Have You Received a Software Audit Notification?

Hi, I'm Jay Bishop, and in this video we're going to be talking about what happens when you receive a software audit notification and the steps that you should take after receiving the notification as you move into the audit process. Microsoft, IBM, Adobe, you name it, Any software vendor can send you a software audit notification. The one thing to keep in mind is that the process to go through when you receive that notification is just about the same, regardless of the vendor. A software audit notification is just a fancy way of saying that your organization has been nominated to go through a software publisher audit. This is what we call the notification step. So the first thing I want to talk about with regards to the notification is how you're going to be informed that you've been nominated for the audit. If it's an actual audit, you will receive a letter generally in the mail, informing you that your organization has been nominated to go through the audit process and asking you to get in touch with them to figure out the next steps. It's also important to point out that we see requests for different activities such as software asset management engagements or seemingly friendly compliance check requests. Unless it is accompanied by an official letter, it's not considered to be an official audit. Receiving a software audit notification can be a scary thing, but as long as you don't hide your head in the sand and you follow these steps, everything's going to be fine. Step one, ensure that the request that you've received is authentic. Okay, so we see lots of fake audit requests that clients receive, whether it be through scamming emails, phishing emails. They're really just looking for information. So that's the first thing is make sure that the request that you've received is real. If it comes from someone whose name you've never heard of before, or just, you know, maybe the email address doesn't look right, make sure you double check because something might be fishy, and I mean fishy with a phone. Step two, you're going to assign a single point of contact for all things audit related within your company. The reason that you want to do this is you want to make sure all communications go through that single person and that there aren't different people from the publisher working within the organization to find out information that they can use against you during the audit process. Step three is extremely important. You want to make sure that you put in place an NDA. The reason that this is important is many companies use a third party to perform their audits. You want to make sure that you put a three way NDA in place to make sure a third party auditor cannot pass along any information that hasn't been validated and okayed by you before it's ready. Step four is to clearly define the scope of the audit. Once you have the ND in place, the next step is to make sure you are putting some fences around exactly what the audit is going to include. Now, sometimes it might be an absolute full audit where they're looking to have access to records and deployments around every single product. However, there is also lots of cases where you can limit the scope of what they're looking at to certain products. In particular, depending on the publisher, limiting the scope will prevent something what we call scope creep, right? Where as we're moving through the audit process, the auditors start to look at different data that might lead into different products. And as you can see by what I'm saying, it starts to creep into different areas where the audit never should have been going, which can lead to issues as well. Step five is to create your own estimated license position. Understanding your own position before the audit takes place is extremely important in understanding what leverage you have as you move into the negotiation or in fighting back against bogus claims that auditors commonly make. If you're waiting for the vendor to give you clear and concise position based on the data that they're going to take from your systems around deployments, don't. Because I've been in this business for a long time and I can tell you, out of all the audits that I've worked on, I have never seen an auditor's report come back and be correct. So step six in the process is to ensure that the timeline that the vendor is requesting for the audit is is one that is reasonable. Every contract that has an audit clause also has some description around what's okay and what's not regarding the timeline for performing those audits. So if you don't want to be stuck trying to negotiate an audit through potentially a Christmas break or your scheduled holidays, it's important that you clearly define the timeline from the beginning. And the other thing is, understand that you are in the driver's seat and you will define and confirm the timelines. Even though the vendor will request for them to be very short, it's in your best interest to extend them and make them as long as you want. Another reason it's important to firmly establish the timeline is it can give you the time that you require internally to create and review your own position and get really get your own ducks in a row before the formal audit starts to take place. Remember, auditors do this all the time. So they have an actual playbook of the way that they want things to go, and it's been developed based on what's been successful for them. Your job is to turn that playbook on its head and signal from the very beginning that you understand, you have control of your situation and you're ready to take them on. A lot of times, what we see is we see these data files that nobody knows what's exactly in them, so you don't even know what information you're handing over to the auditor it could contain.