAM, IT finance and IT teams to establish clear rules of engagement that detect a backdoor audit and provide protocol for vendor communications. Vendors know how to sniff out dysfunction and misalignment, which typically leads to the unveiling of noncompliance within the customer’s environment. Here are 3 tips to get your team ready.
Finally, know which vendors are targeting customers more aggressively. Which of your software estates are most vulnerable given vendor behavior, deployment size and spend? For example, if you’re an Oracle customers with a large Java deployment, you may be at considerable risk for an audit. What other software deployments in your environment are at risk?
As the old saying goes, the best defense is a good offense. Execute self-audits now to reconcile your environment and remediate noncompliance before a formal (or informal) audit arises. It’s a no-brainer way to fortify and protect your IT budget.
If you have questions about how to determine and mitigate software audit risk, NPI can help. Contact us to learn more.
RELATED CONTENT