In-Depth

Software Raids: Surviving an Audit

Software audits are a hassle, an embarrassment, and can result in hefty fines and worse. Here’s how to prepare for, and win, an audit.

• By Scott Braden
• 01/01/2006

Why are audits increasing? In short, it’s all about money. With flat IT budgets and increasing competition in every software market, vendors need new revenue streams.

Of course, vendors realize that it’s not a good relationship-building exercise to routinely audit customers. Instead, they usually rely on the Business Software Alliance (BSA) and Software Information Industry Association (SIIA), who act as outsourced auditors. In turn, BSA and SIIA depend on two primary sources of revenue: membership fees from vendors and “settlements” from software users.

The vendor membership fees -- which can run into the millions of dollars annually for a large company like Microsoft -- still make up the minor share of the BSA and SIIA’s revenue, according to Robert J. Scott, an attorney specializing in software audit defense.

But because these associations operate with a limited power of attorney from their member software companies, they can generate (and keep) their own cash by auditing software users and charging fines for non-compliance. Customer settlements can be in the hundreds of thousands or, sometimes, millions of dollars -- and can also produce unpleasant side effects, such as unwanted media scrutiny.

The BSA and SIIA don’t shy away from publicity. Both call for tips about non-compliant businesses through radio advertising, billboards and direct mail to executives of small and midsize companies. Now the associations and independent software vendors are offering rewards for information that leads to a successful audit.

Risk Factor
Software licenses are governed by contracts with vendors, and by U.S. Copyright law. You as an individual and your company may both be at risk for civil and criminal penalties for software license violations. Fines for corporations can reach $150,000 for each illegally installed copy of software. As an individual, you could be criminally prosecuted, fined up to $250,000 and even face jail time -- up to five years.

There are also costs associated with the audit, negative publicity for your company, and the aggravations of dealing with lawyers for hours, days -- sometimes months -- on end.

And don’t think that just because you’re a mid-level IT manager, you aren’t liable. Warns Scott: “If you’re the IT director responsible for managing software and your pay is partially based on your budget, spending or corporate profitability, it could be argued that you have an incentive to avoid paying for software and are therefore personally liable for any infringement.”

Auditing, Step by Step
There are different types of audits. For most Redmond readers, a “letter audit” is most likely. Here, a member of your senior executive team will receive a certified letter from a law firm that reads as a formal legal notice under U.S. Copyright law. It may also mention contract law and one or more software license agreements that your company owns. It mentions an effective date for the audit (which is likely to be in the past by the time the letter is received), and a due date for you to respond, typically 30 days or so after the effective date.

Most letter audits result from tips, so the notification letter will describe the specific software titles in question for the audit. To prepare for a letter audit, you can follow these general steps:

• First, get your corporate attorney involved and make him aware of the potential for serious criminal and civil liability. Next, consider hiring an outside attorney for expertise, and also to be the communication channel with the auditors. By hiring an outside attorney, your internal audit findings can often be protected from the auditor’s prying eyes by the doctrine of attorney-client privilege. If you conduct your self-audit with internal IT staff, or an outside contractor not associated with an attorney, you have less defense against the auditor getting full access to your data.
• Have your attorney send an initial communication to the auditors, acknowledging receipt of the audit notice. Pledge cooperation, but don’t give up any rights or information yet.
• Now build your audit response team: include your CEO, CFO, CIO, legal counsel, software asset manager and other individuals (such as departmental IT managers) as needed. Communication is a key here; tell the executives in clear terms what’s happening, what your plan is, and what information you’ve gathered so far.
• Focus only on the specific software titles described in the scope of the audit. Many automatic discovery tools will report on everything they find; make sure your response to the audits only includes the exact titles required by the audit. In fact, the reports and discovery data should be interpreted by someone knowledgeable not only in the tool, but also in the specifics of software licensing.
• Gather proof of purchase documentation. Auditors typically only accept dated proof of purchase -- such as invoices and sales receipts -- that show the name of your organization and a detailed description of the product. Most reseller invoices are adequate. Other documentation such as manuals, packaging or the holographic certificates of authenticity are probably insufficient.
• Review your purchase records. Dig out old invoices. Get your current and past vendors to deliver purchase history reports.
• Taking each product defined in the audit, compare your license proofs to the installations found. Be sure to take into account free and paid upgrades (including those covered by maintenance and short-term promotions). Also be sure you’re properly applying the correct licensing rules. For example, some licenses may be governed by the terms in force when you purchased them; others may have had terms change via maintenance or upgrade terms. That’s why in-depth knowledge of licensing rules and dates are critical.

Keep in mind the challenges presented by software discovery tools. Regardless of which tool(s) you use to inventory your installed software, it’s impossible to discover all installations. Mobile users, workstations not logged in, and remote and home users may not show up on the inventory. To track all this down, you need someone experienced to interpret the raw data from the tool -- data which can be confusing and duplicated.

If relevant to the audit, be sure to include products that a discovery tool won’t find, such as Client Access Licenses (CALs) and licenses for remote workers such as home/laptop users, VPN users and Citrix or Terminal Services users.

Good tools can be a lifesaver in these situations, as Carpenter found out. “In our case, they were expecting [the requested audit information] to take about a month and seemed surprised when we turned it around in a week. [Intel’s] LANDesk was a timesaver and the accuracy held up. Having good, available numbers on demand is probably the greatest thing.”

Filling the Gaps
If you have a compliance gap, communicate the details to your executives -- along with an estimate of the penalties and license fees they can expect to pay. The BSA and SIIA each use a slightly different method of calculating their standard fines, but you can expect to pay something on the order of two to four times the full retail list purchase price for each fine violation. This is in addition to your cost to purchase the correct number of licenses.

Your audit report should be a simple spreadsheet that contains the product names, cumulative installed number of copies as of the effective date, total proofs of purchase, and the net amount over- or under-licensed for the products. Attach supporting data such as proofs of purchase. Also, organize the supporting materials, such as discovery tool reports and proofs of purchase, by product. Post-Audit Considerations

Following the audit, your attorney will send the results to the auditors. They’ll get back to you with their analysis and proposed fines (if any). Review the auditor’s analysis carefully, checking for errors and any proofs of purchase that were rejected.

Remember that this is a negotiated settlement, so you can make requests, too. Beyond the obvious monetary concerns, what else do you want to protect? For instance: You don’t want to go to court. You don’t want the results made public. You probably don’t want to consent to allowing future onsite audits to happen every few months -- or at all, if possible. Maybe you’ll be willing to consent to building an ongoing software license management program, or other compromises. Also remember during the settlement phase that non-compliance can be fixed by either buying licenses or un-installing software.

Don’t Do It the Enron Way
Software license compliance in many organizations is one of those “yeah, we need to do it, but other priorities are higher”-type of projects. Why should you raise the priority now?

First, your risk of audit is increasing, says Scott, who has seen his caseload double over the past year. “Shrinking IT budgets and fierce competition among software publishers have created explosive growth in the incidence and frequency of software audits.”

In fact, Gartner Inc. estimates that 40 percent of all midsize to large U.S. businesses will face external software audits by the end of 2006.

In addition, Sarbanes-Oxley auditors are catching on to software non-compliance. In the parlance, software non-compliance is what’s known as an “off balance sheet” liability. The logic goes like this: if your company has software non-compliance, there is a negative value associated with the risk of getting caught, paying fines and so on. So in the auditor’s view, your company has a liability -- a liability to the corporation that’s not shown on any balance sheet or other public SEC filings. If that phrase “off balance sheet liability” sounds familiar, it’s because a company called Enron got in trouble for hiding liabilities “off balance sheet.”

Second, good old ROI will improve. Software compliance projects routinely have enormous hard-dollar cost savings associated with them. When you have the tools and processes to keep tight control of your licenses and usage, you also have increased negotiation leverage with vendors, and the ability to avoid purchases by re-allocating existing licenses (see “SOX and the Single Admin” for a few handy software compliance shortcuts).

Finally (but not least importantly), you avoid the risk of penalties or jail time. Ask yourself, “Whose job is it to make sure we stay compliant?” And, “Who gets fired if we’re not compliant?”

It’s never fun to be the whistleblower; but these days, nobody gets fired for being a stickler for compliance. As Carpenter says, “They can eat you alive if you don’t have something to fall back on, to say, ‘I know what I have in my organization.’”