What Are BSA Audits?

Have you received a letter from the Business Software alliance, or BSA for short, and not sure how to respond or what steps you should take? Don't worry, you're in the right place. Before you respond, watch this video to find out exactly what the BSA is and what to do about the letter that you received. In this video, I'm going to answer, what is the bsa? What goes on in one of their audits, how to respond to that audit, how the audit got triggered, and the steps you need to successfully defend yourself. Hi, Mike Austin here from the SAM Channel. While most of the time my work has me working with Fortune 500 companies, it doesn't mean that I don't understand what happens in a BSA audit. In fact, my experience there may help you better navigate a BSA audit if you actually have one show up at your door. So come on, let's dive into it and let's chat about BSA audits. So let's start with what is the BSA in the first place? So the BSA was actually started by some of the biggest software companies. Companies like Microsoft, Oracle, Adobe, IBM are all members of the BSA alliance. And the main goal of the BSA is to crack down on copyright infringement and protect the IP of these software vendors. And so if you're found to be out of compliance, you could actually face hefty fines within a court if you don't actually settle with them. Now let's take a look at how a BSA audit typically plays out and what you can do to avoid it. The first thing that's going to happen is you're going to get a letter from the BSA saying that you're under investigation. In that letter, it's going to demand that you provide them with spreadsheets, purchasing records, deployment data, all kinds of stuff in order for them to analyze where you're at from a license position perspective for whichever vendor you're being audited for. So most often a BSA audit is, I'll call it a self audit. They don't necessarily send in a third party like Deloitte or KPMG to actually physically do the audit. They request that you self report. In other words, you pull your deployment data, you provide them your license information, they create the license position. Now, they may offer some of their tools to help if you don't have tools or you're not sure how to collect the information. But for the most part, they're going to want you to use your tools. And there's a reason for that. That I'll get into. So the number one thing because of this is that we recommend that you talk to a lawyer yourself to understand your rights and how to protect any of your own proprietary information before you start actually turning over information to the bsa. We don't suggest you avoid them because that can lead to a lawsuit and court time, but we do recommend that you speak to counsel in order to protect your rights. So one thing that's different between a BSA audit and just a publisher audit themselves is that the BSA has an extensive snitch line. Right? I call it a snitch line where they actually are seeking out employees to provide information on companies that they believe that their company is non compliant. So one of the most common scenarios where you got hit with a BSA audit, a disgruntled employee, and the reason for this is the bsa, although they don't disclose how much, is actually providing them with a fee if they're successful at winning the audit itself. So that means you want to be careful with disgruntled employees, particularly if they're exit employees, maybe contractors even. We're actually starting to see espionage, like corporate espionage, where third world actors are starting to nominate people if they've been sniffing around your network. So sort of, you know, you definitely want to make sure that you're protecting your environment with security because we are seeing that as one of the areas where the BSA is getting their information from. One place that's probably a little different is you won't see your software sales rep necessarily nominating you to the bsa. Because it's my understanding that if the BSA collects findings, it actually goes to the bsa. It doesn't go to the software company. So your rep is not going to get quota relief or quota retirement by findings from the bsa. So that's a good distinction that you probably want to know because, you know, don't go getting upset with your software rep. That's where you don't want to look. You want to go and look at disgruntled employees, contractors, you know, those sorts of things as the reasons for why you were nominated in the first place. So let's, let's talk about the steps that you go through to defend a BSA audit. First, seek representation. I talked about how this is different than a audit from a publisher. You, you really should think about this one as a legal proceeding and make sure that you're covered with the privilege, client attorney privilege. So that information goes to your attorney. It's covered under the privilege act between you and your client, first and foremost. Second, you're going to want to ensure that there's confidentiality. So you're going to want to make sure that the clauses in the bsa, again, your legal representative will help you here protect any information that the BSA may be able to collect that's personal around. You know, personal information, employee records, employee names, email addresses, all that stuff that's sensitive when it comes to security. You want to make sure that you have confidentiality around that because you may be required to hand over some of that information as a portion of the data that needs to be discovered in the audit process. So once you have both of those in place, then you're going to want to start collecting information. The types of things you're going to need to gather, they're going to be software inventory. So what's deployed out there? It might be users. So how do you have, how are users accessing servers on the software? That's one area that the BSA focuses on quite heavily. You're going to have to collect your purchase records, your entitlements, your contracts, those sorts of things. And this is one of the areas that you want to be careful because when you hand over that raw information, the bsa, if you've watched any of our other audit stuff, can make interpretations of that data. Those interpretations can be punitive. And don't forget this is a legal proceeding where they're looking at copyright infringement, which could be $500 or more per non compliance issue. So the last thing I'll say is depending on your size and your budget, you may want to not just get an attorney to protect you from a confidentiality and legal perspective, but maybe you want to get some help from a licensing expert that understands how to properly collect that inventory, how to interpret it, and also how to apply your licenses and make sure that they're making the optimal use of everything that you own before that gets handed over to the bsa. If you have any questions, feel free to click the link in the comments below and reach out to me or anybody on my team and we'd be happy to help answer any remaining questions you may have. And thanks for watching this video and remember to click the like button and the subscribe button to follow along with all our great content that we publish here at the SAM Channel. As always, I'm Mike Austin and thanks for watching.