A software audit letter has arrived. Now what?
It usually comes without warning — an email, a formal letter, or a call from a software vendor (or a third-party audit firm acting on their behalf). They’re conducting a software licence audit and require your cooperation.
For most IT and procurement teams, this is the moment they realise how little visibility they have over their software estate and licence compliance. By then, the balance of power has already shifted to the vendor.
Software audits are not rare. They are a routine and increasingly aggressive software compliance enforcement mechanism used by major vendors like Microsoft, Oracle, Adobe, and Broadcom. This guide explains how they work — and how to protect your organisation.
In this guide:
- What triggers a software audit
- Which vendors are most active
- Common compliance risks
- How to respond when a software audit letter arrives
- How to reduce audit risk proactively
Why Software Vendors Audit — and Why It’s Increasing
Software audits are written into most enterprise licence agreements. Vendors use them to verify compliance — but they are also a significant revenue-generating mechanism.
When a vendor suspects — or calculates — that an organisation may be under-licensed, they exercise those rights. The outcome is typically backdated licence fees, a settlement agreement, or additional licence purchases.
Why Audit Activity Is Growing
- Cloud and SaaS complexity
Many organisations assumed subscription models would reduce compliance risk. In reality, risk often increases. SaaS platforms monitor usage centrally, features are activated tenant-wide, and licensing rules are more granular than ever.
- Vendor consolidation
Following acquisitions — such as Broadcom’s takeover of VMware — new ownership brings new revenue expectations and more assertive audit strategies. Organisations with previously stable vendor relationships are now facing significantly more rigorous licence scrutiny.
- Better data visibility for vendors
Modern platforms allow vendors to monitor usage directly and in detail, making it significantly easier to identify potential compliance gaps — often before you are even aware of them.
Common Triggers for a Software Audit
Organisations are typically selected for audit based on patterns such as:
- Rapid growth in users or infrastructure
- Merger or acquisition activity
- Unusual usage patterns flagged by the vendor
- Under-reporting at licence renewal (e.g. Microsoft Enterprise Agreement True-ups)
- Data signals obtained through partners or third-party procurement ecosystems
Major Vendors Conducting Software Audits
Microsoft Software Audit Risk
Microsoft does not always initiate formal audits in the way other vendors do. Instead, it relies on monitoring, structured review programmes, and Enterprise Agreement renewal negotiations to surface compliance issues.
Common Microsoft audit risk areas:
- Microsoft 365 E5 licensing exposure from tenant-level feature activation without corresponding user licences
- Azure Hybrid Benefit claimed without valid or documented Software Assurance entitlement
- Under-reported usage in Enterprise Agreement True-ups — often due to incomplete inventory visibility
- Perpetual licences with Software Assurance but no record of the original purchase chain
| Key takeaway: You must be able to evidence your licensing position, not just assume compliance. The burden of proof sits with the customer. |
Oracle Java Audit Risk
Oracle’s Java SE audit programme has expanded significantly and frequently catches organisations that believe they are compliant.
The most critical — and widely misunderstood — aspect of Oracle’s current commercial model is that licensing exposure is often calculated on total employee count or equivalent organisational metrics, not actual usage. A single Java installation can create a significant, organisation-wide financial liability.
Oracle actively targets organisations across sectors, using software inventory data obtained via third parties and patterns identified through procurement ecosystems.
Adobe Licence Audit Risk
Adobe audits are typically conducted by the BSA (The Software Alliance) on Adobe’s behalf. Creative Cloud licences are strictly named-user — yet in practice, many organisations unknowingly breach this requirement.
Common Adobe compliance triggers:
- Shared or generic accounts breaching named-user terms
- Geographic usage outside licensed territories
- Growth through acquisition without licence reconciliation
- Contractor and flexible working usage not accounted for in the licence model
VMware / Broadcom Licensing and Audit Risk
Since Broadcom’s acquisition of VMware, the licensing model has changed fundamentally. Perpetual licences have been replaced with subscription-based offerings, and many organisations have found their historical entitlements altered or reframed.
Broadcom has adopted a significantly more assertive enforcement approach, including legal escalation in some cases. At renewal, organisations are often required to provide detailed infrastructure environment data — via vendor-supplied scripts — before receiving a quote.
| If you haven’t reviewed your VMware position under the new licensing model, that review is overdue. |
The 3 Mistakes That Turn a Software Audit Into a Crisis
|
Mistake 1: Responding Without Preparation When an audit notification arrives, the instinct is often to cooperate immediately and provide everything requested. This is the wrong approach. Audit requests are deliberately broad — vendors ask for more information than they are contractually entitled to, in formats designed to advantage them. You have time. Audit processes take months. Use the early weeks to understand your position and contractual obligations before disclosing anything. |
|
Mistake 2: Assuming SaaS Means No Risk Migrating to cloud and SaaS does not eliminate compliance risk — it changes its form. SaaS licences are typically named-user. Shared accounts, generic logins, and unlicensed users accessing a platform are violations just as much as unlicensed on-premise software. And the usage data vendors hold on your SaaS estate is often more detailed than anything they could obtain from an on-premise inspection. |
|
Mistake 3: Letting It Get to Audit in the First Place The most expensive audits are the ones that were preventable. An organisation with accurate inventory, regular licence reviews, a functioning leaver process, and clear compliance accountability is a far less attractive audit target. Vendors target organisations they believe are likely to be non-compliant. The cost of proactive software asset management is a fraction of the cost of a single significant audit finding. |
How to Prepare for a Software Audit: Audit Readiness Checklist
Audit readiness is not perfect compliance. It is confident visibility. In practice, it means having the data and processes to understand your own position — before a vendor does.
- Accurate software inventory — Across on-premise, cloud, and SaaS environments
- A clear licence position — What you own versus what you have deployed
- Supporting documentation — Contracts, purchase records, invoices, Software Assurance certificates
- Ongoing SAM processes — Not one-off point-in-time exercises
- Independent expertise — Free from reseller bias or commercial conflicts of interest
What to Do If You’ve Already Received a Software Audit Letter
If an audit notification has already arrived, the most important thing you can do is not respond unilaterally. Here’s the process to follow:
- Do not respond immediately to the vendor’s information request
- Review your licence position internally before making any disclosures
- Understand what you are contractually required to provide — and what you are not
- Seek independent software asset management advice
- Prepare your negotiation position early, based on accurate data
Most audits, even those that identify genuine compliance gaps, are resolved through negotiation rather than litigation. The organisation that arrives at that negotiation with a clear understanding of its position — supported by accurate data and independent expertise — consistently achieves a better outcome than one that responds reactively.
The Software Audit Risks Most Organisations Are Carrying Right Now
Here is an honest assessment of where most mid-market organisations sit today. These are not hypothetical risks — they are patterns we see consistently when working with organisations on their software estate.
Microsoft: Licences assigned to leavers, E5 features activated at the tenant level without full user licensing, Azure Hybrid Benefit claimed but not fully documented, perpetual licences with Software Assurance but no provenance records.
Oracle: Java SE deployed somewhere in the environment — sometimes without IT teams being aware — creating a potential liability calculated on the entire employee headcount.
Adobe: Creative Cloud licences that have drifted from the named-user model through shared accounts, contractor usage, or international deployments.
VMware: Workloads running on licensing terms that may no longer reflect actual entitlement following the Broadcom transition.
None of these gaps were created through negligence. They were created through growth, change, and the genuine complexity of modern software licensing. But they are real, they are auditable, and they are the reason a proactive review is worth doing now — on your terms, before a vendor decides to do it on theirs.
Reduce Your Software Audit Risk Before It’s Too Late
Software audits do not have to be a crisis. A proactive software asset management strategy reduces audit likelihood, minimises financial exposure, and — critically — identifies cost-saving opportunities that a reactive approach never surfaces.
One final point worth making: a software audit will not tell you where you can optimise spend. At The SAM Club, we do.
About The SAM Club
The SAM Club provides independent software asset management consulting. We have helped organisations navigate software audits, prepare for vendor reviews, and build the ongoing licence management practices that make audits far less likely — and far less damaging when they do occur.
We are not a reseller. We have no commercial relationship with Microsoft, Oracle, Adobe, or Broadcom. Our only interest is ensuring your software estate is accurately understood, properly managed, and defensible.
If you would like to understand your current audit exposure, or if an audit notification has already arrived, visit us at thesamclub.co.uk.
The SAM Club Limited. Independent software asset management consultants since 2014