Software Audit Response Checklist

Document type: Checklist Practice area: Technology — Technology Transactions Jurisdiction: United States Last reviewed: 5 September 2026

Section 1 — First 72 hours

Do not run the publisher's collection scripts
Do not let anyone respond to the auditor
Locate the governing agreement, all amendments, and every order form
Determine which agreement's terms actually govern each licence — publishers default to current terms
Read the audit clause in full
Appoint a single coordinator; instruct IT in writing
Engage counsel; establish the privileged channel
Acknowledge the letter without conceding scope or timetable

Section 2 — Audit clause analysis

Frequency — once annually? has one been done recently?
Notice period — compare against the demanded timetable
Who conducts it — publisher, independent auditor, or one reasonably acceptable to the customer
Scope — "records relating to use"? Note what it does not say: system access, script execution, network diagrams, architecture documentation
Location and manner — at the customer's premises during business hours?
Confidentiality, and to whom the auditor reports
Cost shifting — threshold and basis
Remedy on a finding — list price or negotiated price? Back maintenance? Interest?
Write down every gap between the demand and the clause

Section 3 — Privilege and preservation

Internal assessment directed by counsel, purpose documented in writing
Any licence consultant engaged through counsel; conflicts checked in writing (many also serve publishers)
Work product marked
Litigation hold if warranted, scoped to relevant products and custodians — not the whole estate
Instruct: no "cleanup" without telling the coordinator first — quiet mid-audit remediation looks like spoliation

Section 4 — Negotiate the audit terms

NDA with the auditor, running to the customer, excluding disclosure to the publisher's sales organization, prohibiting use beyond the audit, requiring return or destruction
Written scope document: products, entities, period, environments, data to be produced, form, collection method, timetable
Right to review and comment on draft findings before they go to the publisher's commercial team
Offer customer-generated discovery data in place of publisher tooling
Decline system access where the clause does not require it — in writing, asking for the contractual basis
Agree realistic dates and hold both sides to them

Section 5 — Entitlement reconstruction

Sources, in order of yield:

Contract repository
Procurement and purchasing systems
Accounts payable — often the best trail
Email archives, including departed employees
The publisher's own customer portal
Reseller order histories — resellers keep good records and will produce them
Acquisition data rooms
Maintenance renewal quotes — usually the cleanest summary of supported quantities

Build the register:

Publisher, product, version, metric, quantity, granting document, date, holding entity, territory, maintenance status, restrictions
Source document attached to every row
Request the publisher's entitlement record and compare — discrepancies often favour the customer
Trace migrations, upgrades, and metric conversions, verifying each conversion ratio

Section 6 — Deployment discovery by metric

Named user: account inventory, last activity, role, status; shared, service, test, training accounts identified; contract definition of "user" established
Concurrent: session definition, timeout, pooled connection behaviour
Capacity: processor model, sockets, physical cores, hyperthreading, publisher core factor per family
Hardware refresh history — core growth is a top-five finding
Virtualization: cluster membership, host inventory, VM placement, affinity rules, and migration logs
Migration logs are the decisive evidence — they convert "could run" into "did run"
Environments: production, dev, test, staging, training, DR identified and mapped to contract terms
Indirect access: integration architecture, data flow, real-time vs batch, credentials held, functionality exposed

Section 7 — Reconcile and remediate

Entitlements against deployments, per product, per metric
Position stated for each: compliant / over-deployed by N / disputed on interpretation
Remediate before producing: deactivate dormant accounts, uninstall unused, isolate clusters, move workloads
Document the interpretation of every ambiguous term, with reasoning — this answers wilfulness
Quantify three numbers: publisher's likely opening at list; customer's position; probable settlement range
Brief the CFO and executive team with the range and the process shape

Section 8 — Production

Produced through counsel with a cover letter: what is produced, how collected, known limitations, rights reserved, scope confirmed
Answer only what is asked — do not volunteer
Requests exceeding agreed scope challenged in writing
Production log maintained: what, when, to whom, in response to what
Consistency verified across any concurrent audits
Data clean, complete, and labelled — gaps invite adverse extrapolation

Section 9 — Rebut the findings

Categorize every line: factual error / metric interpretation / entitlement dispute / genuine shortfall
Concede genuine shortfalls clearly — credibility on the disputed items depends on it
Correct factual errors with evidence attached
Written rebuttal document: executive summary, findings table with position on each, indexed evidence
Never let a draft finding reach the commercial team without a response

Section 10 — Arguments by metric

Virtualization:

Affinity rules and migration logs showing actual deployment
Contract language — "installed or running," not "could run"
Status of the partitioning policy — website document, unilaterally amendable, imported by a general reference to "documentation"
Prospective remediation into an isolated cluster

Indirect access:

Contract definition of "user" — individuals authorized to access the Software
Architecture: batch extraction into a reporting layer is not real-time access
Publisher's inconsistent practice across its customer base
The commercial alternative — most such claims are an argument for a pricing model

Named users:

Accounts that are not people: service, integration, system
Deactivation dates evidenced
Provisioned vs actually used, where the contract supports it
Duplicates for one individual

Entity and territory:

What the order form says about the licensed entity
Whether the corporate transaction triggered a consent requirement, and whether consent was given

Section 11 — Settlement

Settle the facts in writing before discussing money
Attack the pricing basis — negotiated rate rather than list; no back maintenance, interest, or penalty
Identify what the publisher actually wants — subscription conversion, cloud migration, renewal, expansion
Complete release: all claims, contract and copyright, all periods through the effective date, all products in scope, customer and affiliates and personnel
Not a release limited to "the findings in the Audit Report"
Accounting treatment confirmed with the CFO; disclosure assessed

Section 12 — Fix the contract while leverage is highest

Cure period — 30–60 days to remediate before any claim arises
Remediation at the customer's most recent negotiated price, no back maintenance or interest
Audit frequency limited to once in 24 months; 60 days' notice
Auditor reasonably acceptable to the customer, NDA running to the customer
Scope limited to records, at the customer's premises; no obligation to run publisher tools or grant system access
Auditor reports the compliance conclusion only, not the customer's estate
Metric definitions written into the agreement — user, processor, core factor, virtualization, indirect access
Where a policy must be referenced, attach the current version as an exhibit; later versions do not apply
Environment carve-outs: dev, test, staging, training, DR, with an allowance
Affiliate coverage; survival through change of control and reorganization; transitional licence for a divested business
Records retention obligation limited to the audit look-back period
Cost shifting only above a meaningful threshold and only after the customer's response

Section 13 — Prevention

Entitlement register maintained, not reconstructed, with a named owner
Quarterly reconciliation per product per metric
Change gate: hardware refresh, virtualization change, integration, acquisition, divestiture assessed for licensing impact before it happens
Interpretation file kept current
Audit runbook with each major clause summarized and the response template ready
Clause library: frequency, notice, auditor, scope, cure, remediation pricing, per publisher
Annual privileged self-assessment of the highest-risk products
Renewals treated as licensing opportunities, not only price negotiations
Acquisition diligence: transferability checked, representation on assignability, consents obtained before closing