License Compliance Toolkit: Entitlement Records, Audit Clause Analyses, and Settlement Frameworks

Document type: Toolkit Practice area: Technology — Technology Transactions Jurisdiction: United States Last reviewed: 5 September 2026

Tool 1 — Entitlement register schema

One row per grant. Source document attached to each row. Owned by a named person. Reviewed quarterly.

Reconstruction sources, in order of yield: accounts payable · reseller order history · maintenance renewal quotes · the publisher's customer portal · procurement systems · email archives (including departed employees) · acquisition data rooms · contract repository.

Always request the publisher's own entitlement record and compare. Publishers lose entitlements from acquisitions, migrations, and legacy order forms too, and the discrepancies frequently favour the customer.

Tool 2 — Reconciliation worksheet

Per product, per metric, per quarter.

Product: ______ Metric: ______ Period: ______ Prepared by: ______ (privileged, at counsel's direction)

Entitled quantity: ______ (register rows: ______) Deployed quantity: ______ (source: ______, collected: ______) Position: □ Compliant □ Over by ______ □ Disputed on interpretation

Named user detail (if applicable) Total accounts: ___ · Active in period: ___ · Dormant >90 days: ___ · Departed employees: ___ · Service/system accounts: ___ · Duplicates: ___ · Test/training: ___ Contract definition of "user": [quote it] Adjusted count on the customer's reading: ___

Capacity detail (if applicable) Hosts: ___ · Sockets: ___ · Physical cores: ___ · Processor families and core factors: ___ Hardware changes in period: ___ (core growth is a top-five finding)

Virtualization detail (if applicable) Cluster: ___ · Total hosts: ___ · Licensed hosts: ___ · Affinity rule type: hard / soft Migration events in period: ___ Hosts on which the software has actually run: ___ Evidence location: ______

Environments Production: ___ · Dev: ___ · Test: ___ · Staging: ___ · Training: ___ · DR (passive/active): ___ Contract treatment of each: ______

Remediation available: ______ Estimated effect: ______ Exposure estimate: list $______ · negotiated $______ · settlement range $______

Tool 3 — Interpretation memorandum

Prepare one per ambiguous term, at the time the interpretation is adopted — not during an audit.

PRIVILEGED — PREPARED AT THE DIRECTION OF COUNSEL

Product: ______ Term: ______ Date adopted: ______

The contract language: [quote exactly, with the clause reference and the agreement it appears in]

The ambiguity: [state precisely what is unclear]

Readings available: (a) ______ (b) ______

The reading adopted: ______

Reasons: [contract text; structure of the agreement; the metric named in the order form; industry practice; the publisher's own statements or documentation; consistency with how the parties have operated]

Publisher's position, if known: ______ Source: ______

Financial effect of the alternative reading: $______

Approved by: ______ Reviewed: [annual date]

Why this matters. Innocent infringement under the Copyright Act permits a court to reduce statutory damages where the infringer was not aware and had no reason to believe its conduct infringed. A contemporaneous written record of a reasonable interpretation of an ambiguous term is the best available evidence on that question, and its absence is the best evidence a publisher has for the opposite.

Tool 4 — Acknowledgment letter

Send within a few days. Concede nothing.

[Date] — By email and courier

Re: Audit notice dated [date] — Agreement [reference]

Dear [name],

We acknowledge receipt of your letter of [date] regarding [Publisher]'s election to exercise the audit right under Section [X] of the [Agreement] dated [date].

[Customer] takes its licence obligations seriously and will comply with its contractual obligations under that Section.

We note that Section [X] provides for [thirty] days' written notice and that the audit is to be conducted [by an independent auditor / at Customer's premises during normal business hours / of records relating to Customer's use of the Software]. Your letter proposes a commencement date of [date] and requests [remote execution of collection tooling / access to Customer systems / network and architecture documentation]. We would be grateful if you would identify the contractual basis for each such request.

Please direct all communications regarding this matter to the undersigned. No other [Customer] personnel are authorized to respond, and we ask that the auditor not contact them directly.

Before any information is exchanged we will need to agree (i) a non-disclosure agreement with the auditor, and (ii) a written statement of scope covering the products, entities, period, environments, data, method of collection, and timetable, including Customer's opportunity to review and comment on draft findings.

We propose a call on [date, approximately four weeks out] to agree those matters.

Customer reserves all rights. Nothing in this letter or in Customer's participation in the audit constitutes an admission or a waiver of any right or defence.

Yours faithfully, [Name, title]

Tool 5 — Auditor NDA (key provisions)

Confidential Information means all information disclosed by Customer to Auditor in connection with the Audit, including deployment data, system configurations, account records, entitlement records, contracts, pricing, personnel information, and any analysis derived from any of the foregoing.

Permitted use. Auditor shall use Confidential Information solely to determine Customer's compliance with the Agreement and for no other purpose, including without limitation any other engagement, benchmarking product, or dataset.

Permitted disclosure. Auditor may disclose Confidential Information only to (a) those of its personnel engaged on the Audit who need it and are bound by equivalent obligations, and (b) [Publisher]'s licence compliance function. Auditor shall not disclose Confidential Information to [Publisher]'s sales, account management, marketing, or product organizations.

Reporting. Auditor's report to [Publisher] shall be limited to Auditor's compliance conclusions and the data reasonably necessary to support them, and shall not include Customer's broader environment, unrelated products, roadmap, or vendor relationships.

No aggregation. Auditor shall not incorporate Confidential Information into any benchmark, index, or aggregated dataset.

Security. Confidential Information shall be held on systems meeting [stated standard], shall not be transferred outside [territory], and shall not be processed by any subcontractor without Customer's written consent.

Return and destruction. Within [30] days after delivery of the final report, Auditor shall return or destroy all Confidential Information and certify destruction, retaining only work papers required by professional standards, which remain subject to this Agreement.

Third-party beneficiary. Customer may enforce this Agreement directly against Auditor. Auditor acknowledges that damages may be inadequate and that injunctive relief is available.

Tool 6 — Scope of audit agreement

Agree in writing before producing anything.

1. Products in scope: [list by name and version]. No other product is within scope. 2. Entities in scope: [list]. No affiliate outside this list is within scope. 3. Period: [start] to [end]. 4. Environments: [production only / production and DR / etc.]. Excluded: [list]. 5. Data to be produced: [enumerate exactly]. Customer will produce data generated by its own discovery tooling, in [format]. Customer will not execute Publisher-supplied tooling or provide access to Customer systems. 6. Method: Data produced through Customer's counsel, at [interval], accompanied by a description of collection methodology. 7. Timetable: production by [date]; Auditor questions by [date]; draft findings to Customer by [date]; Customer comment by [date]; final report by [date]. 8. Draft findings. Auditor shall provide draft findings to Customer and shall not deliver findings to Publisher or any Publisher commercial function until Customer has had [20] business days to comment and Auditor has considered the comments. 9. Interviews. Any interview of Customer personnel shall be arranged through Customer's coordinator, with counsel present. 10. No expansion. Scope may be expanded only by written agreement. 11. Reservation. Customer's participation is without prejudice to and does not waive any right, defence, or position, including as to the scope of the audit right itself.

Tool 7 — Production cover letter

Re: Audit — Production [N]

Enclosed is Customer's production [N] under the Scope Agreement dated [date], comprising:

• [file]: [description], generated by [tool] on [date], covering [scope]
• [file]: [description] ...

Methodology. [Two or three sentences: what tool, what it collects, what period, what it excludes and why.]

Known limitations. [State them. Gaps disclosed are far less damaging than gaps discovered.]

Items requested but not produced. [Item], because [it falls outside Section X of the Agreement / outside the Scope Agreement]. We would be grateful for the contractual basis for the request.

Customer reserves all rights. This production is made without prejudice to Customer's positions, including as to the interpretation of [term] and the scope of the audit right.

[Name, title]

Tool 8 — Findings rebuttal structure

RESPONSE TO DRAFT AUDIT FINDINGS — [Date]

1. Executive summary. Draft finding: $. Customer's position: $. The difference comprises [N] factual errors ($), [N] entitlements not credited ($), and [N] interpretation disputes ($). Customer concedes [item] in the amount of $.

2. Findings table.

#	Finding	Amount	Customer position	Category	Evidence
1				Factual error	Ex. A
2				Entitlement not credited	Ex. B
3				Interpretation	§4.2
4				Conceded	—

3. Factual corrections. [One paragraph per item, with the evidence identified.]

4. Entitlements not credited. [One paragraph per item, with the granting document attached.]

5. Interpretation disputes. [For each: quote the contract language; state the reading; state why; note any inconsistency in the Publisher's own practice or documentation.]

6. Conceded items. [State them plainly and identify the remediation already completed.]

7. Remediation completed. [What was done, when, and its prospective effect.]

8. Exhibits index.

Note. Concede the genuine shortfalls clearly and early. Credibility on the disputed items depends entirely on not fighting the indisputable ones.

Tool 9 — Settlement and release

Release. Upon receipt of the Settlement Amount, Publisher, on behalf of itself and its subsidiaries, affiliates, successors, and assigns, irrevocably releases and forever discharges Customer, its affiliates (including any entity that becomes an affiliate before the Effective Date), and their respective officers, directors, employees, agents, contractors, resellers, and customers, from any and all claims, demands, causes of action, and liabilities of any kind, whether known or unknown, whether in contract, tort, copyright, or otherwise, arising out of or relating to the use, installation, copying, deployment, or access of the Products at any time through the Effective Date, including without limitation any claim arising from the matters described in the Audit Report and any claim that could have been asserted on the basis of the facts disclosed in the Audit.

Scope. For the avoidance of doubt, this release extends to all Products listed on Schedule 1, all environments, all entities within the Customer group, and all periods through the Effective Date, whether or not identified in the Audit Report.

No admission. Neither this Agreement nor the Settlement Amount constitutes an admission of liability, infringement, or breach.

Confidentiality. The terms are confidential, subject to disclosure to professional advisers, auditors, and as required by law or regulation.

No further audit for the period. Publisher shall not conduct any audit covering any period ending on or before the Effective Date.

Publisher warrants that it has authority to grant this release on behalf of all entities holding rights in the Products.

Drafting note. The two clauses that matter are the extension to affiliates and customers, and the catch-all covering claims that could have been asserted on the disclosed facts. A release limited to "the findings set out in the Audit Report" leaves the publisher free to return with a different theory about the same period, which has happened.

Tool 10 — Amended audit clause

Negotiate at settlement or at renewal. This is the highest-value work in the whole exercise.

Records. Customer shall maintain records sufficient to verify its compliance for a period of [two] years, and shall have no obligation to retain records beyond that period.

Frequency and notice. Publisher may verify compliance not more than once in any twenty-four (24) month period, on not less than sixty (60) days' prior written notice to Customer's [named role].

Auditor. Verification shall be conducted by an independent auditor reasonably acceptable to Customer, which shall execute a non-disclosure agreement in favour of Customer in substantially the form of Exhibit [X] before receiving any information.

Scope and manner. Verification shall be limited to records reasonably necessary to verify Customer's compliance with the licence metrics for the Products, produced by Customer at its premises during normal business hours. Customer shall have no obligation to execute any software supplied by Publisher or the auditor, to grant access to any Customer system or network, or to produce network diagrams, architecture documentation, or information regarding products other than the Products. Verification shall not unreasonably interfere with Customer's operations.

Draft findings. The auditor shall provide draft findings to Customer and shall not deliver findings to Publisher until Customer has had twenty (20) business days to respond and the auditor has considered the response.

Cure. If verification identifies a shortfall, Customer shall have sixty (60) days from receipt of the final report to cure, whether by acquiring additional licences or by reducing deployment. No shortfall cured within that period shall constitute a breach of this Agreement or an infringement of any Publisher intellectual property right, and Publisher shall have no claim in respect of it.

Remediation pricing. Licences acquired to cure a shortfall shall be priced at the lowest price paid by Customer for the same Product and metric in the preceding thirty-six (36) months, without back maintenance, back subscription fees, interest, penalty, or uplift.

Costs. Each party bears its own costs, except that if verification discloses an uncured shortfall exceeding [ten percent (10%)] of Customer's entitled quantity for a Product after taking account of Customer's response, Customer shall reimburse the auditor's reasonable fees for that Product.

Confidentiality of results. The auditor's report shall be disclosed only to Publisher's licence compliance function and shall not be disclosed to Publisher's sales or account organizations.

Tool 11 — Metric definitions exhibit

Put these in the agreement. Do not leave them to a policy the publisher can rewrite.

"User" means a natural person to whom Customer has issued credentials permitting that person to log in to and directly operate the Software. "User" does not include (a) any account not associated with a natural person, including service, system, integration, batch, and monitoring accounts; (b) any account that has not been used to log in during the preceding [90] days; (c) any person who receives data or output originating from the Software through any other application, report, portal, interface, or file, and who does not log in to the Software; or (d) duplicate accounts held by the same natural person.

"Processor licence" entitles Customer to run the Software on [N] physical processor cores. Core counts shall be determined by reference to physical cores, disregarding hyperthreading or simultaneous multithreading. The core factor table at Exhibit [Y], as in effect on the Effective Date, applies for the Term and shall not be amended.

Virtualization. Where the Software runs on a virtual machine, licensing is required only for the physical hosts on which the Software has actually been installed or executed. Where Customer configures affinity rules restricting a virtual machine to specified hosts, only those hosts require licensing. No licence is required for any host on which the Software has not run, notwithstanding any technical capability for the virtual machine to migrate to that host, and notwithstanding any Publisher partitioning, virtualization, or licensing policy however published.

Non-production environments. Customer may install and use the Software without additional licence in [two] non-production environments per licensed production environment for development, testing, staging, training, and quality assurance, and in [one] passive disaster recovery environment, provided the DR environment is not used to process production workloads except during a failover event or a test of not more than [96] hours per year.

Affiliates. The licences extend to Customer and each of its Affiliates. An entity that ceases to be an Affiliate may continue to use the Software for [twelve] months following the change, after which it shall obtain its own licences.

Indirect access. No licence is required in respect of any person or system that receives data, reports, or output originating from the Software but does not log in to and directly operate the Software.

Tool 12 — Change gate

Embed in the change management process. Most findings originate in a change nobody assessed.

Licensing review required before any of the following proceeds:

• Hardware refresh or capacity change on any server running licensed software (core growth)
• Any change to cluster membership, affinity rules, or virtualization configuration (virtualization scope)
• Any new integration exposing licensed system data to another application or to external users (indirect access)
• Deployment of licensed software in any new environment
• Extension of access to a new legal entity, country, or business unit (entity and territory drift)
• Any acquisition, divestiture, or reorganization (transferability and entity scope)
• Migration of a licensed workload to any public cloud (licence mobility, bring-your-own-licence)
• Move to third-party support, or lapse of maintenance (expect an audit)
• Any bulk account provisioning (named user)

Reviewer records: the change, the products affected, the metric impact, the entitlement position after the change, and any remediation required. Two paragraphs. Filed with the register.

Tool 13 — Programme dashboard

Quarterly, one page, to the CIO and general counsel.

Products under management: ___ · Entitlement rows verified this quarter: ___ Reconciliations completed: ___ / ___ · Products in a compliant position: ___ Open exposures: [product, metric, quantity, estimated value, remediation plan, owner, date] Remediation completed this quarter: [items and estimated value avoided] Change gate reviews: ___ submitted · ___ requiring action Interpretation memoranda: ___ current · ___ due for review Active audits: [publisher, stage, next date, exposure range] Audit clauses amended this year: [publisher, provisions obtained] Renewals in next 12 months: [publisher, date, licensing objectives] Top three risks: ___

Related documents

• Software license audits and compliance disputes: true-ups, indirect access, and the letter you did not want
• Responding to a software license audit: a practical guide
• Software audit response checklist
• Infrastructure agreement toolkit: SLA schedules, power commitments, and exit provisions
• Patent licensing toolkit: grant clauses, royalty structures, and exhaustion analyses