Software License Audit Response Playbook
SOFTWARE LICENSE AUDIT RESPONSE PLAYBOOK
Comprehensive Response Guide for Vendor and Trade Association Software Audits
Prepared for: [________________________________]
Prepared by: [________________________________]
Date: [__/__/____]
Matter/File No.: [________________________________]
TABLE OF CONTENTS
- Part I: Overview of Software Audits
- Part II: Audit Rights Analysis
- Part III: Initial Response Letter Template
- Part IV: Internal Audit Checklist
- Part V: Common Audit Triggers and Red Flags
- Part VI: Negotiation Strategies
- Part VII: Privilege and Confidentiality Considerations
- Part VIII: Response Timeline and Deadlines
- Part IX: Settlement Agreement Framework
- Part X: Post-Audit Compliance Program
- Part XI: Practice Tips
- Sources and References
PART I: OVERVIEW OF SOFTWARE AUDITS
1.1 Purpose of This Playbook
This playbook provides a structured, step-by-step framework for responding to software license audits initiated by software vendors, trade associations, or their representatives. It is designed for legal counsel representing companies that have received audit requests or demand letters, providing practical guidance on managing scope, minimizing risk, and achieving favorable outcomes.
1.2 Types of Software Audits
| Audit Type | Initiator | Typical Process | Legal Basis |
|---|---|---|---|
| Vendor-initiated audit | Individual software publisher (e.g., Oracle, SAP, Microsoft, Adobe, IBM) | Formal letter citing contractual audit clause; vendor or third-party auditor conducts review | Contractual audit clause in license agreement |
| BSA audit | BSA | The Software Alliance (trade association representing major publishers) | Letter threatening litigation; demand for self-audit; negotiated settlement | Copyright infringement claims (17 U.S.C. § 501 et seq.) |
| SIIA audit | Software & Information Industry Association | Similar to BSA; letters demanding compliance review | Copyright infringement claims |
| Government audit | Federal or state procurement office | Compliance review for government-purchased software | Procurement regulations; FAR clauses |
| Internal audit | Company's own IT, legal, or compliance team | Proactive review to identify and remediate compliance gaps | Best practice; risk management |
1.3 Who Initiates Audits and Why
Vendor-Initiated Audits:
- Major publishers (Oracle, SAP, Microsoft, IBM, Adobe, Salesforce) conduct audits as a routine part of their license management and revenue recovery programs
- Audits are often triggered by license renewal negotiations, reported tips, or automated telemetry data
- Vendors may use audits strategically to drive upselling, cloud migration, or subscription conversion
BSA | The Software Alliance:
- Trade association representing major publishers including Adobe, Apple, Autodesk, IBM, Microsoft, Oracle, SAP, Siemens, and Symantec (among others)
- Operates a confidential reporting hotline encouraging employees and contractors to report unlicensed software use
- Offers monetary rewards (up to $1 million) for information leading to successful enforcement actions
- Typically initiates contact through a demand letter requesting a voluntary self-audit
SIIA (Software & Information Industry Association):
- Trade association focused on software and digital content industries
- Operates a similar reporting program and enforcement mechanism
- Tends to focus on smaller publishers and niche software
1.4 Legal Framework for Software Audits
| Legal Basis | Description | Potential Liability |
|---|---|---|
| Copyright infringement | Unauthorized copying, installation, or use of software beyond license scope | Statutory damages: $750–$30,000 per work (17 U.S.C. § 504(c)(1)); up to $150,000 per work for willful infringement (§ 504(c)(2)) |
| Contractual breach | Violation of terms in the software license agreement (e.g., exceeding user count, unauthorized deployment) | Contractual damages; back-licensing fees; audit costs; termination of license |
| Criminal liability | Willful copyright infringement for commercial advantage | Up to 5 years imprisonment and $250,000 fine (18 U.S.C. § 2319) |
| Trade secret misappropriation | Use of software obtained through misappropriation | Injunctive relief; actual damages; exemplary damages |
1.5 Initial Triage Assessment
Upon receipt of an audit notice or demand letter, immediately complete the following assessment:
| Assessment Item | Details | Notes |
|---|---|---|
| Date notice received | [__/__/____] | |
| Sender identity | [________________________________] | Vendor, BSA, SIIA, or other |
| Products at issue | [________________________________] | Specific software named in notice |
| Contract(s) cited | [________________________________] | License agreement, order form, ELA |
| Audit clause invoked | [________________________________] | Specific contractual provision |
| Response deadline | [__/__/____] | Per notice or contract |
| Threat level | ☐ Litigation threatened ☐ Settlement proposed ☐ Informational | |
| Internal team assembled | ☐ Yes ☐ No | Legal, IT, Procurement, Finance |
PART II: AUDIT RIGHTS ANALYSIS
2.1 Review the License Agreement
The first and most critical step is to review the license agreement's audit clause. Not all audit demands are contractually supported, and the scope of the vendor's audit rights depends entirely on the specific terms of the agreement.
2.2 Audit Clause Analysis Checklist
Review each of the following elements in the applicable license agreement:
A. Existence of Audit Rights
- ☐ Does the license agreement contain an audit clause?
- ☐ If no audit clause exists, the vendor may have no contractual right to audit (though BSA/SIIA claims are typically based on copyright infringement, not contract)
- ☐ Is the audit clause in the master agreement, the order form, the EULA, or a separate document?
B. Scope of Audit
- ☐ Which products/versions are covered by the audit clause?
- ☐ Which entities are subject to audit (parent company only, or subsidiaries and affiliates)?
- ☐ Which environments are covered (production, development, test, staging, disaster recovery, sandbox)?
- ☐ What geographic scope applies?
- ☐ What time period is covered (current deployment, or historical use)?
C. Notice Requirements
- ☐ How much advance notice must the vendor provide? [____] days (commonly 30 days)
- ☐ Must notice be in writing?
- ☐ Must notice specify the products and scope of the audit?
- ☐ Was the notice actually compliant with the contractual requirements?
D. Frequency Limitations
- ☐ How often may the vendor conduct an audit? ☐ Once per year ☐ Once per [____] months ☐ No limit specified
- ☐ When was the last audit? [__/__/____]
- ☐ Does the frequency limitation reset after a license renewal or amendment?
E. Auditor Identity and Qualifications
- ☐ Who may conduct the audit? ☐ Vendor's employees ☐ Independent third-party auditor ☐ Either
- ☐ Does the agreement require the auditor to be a certified public accountant or other qualified professional?
- ☐ Does the agreement require the auditor to sign a confidentiality/NDA?
- ☐ Can the company reject the proposed auditor and request an alternative?
F. Data Access and Methods
- ☐ What data is the vendor entitled to access? (Deployment reports, server logs, user counts, financial records?)
- ☐ Is the vendor permitted to install audit tools or scripts on the company's systems?
- ☐ Is the company permitted to provide self-reported data instead of granting direct access?
- ☐ Are there restrictions on data collection (e.g., no access to trade secrets, customer data, or personally identifiable information)?
G. Cost Allocation
- ☐ Who bears the cost of the audit? ☐ Vendor ☐ Company ☐ Depends on findings
- ☐ Is there a threshold (e.g., if underpayment exceeds [____]%, the company pays audit costs)?
- ☐ Are the company's internal costs of cooperating with the audit addressed?
H. Remedies
- ☐ What remedies does the audit clause provide for non-compliance? (Back-licensing at list price, contract termination, liquidated damages?)
- ☐ Is there a cure period for identified compliance gaps?
- ☐ Are there caps or limitations on the vendor's remedies?
2.3 Common Audit Clause Red Flags
| Red Flag | Risk | Recommended Action |
|---|---|---|
| No frequency limitation | Vendor could audit repeatedly | Negotiate for annual cap |
| Vendor may use its own employees as auditors | Potential for commercial intelligence gathering | Request independent third-party auditor |
| Broad scope covering "all records" | May expose trade secrets or customer data | Limit scope to deployment data only |
| Company pays audit costs regardless of findings | Financial burden even if compliant | Negotiate for vendor-pays unless material non-compliance found |
| "Audit" includes right to install tools/agents | Security and privacy risks | Require prior approval of tools; restrict to controlled environment |
| No confidentiality obligation for auditor | Audit data could be used for competitive purposes | Require NDA before any data is shared |
| Remedies include list price for over-deployment | List price may be significantly higher than contracted rates | Negotiate for contract pricing for true-up |
PART III: INITIAL RESPONSE LETTER TEMPLATE
3.1 Initial Response Letter (Vendor-Initiated Audit)
[COMPANY LETTERHEAD]
[__/__/____]
VIA: ☐ Email ☐ Certified Mail ☐ Overnight Courier
[________________________________] (Vendor Contact Name)
[________________________________] (Vendor Company Name)
[________________________________] (Street Address)
[________________________________] (City, State, ZIP)
[________________________________] (Email)
Re: Response to Audit Request — [License Agreement Reference] — [Products]
Dear [________________________________]:
We acknowledge receipt of your letter dated [__/__/____] requesting a software license audit pursuant to [________________________________] (specific audit clause). We take our software license compliance obligations seriously and are committed to working cooperatively with you within the framework established by our agreement.
Before we proceed, we respectfully request clarification on the following matters to ensure that the audit process is efficient and conducted within the scope authorized by our agreement:
1. Scope Confirmation. Please confirm the specific products, versions, and environments that are the subject of this audit, as well as the time period and entities covered.
2. Auditor Identity. Please identify the individual(s) or firm that will conduct the audit on your behalf. Per Section [____] of our agreement, we request that the auditor execute a non-disclosure agreement before receiving any of our proprietary information.
3. Data Requirements. Please provide a detailed list of the specific data, records, and documentation you are requesting. We will evaluate these requests against the scope of the audit clause in our agreement and prepare responsive materials.
4. Methodology. Please describe the audit methodology to be used, including any tools or scripts that you propose to install or run on our systems. We reserve the right to evaluate any such tools for security and compatibility before deployment.
5. Timeline. We propose a [____]-day period to prepare our internal response and gather the requested information. Please confirm that this timeline is acceptable.
6. Costs. Per Section [____] of our agreement, [the audit shall be conducted at your expense / we request confirmation of the cost allocation for this audit].
We are assembling an internal team to manage this process. All communications regarding this audit should be directed to:
[________________________________] (Contact Name)
[________________________________] (Title)
[________________________________] (Email)
[________________________________] (Telephone)
We look forward to resolving this matter promptly and cooperatively.
Sincerely,
______________________________
[________________________________] (Name)
[________________________________] (Title)
[________________________________] (Company)
3.2 Initial Response Letter (BSA/SIIA Demand Letter)
[COMPANY LETTERHEAD / LAW FIRM LETTERHEAD]
[__/__/____]
VIA: ☐ Email ☐ Certified Mail
[________________________________] (BSA/SIIA Contact)
[________________________________] (Address)
Re: Response to Software Compliance Inquiry — Reference No. [________________________________]
Dear [________________________________]:
We represent [________________________________] ("Company") and are responding to your letter dated [__/__/____] regarding software compliance.
The Company takes its software licensing obligations seriously and maintains an active software asset management program. We are reviewing the matters raised in your letter and request the following information to facilitate our evaluation:
- Please identify the specific software publisher(s) on whose behalf you are acting.
- Please identify the specific software product(s) and version(s) that are the subject of this inquiry.
- Please provide a copy of any information or report that forms the basis for this inquiry (to the extent permitted by your confidential informant protections).
- Please confirm the legal basis for your audit request (i.e., whether this is a contractual audit demand or a pre-litigation inquiry).
The Company is conducting an internal review of its software deployments and license entitlements for the products identified in your letter. We anticipate completing this review within [____] days and will provide a substantive response at that time.
We request that you direct all further communications regarding this matter to the undersigned counsel. Please do not contact Company personnel directly.
In the meantime, we reserve all rights and defenses available to the Company under applicable law and agreements.
Sincerely,
______________________________
[________________________________] (Attorney Name)
[________________________________] (Law Firm)
[________________________________] (Bar Number)
[________________________________] (Email / Telephone)
PART IV: INTERNAL AUDIT CHECKLIST
4.1 Software Inventory
Conduct a thorough internal inventory of all software deployed within the organization:
A. Entitlement Review
- ☐ Gather all software license agreements, order forms, enterprise license agreements (ELAs), volume license agreements, and subscription agreements
- ☐ Compile all proof-of-purchase records (invoices, purchase orders, credit card receipts)
- ☐ Identify all license metrics (per-user, per-device, per-core, per-processor, concurrent, named user, CAL, etc.)
- ☐ Determine total entitlements by product, version, and metric
- ☐ Identify any bundled or included licenses (e.g., operating system licenses included with hardware)
- ☐ Review any prior true-up or compliance agreements
B. Deployment Discovery
- ☐ Run software discovery tools across all environments (production, development, test, staging, disaster recovery)
- ☐ Scan all servers (physical and virtual), desktops, laptops, and mobile devices
- ☐ Identify all cloud instances and SaaS subscriptions
- ☐ Capture product names, versions, installation dates, and installation paths
- ☐ Document virtual environments (VMware, Hyper-V, cloud IaaS) and determine how virtualization affects licensing
- ☐ Identify disaster recovery and high-availability instances
- ☐ Check for trial, evaluation, and beta software that may have expired
C. Reconciliation
| Product | Entitlements (Licensed) | Deployed (Installed) | Variance (+/-) | Notes |
|---|---|---|---|---|
| [________________] | [____] | [____] | [____] | [________________________________] |
| [________________] | [____] | [____] | [____] | [________________________________] |
| [________________] | [____] | [____] | [____] | [________________________________] |
| [________________] | [____] | [____] | [____] | [________________________________] |
| [________________] | [____] | [____] | [____] | [________________________________] |
| [________________] | [____] | [____] | [____] | [________________________________] |
4.2 License Metric Verification
Different software publishers use different license metrics. Verify the correct metric for each product:
| Metric | Description | Verification Method |
|---|---|---|
| Per-user / Named user | Licensed to specific individuals | Compare user list to entitlement count |
| Concurrent user | Licensed by maximum simultaneous users | Check peak concurrent usage logs |
| Per-device | Licensed to specific devices | Compare device inventory to entitlements |
| Per-processor / Per-core | Licensed by number of processors or cores | Count physical cores; check virtualization rules |
| Per-server | Licensed to specific servers | Compare server inventory to entitlements |
| Client Access License (CAL) | Permits a user or device to access server software | Verify CAL count against accessing users/devices |
| Subscription | Time-limited access; must be current | Verify subscription status and expiration dates |
| Enterprise / Site license | Covers all users or devices at an entity | Confirm entity scope matches deployment |
| OEM | Bundled with hardware; non-transferable | Verify hardware is still in use |
4.3 Common Compliance Gaps
| Gap | Description | Risk Level |
|---|---|---|
| Over-deployment | More installations than licenses | High |
| Version mismatch | Using a newer version without upgrade rights | Medium |
| Metric mismatch | Using per-user license on a per-device basis (or vice versa) | Medium |
| Virtualization issues | Failing to license virtual cores/instances correctly | High |
| Expired subscriptions | Continuing to use software after subscription lapse | High |
| Unauthorized environments | Using production licenses in non-production environments (or vice versa) | Medium |
| Indirect access | Third parties accessing licensed software through an intermediary system | High (especially Oracle, SAP) |
| Unapproved hardware migration | Moving OEM-licensed software to different hardware | Low-Medium |
| Employee departures | Failing to reclaim licenses from departed employees | Low |
| Mergers/acquisitions | Deploying software on acquired entity's systems without license transfer | High |
4.4 Internal Audit Response Team
| Role | Responsibility | Team Member |
|---|---|---|
| Legal Counsel (Lead) | Overall strategy, communications, privilege management, negotiation | [________________________________] |
| IT / SAM Manager | Software discovery, deployment data, technical analysis | [________________________________] |
| Procurement | License agreements, purchase records, entitlements | [________________________________] |
| Finance | Budget for remediation/settlement, cost-benefit analysis | [________________________________] |
| Information Security | Review vendor audit tools, data protection, access controls | [________________________________] |
| Business Unit Owner | Operational impact assessment, business justification | [________________________________] |
| Executive Sponsor | Escalation, decision authority, budget approval | [________________________________] |
PART V: COMMON AUDIT TRIGGERS AND RED FLAGS
5.1 What Triggers a Software Audit
| Trigger | Description | Frequency |
|---|---|---|
| Employee tips | Disgruntled or former employees report unlicensed use to BSA/SIIA hotlines | Very common |
| License renewal cycle | Vendor initiates audit in connection with renewal negotiations | Common |
| Acquisition/merger | Vendor audits acquired entity's compliance | Common |
| Usage telemetry | Software "phones home" and reports deployment data to vendor | Increasing |
| Business intelligence | Vendor identifies usage patterns inconsistent with license entitlements | Common |
| Random selection | Vendor selects accounts for routine compliance review | Less common |
| Industry campaign | BSA/SIIA conducts targeted enforcement in a specific industry | Periodic |
| Government compliance | Federal procurement office reviews compliance with volume agreements | Government customers |
5.2 Red Flags That Attract Audit Attention
- ☐ Rapid growth (headcount, offices, servers) without corresponding license purchases
- ☐ Failure to renew support/maintenance contracts (suggests possible continued use without license)
- ☐ Significant virtualization deployment (raises licensing complexity)
- ☐ Cloud migration (hybrid environments create compliance gaps)
- ☐ Mergers and acquisitions (acquired entities may have compliance issues)
- ☐ Reduction in workforce (departed employees' licenses not reallocated)
- ☐ Multi-vendor environment with complex licensing terms
- ☐ Prior audit findings that were not fully remediated
- ☐ Using trial or evaluation software beyond the trial period
- ☐ Decentralized IT procurement with no centralized software asset management
5.3 Vendor-Specific Audit Tendencies
| Vendor | Common Audit Focus | Key Risks |
|---|---|---|
| Oracle | Processor licensing, virtualization, indirect access, cloud usage, Java SE licensing changes | Extremely aggressive audit practices; complex licensing metrics; "soft audit" through LMS reports |
| SAP | Named user types (Professional, Limited, etc.), indirect/digital access, engine licensing | Indirect access claims (accessing SAP data through non-SAP interfaces); "enhanced" audit scope |
| Microsoft | Server CALs, SQL Server core licensing, Office/M365 licensing, Windows Server Datacenter vs. Standard | Virtualization licensing complexity; hybrid benefit entitlements; Azure consumption |
| Adobe | Named user vs. shared device licensing, Creative Cloud deployment, legacy perpetual licenses | Transition from perpetual to subscription model; employee departures |
| IBM | PVU (Processor Value Unit) licensing, sub-capacity reporting, virtualization | Complex PVU calculations; ILMT tool deployment requirement for sub-capacity licensing |
| Autodesk | Named user licensing, legacy perpetual licenses, subscription compliance | Transition to subscription-only model; historical perpetual license entitlements |
| Salesforce | User licensing tiers, API access, data storage, integration users | User type classification (Full vs. Platform vs. Integration); overage charges |
PART VI: NEGOTIATION STRATEGIES
6.1 Overarching Principles
-
Cooperate but control the narrative. Demonstrate good faith cooperation while managing scope, timing, and data disclosure.
-
Know your rights. The audit clause is a contract — enforce it. Push back on demands that exceed the contractual scope.
-
Never volunteer more than required. Provide accurate data as requested, but do not disclose information beyond the audit scope.
-
Understand the vendor's incentives. Vendors use audits to generate revenue (through back-licensing, settlements, and upselling). Understanding this motivation helps frame negotiations.
-
Aim for a global resolution. The best outcome is a settlement that resolves all past non-compliance and positions the company for future compliance at favorable commercial terms.
6.2 Scope Limitation Strategies
- ☐ Challenge requests that exceed the contractual audit clause scope
- ☐ Limit the audit to specific products named in the notice, not all vendor products deployed
- ☐ Restrict the audit to the entities (legal entities, subsidiaries) covered by the license agreement
- ☐ Exclude non-production environments if the license agreement does not cover them
- ☐ Reject requests for "all records" — provide only deployment data relevant to the audited products
- ☐ Resist installation of vendor audit tools on production systems; propose controlled data extracts instead
- ☐ Insist on an NDA before sharing any data
6.3 Pricing and True-Up Strategies
- ☐ Negotiate true-up pricing at contracted rates (not list price)
- ☐ Request volume discounts for large true-ups
- ☐ Bundle the true-up with a renewal or new purchase to improve overall commercial terms
- ☐ Negotiate installment payments for large settlement amounts
- ☐ Propose a technology upgrade or cloud migration as part of the settlement (often in vendor's interest)
- ☐ Challenge the vendor's deployment calculations — request detailed methodology and validate assumptions
- ☐ Dispute metric interpretations that are unreasonable (e.g., counting inactive users, dormant accounts, DR instances)
- ☐ Request a mutual release for past non-compliance upon payment of the settlement amount
6.4 Settlement Negotiation Tactics
| Tactic | Description | When to Use |
|---|---|---|
| Self-audit first | Conduct internal audit before sharing any data with the vendor | Always — understanding your own position before engaging with the vendor |
| Challenge the findings | Audit findings are not gospel; vendors routinely overcount | When vendor's calculations appear inflated |
| Offer alternative data | Provide self-reported data from your own SAM tools instead of vendor-controlled tools | When vendor requests invasive access |
| Leverage renewal | Combine the settlement with a license renewal for better commercial terms | When renewal is upcoming (within 12 months) |
| Propose cloud migration | Offer to migrate to vendor's cloud solution as part of the settlement | When vendor is pushing cloud adoption |
| Request a payment plan | Spread settlement payments over 12-24 months | When the settlement amount is large |
| Negotiate release language | Insist on broad mutual release language covering all past use | Always — prevent future claims for the same period |
| Walk-away scenario | Be prepared to decline unreasonable terms and defend in litigation | When vendor demands are excessive and litigation risk is manageable |
6.5 BSA/SIIA-Specific Negotiation Considerations
- ☐ BSA/SIIA settlements typically include: (a) purchase of replacement licenses, (b) payment of a "settlement fee" (often characterized as damages), and (c) destruction of unlicensed copies
- ☐ BSA/SIIA settlement demands are often inflated — negotiate aggressively
- ☐ Confirm which publishers the BSA/SIIA represents in this specific matter — they may not represent all publishers whose software is at issue
- ☐ Consider whether the BSA/SIIA's informant is reliable (disgruntled employees may exaggerate)
- ☐ If the company is compliant, provide evidence and demand dismissal — do not accept a nuisance settlement
PART VII: PRIVILEGE AND CONFIDENTIALITY CONSIDERATIONS
7.1 Attorney-Client Privilege
- ☐ Engage legal counsel early. Involve legal counsel from the outset to ensure that the internal audit and response strategy are protected by attorney-client privilege.
- ☐ Direct the internal audit through counsel. The internal software audit should be conducted at the direction of legal counsel, and the results should be reported to counsel, to maximize privilege protection.
- ☐ Label privileged documents. All audit-related memoranda, analyses, and communications should be labeled "ATTORNEY-CLIENT PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL."
- ☐ Separate privileged and non-privileged information. Keep the legal analysis separate from the factual deployment data that will be shared with the vendor.
7.2 Work Product Doctrine
- ☐ Internal audit analysis prepared in anticipation of litigation is protected by the work product doctrine.
- ☐ If the BSA/SIIA has threatened litigation, documents prepared in response are more likely to be protected.
- ☐ Factual data (deployment counts, license records) is generally not privileged, but the legal analysis of that data may be.
7.3 Confidentiality Protections
- ☐ Require NDA before sharing data. Before providing any deployment data, license records, or business information to the vendor or auditor, execute a non-disclosure agreement.
- ☐ Mark all documents as confidential. All data provided to the vendor should be marked "CONFIDENTIAL — SUBJECT TO NDA."
- ☐ Limit data access. Provide summarized data rather than raw system access whenever possible.
- ☐ Restrict auditor's use of data. The NDA should prohibit the auditor from using audit data for any purpose other than the audit, and should prohibit sharing with the vendor's sales team.
- ☐ Require destruction of data. The NDA should require the auditor to return or destroy all company data upon completion of the audit.
7.4 Data Security Considerations
- ☐ Evaluate any vendor-provided audit tools for security risks before deployment
- ☐ Do not allow vendor audit tools to run on production systems without security review
- ☐ Remove all PII, PHI, customer data, and trade secrets from data provided to the vendor
- ☐ Monitor outbound data transfers during the audit process
- ☐ Ensure audit tools do not create persistent backdoors or exfiltrate data beyond the audit scope
PART VIII: RESPONSE TIMELINE AND DEADLINES
8.1 Recommended Response Timeline
| Day | Action | Responsible | Status |
|---|---|---|---|
| Day 0 | Audit notice received; logged and forwarded to legal | IT / Admin | ☐ Complete |
| Day 1-3 | Initial triage: identify sender, products, contract, deadline | Legal Counsel | ☐ Complete |
| Day 3-5 | Assemble internal audit response team | Legal Counsel | ☐ Complete |
| Day 5-7 | Review license agreements and audit clause | Legal Counsel | ☐ Complete |
| Day 7-10 | Send initial response letter (acknowledging receipt, requesting clarifications) | Legal Counsel | ☐ Complete |
| Day 10-30 | Conduct internal software inventory and license reconciliation | IT / SAM Manager | ☐ Complete |
| Day 30-45 | Complete internal analysis; identify compliance gaps and exposure | Legal + IT | ☐ Complete |
| Day 45-60 | Prepare and submit audit response to vendor | Legal Counsel | ☐ Complete |
| Day 60-90 | Negotiate scope, methodology, and findings with vendor | Legal Counsel | ☐ Complete |
| Day 90-120 | Negotiate settlement or true-up terms | Legal + Finance | ☐ Complete |
| Day 120-150 | Execute settlement agreement; implement remediation | Legal + IT + Procurement | ☐ Complete |
| Day 150+ | Post-audit compliance program implementation | IT / SAM Manager | ☐ Complete |
8.2 Critical Deadlines
| Deadline | Source | Action Required |
|---|---|---|
| Contractual response deadline | License agreement audit clause | [____] days from notice |
| BSA/SIIA response deadline | Demand letter | Typically 30-60 days (negotiable) |
| Extension requests | As needed | Request in writing before deadline |
| Vendor's audit completion deadline | License agreement or negotiated scope | [____] days from engagement |
| Cure period for non-compliance | License agreement | [____] days from finding |
| Settlement payment deadline | Settlement agreement | [____] days from execution |
8.3 Extension Requests
If additional time is needed, send a written extension request:
"We are diligently working to gather the information necessary to respond to your audit request. Due to the scope of the review and the number of products and environments involved, we respectfully request an extension of [____] days, to [__/__/____], to complete our response. We remain committed to cooperating fully within the framework of our agreement."
PART IX: SETTLEMENT AGREEMENT FRAMEWORK
9.1 Key Settlement Terms
A software audit settlement agreement should address the following elements:
- ☐ Scope of settlement — Specifically identify the products, versions, time period, and entities covered
- ☐ True-up licenses — Number and type of additional licenses to be purchased
- ☐ Pricing — Negotiated price for true-up licenses (ideally at contracted rates, not list price)
- ☐ Settlement payment — Separate payment for past non-compliance (damages, penalties, audit costs)
- ☐ Payment terms — Lump sum or installments; payment schedule
- ☐ Mutual release — Broad release of all claims relating to past software use through the settlement date
- ☐ Destruction of unlicensed copies — Commitment to remove unauthorized installations
- ☐ Forward-looking compliance — Commitment to maintain compliance going forward
- ☐ Confidentiality — Both parties agree to keep settlement terms confidential
- ☐ No admission of liability — Settlement is not an admission of infringement or wrongdoing
- ☐ Audit data destruction — Vendor/auditor returns or destroys all company data
- ☐ No future audit for [____] months — Moratorium on audits for a defined period
9.2 Settlement Amount Considerations
| Factor | Impact on Settlement |
|---|---|
| Number of over-deployed licenses | Primary driver of settlement amount |
| Duration of over-deployment | Longer periods may increase exposure |
| Metric at issue (users, cores, etc.) | High-cost metrics (e.g., per-core) generate larger settlements |
| List price vs. contracted price | Insist on contracted pricing for true-up |
| Willfulness | Evidence of knowing over-deployment increases exposure |
| Cooperation | Good-faith cooperation typically reduces settlement demands |
| Litigation risk tolerance | Greater willingness to litigate provides negotiating leverage |
| Renewal opportunity | Combining settlement with renewal improves overall deal |
9.3 Settlement Agreement Template Clause
SETTLEMENT AND RELEASE. In consideration of [Company]'s payment of $[________________] and its purchase of [____] additional licenses for [Product(s)] at the pricing set forth in Exhibit [____], [Vendor/BSA/SIIA] hereby releases and forever discharges [Company] from any and all claims, demands, actions, and causes of action arising from or relating to [Company]'s deployment and use of [Product(s)] through [__/__/____] (the "Settlement Date"). This release covers all past, present, and future claims, whether known or unknown, that arise from facts or circumstances existing on or before the Settlement Date.
PART X: POST-AUDIT COMPLIANCE PROGRAM
10.1 Software Asset Management (SAM) Program
Following the audit, implement or strengthen the company's SAM program:
A. Governance
- ☐ Designate a SAM Manager or team with responsibility for license compliance
- ☐ Establish a SAM policy and communicate it to all employees
- ☐ Create a software procurement policy requiring all software purchases through approved channels
- ☐ Establish a software request and approval workflow
B. Inventory and Discovery
- ☐ Deploy automated software discovery tools across all environments
- ☐ Maintain a centralized software inventory database
- ☐ Conduct periodic reconciliation (☐ quarterly ☐ semi-annually ☐ annually)
- ☐ Track software installations, removals, and transfers
C. Entitlement Management
- ☐ Maintain a centralized license entitlement repository
- ☐ Store all license agreements, order forms, and proof-of-purchase records
- ☐ Track license metrics, counts, and usage rights for each product
- ☐ Calendar maintenance renewal dates, subscription expirations, and true-up deadlines
D. Compliance Monitoring
- ☐ Conduct internal compliance audits at least annually
- ☐ Reconcile deployments against entitlements after significant changes (acquisitions, restructuring, cloud migration, layoffs)
- ☐ Implement access controls to prevent unauthorized software installation
- ☐ Monitor for expired subscriptions and trial software
E. Vendor Relationship Management
- ☐ Review and understand audit clauses in all license agreements
- ☐ Negotiate favorable audit terms during contract renewals
- ☐ Maintain organized records to facilitate any future audit
- ☐ Build constructive relationships with vendor account teams
10.2 Employee Training
- ☐ Train all employees on the software procurement and usage policy
- ☐ Conduct annual refresher training
- ☐ Include software compliance in new-employee onboarding
- ☐ Establish a reporting mechanism for compliance concerns
- ☐ Address the consequences of unauthorized software installation
10.3 Ongoing Compliance Calendar
| Activity | Frequency | Responsible | Next Due |
|---|---|---|---|
| Software discovery scan | ☐ Monthly ☐ Quarterly | IT / SAM Manager | [__/__/____] |
| Entitlement reconciliation | ☐ Quarterly ☐ Semi-annually | SAM Manager | [__/__/____] |
| Internal compliance audit | ☐ Annually | Legal + IT | [__/__/____] |
| License renewal review | ☐ 90 days before each renewal | Procurement | [__/__/____] |
| Employee training | ☐ Annually | HR / Compliance | [__/__/____] |
| Audit clause review (new agreements) | ☐ Before execution | Legal | Ongoing |
PART XI: PRACTICE TIPS
11.1 Upon Receiving an Audit Notice
-
Do not panic, but do not ignore it. Respond promptly and professionally. Failure to respond may escalate the matter to litigation.
-
Do not provide data without legal review. All communications with the vendor or BSA/SIIA should go through legal counsel.
-
Preserve all records. Implement a litigation hold on all software-related records, license agreements, purchase orders, and communications.
-
Assess whether you are contractually obligated to comply. Review the audit clause carefully — some audit demands lack a contractual basis.
-
Determine if it is a "soft audit." Some vendors (especially Oracle) initiate "soft audits" disguised as helpful compliance reviews. Treat any information request as a formal audit.
11.2 During the Audit
-
Control the single point of contact. Designate one person (preferably legal counsel) as the sole point of contact with the vendor. Instruct all employees not to communicate directly with vendor auditors.
-
Do not install vendor audit tools without security review. Vendor tools may collect data beyond the audit scope and transmit it to the vendor. Evaluate security implications before any installation.
-
Challenge unreasonable requests. If the vendor demands access to systems, records, or information beyond the audit clause scope, push back in writing.
-
Validate the vendor's findings. Do not accept the vendor's audit report at face value. Verify deployment counts, metric calculations, and pricing independently.
-
Document everything. Keep detailed records of all communications, data provided, meetings held, and decisions made.
11.3 During Negotiations
-
Know your BATNA (Best Alternative to Negotiated Agreement). Understand the litigation risk and cost before entering negotiations. A strong BATNA improves your negotiating position.
-
Negotiate pricing aggressively. Vendors typically demand list price for over-deployed licenses. Insist on contracted pricing, volume discounts, and payment plans.
-
Bundle the settlement with a renewal or new deal. Vendors are often willing to reduce settlement demands if the company commits to a significant new purchase or cloud migration.
-
Demand a broad mutual release. The settlement should release all claims for past use — not just the specific products audited — through the settlement date.
-
Include a moratorium on future audits. Negotiate a period of at least 12-24 months during which the vendor will not conduct another audit.
11.4 After the Audit
-
Implement remediation immediately. Remove unlicensed software, purchase required licenses, and correct any compliance gaps identified during the audit.
-
Strengthen your SAM program. The best defense against future audits is a robust, ongoing software asset management program.
-
Calendar future compliance reviews. Set internal reminders for quarterly or semi-annual compliance reconciliation.
-
Review audit clauses in all new agreements. Before signing any new license agreement, review and negotiate the audit clause.
-
Consider cyber insurance. Some cyber insurance policies cover software audit-related costs and settlements.
SOURCES AND REFERENCES
Statutes
- 17 U.S.C. § 101 et seq. — Copyright Act
- 17 U.S.C. § 106 — Exclusive Rights in Copyrighted Works
- 17 U.S.C. § 501 — Infringement of Copyright
- 17 U.S.C. § 504 — Remedies for Infringement: Damages and Profits
- 17 U.S.C. § 504(c) — Statutory Damages ($750-$150,000 per work)
- 17 U.S.C. § 506 — Criminal Offenses
- 18 U.S.C. § 2319 — Criminal Infringement of a Copyright
Key Cases
- Oracle USA, Inc. v. Rimini Street, Inc., 879 F.3d 948 (9th Cir. 2018) (software copyright infringement damages)
- SAP America, Inc. v. InvestPic, LLC, 898 F.3d 1161 (Fed. Cir. 2018) (software copyright scope)
- Oracle Int'l Corp. v. Envisage Solutions Ltd., No. 5:17-cv-07075 (N.D. Cal. 2019) (unauthorized use of Oracle software)
- BSA v. Compupharma LLC, No. 14-cv-4065 (C.D. Cal. 2015) (BSA enforcement action)
- Adobe Sys. Inc. v. Christenson, 809 F.3d 1071 (9th Cir. 2015) (software licensing terms enforcement)
Industry Resources
- BSA | The Software Alliance: https://www.bsa.org/
- SIIA Anti-Piracy: https://www.siia.net/anti-piracy
- ITAM Review — Software Asset Management Best Practices: https://www.itassetmanagement.net/
- Gartner — Software Asset Management: https://www.gartner.com/en/information-technology/glossary/sam-software-asset-management
- ISO/IEC 19770-1:2017 — IT Asset Management Systems
Vendor-Specific Licensing Resources
- Oracle Licensing Documentation: https://www.oracle.com/assets/technology-price-list-070617.pdf
- Microsoft Volume Licensing: https://www.microsoft.com/en-us/licensing/
- SAP Licensing Guide: https://www.sap.com/about/agreements.html
- Adobe Licensing: https://www.adobe.com/howtobuy/buying-programs.html
- IBM License Information: https://www.ibm.com/software/passportadvantage/
Practice Guides
- Scott & Scott LLP — "11 Secrets to Defending BSA Audits": https://scottandscottllp.com/
- IAITAM — IT Asset Management Body of Knowledge
DISCLAIMER: This template is provided for informational purposes only and does not constitute legal advice. The use of this template does not create an attorney-client relationship. Laws and procedures change frequently, and the applicability of this template to specific facts may vary. You must have this template reviewed and customized by a qualified attorney licensed in your jurisdiction before use. ezel.ai is not a law firm and does not provide legal services.
Template prepared for ezel.ai — Legal Template Repository for Solo Practitioners
Last Updated: 2026-02-26
About This Template
Intellectual property law protects inventions, brand names, creative works, and trade secrets. Filings with federal IP offices have strict formal requirements, and demand letters or licensing agreements have to identify the exact rights being claimed. Weak IP paperwork makes it harder to enforce your rights against copycats, harder to sell or license your IP, and easier for someone else to claim it first.
Important Notice
This template is provided for informational purposes. It is not legal advice. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.
Last updated: March 2026