What to Expect in a Software Audit Kickoff Meeting

Hi, it's Jay bishop with Metrix Data 360. In this video, I'm going to be talking you through what happens in the audit kickoff meeting. The kickoff meeting can either be conducted by a phone call or by an in person meeting with the software publisher and the main point of contact that you've established or anyone else that you wish to be included in the audit process. During the kickoff meeting, you'll discuss the following topics. Step number one will be defining the timeline. So when you're talking about timelines during the kickoff meeting, the vendors are going to request that you perform certain activities within a very short amount of time. And I'm talking about things like doing data collection, potentially running scripts that collect data or deployment data rather and handing it over to them, providing them with purchasing documents or records, past contracts that define your use rights, things like that. When the auditors make those requests, it's important that you immediately let them know that the timelines will be set up based on your resource availability and not what is best for them. Just remember you define the timeline based on your business requirements and needs. Step 2 data collection 1 of the more important topics to come up during the kickoff meeting will be regarding data collection, how you're going to get your deployment data back to the auditors so that they can analyze it. Don't be surprised if the requests that are coming from the auditors are for you to use their tools, such as scripts or data collection tools, in order to get them the data that they require. It's important that you don't automatically agree to using their tools. If you look at the fine print around the use of these tools within your environment, many times the disclaimer around anything that those scripts or any problems those scripts might cause in your production environment. Do not hold the auditors responsible for any business interruption to your production environment from using their tools. That's not acceptable for any organization as far as I'm concerned. And so if that is the case, and those are the requests that are being made, my advice would be to look for alternative tools or to advocate for the use of your own tools. One of the reasons it's important that you define the use of the tools is so that you understand the data that's being extracted by their tool and what you're handing over. A lot of times what we see is we see these data files that nobody knows what's exactly in them. So you don't even know what information you're handing over to the auditor. It could contain competitive information about different vendors who are present within your infrastructure. It could also contain private information about what's going on within your company. You don't exactly know what you're giving them. The ultimate goal in discussing data collection during the kickoff meeting is to establish exactly what information they need and how they're going to get it. And just remember, just because they request it doesn't mean it's relevant to the audit at all. Number three, the statement of work or the timeline and process document. So I got to be honest with you, I've never actually seen one of these documents. It's something that's alluded to many times, but from everything I've ever seen, it generally comes in the form of either a verbal agreement or through email just about how the audit is going to transpire around the timelines, around the things that you've agreed to as far as data collection and the tools that will be used and the different milestones that will come up through the audit process. So one thing I think it's important to reiterate here is by this point in the audit process, you need to make sure that you've appointed a single point of contact as the person that will take care of all things audit related. And anything that any information or requests that come through from the auditors or the publisher always must go through that person. And the instructions are given during the kickoff meeting that that is the only person that any communication regarding the audit is happening through. The reason that that's important is if they start talking to different people, different people start giving different answers, different information, it can compromise your position in the negotiation if there's any outstanding compliance gaps or just your fight against what the truth is during the audit process. Congratulations. You've just made it through the kickoff meeting. You should feel really good about yourself. I know it can be very stressful going into those situations if you're not familiar with them. So now what's going to happen is Mike's going to take over and talk to you a little bit about data collection and data analysis and why that matters and why it's important as you move through the audit process. Thanks for watching and we'll see each other soon.

You're going to get asked to provide a lot of data throughout this audit. You want to make sure that you review all requests and that you understand why that specific data is being b.