Software asset management and license audits for agencies

Reference article · 5 min read

Most agencies own more software than any single record shows. Purchases arrive by different routes: a department buys a tool on a purchasing card, IT renews an enterprise agreement, and a cloud subscription grows seat by seat. Each is a contractual promise about how many people or machines may use the product and under what conditions. Software asset management is the practice of keeping one accurate record of those promises and checking it against what is actually installed, assigned, and used.

Two failures follow from a record that is neither current nor reconciled. The first is shelfware: licenses the agency pays for year after year that nobody uses. The second is a shortfall found during a vendor audit or an annual true-up, which arrives as an unbudgeted invoice priced on the vendor's terms rather than the agency's. Both are avoidable, and both get harder to fix close to a renewal date.

Building the entitlement record

The entitlement record is the agency's own statement of what it is licensed to run. Assemble it from signed contracts, order forms, purchase orders, and amendments, not from a vendor portal alone. Portals reflect the vendor's view, which may miss licenses bought through a reseller or a cooperative contract.

A usable entry captures:

Product, edition, and version. Rights differ between tiers, and downgrade rights are not automatic.
License metric and quantity. The unit being counted and how many units are owned.
Term and key dates. Effective date, expiration, renewal notice deadline, co-termination, and whether maintenance is current.
Contract of record. The governing document, the purchasing vehicle used, and any negotiated addenda.
Assignment. Department, cost center, and fund, especially where grant money paid for the license.
Special rights. Transfer, virtualization, disaster recovery, test and development use, and rights on agency consolidation.

License models and what each requires you to track

The metric determines what the agency must be able to prove.

Per named user. Count assigned identities, not headcount. Service accounts, contractors, seasonal staff, and separated employees whose accounts remain active all consume entitlements.
Per device. Count endpoints, including shared workstations, kiosks, patrol vehicle laptops, and virtual desktops.
Concurrent. Track peak simultaneous use, which requires logging rather than a static inventory.
Per core or per processor. Virtualization and clustering rules are where server licensing most often goes wrong, because a workload allowed to move across hosts can obligate licensing on every host it could reach.
Consumption based. Cloud services billed by storage, transactions, or compute hours need spending controls and alerts rather than a seat count, and usage can grow without a purchase decision.
Enterprise or site licenses. Confirm the defined population. A license written for one city department does not automatically cover a joint powers authority or a consolidated IT service.

Watch for indirect access: server software reached through a public portal or an integration can still require licensing for the underlying users.

Reconciling entitlements against deployment

Reconciliation compares the entitlement record to discovery data. Useful sources include endpoint management and inventory tools, identity provider sign-in reports, cloud tenant administration reports, network discovery, and accounts payable data that reveals card purchases made outside the IT catalog. Product names rarely match across sources, so normalization is part of the work.

Run the comparison on a schedule and ahead of every renewal. Inactive accounts identified by last sign-in date are the most common recoverable cost. Pair reclamation with onboarding and offboarding so that separations release licenses automatically.

What an audit clause usually allows

Most commercial software agreements include an audit right. Terms vary by vendor and change over time, so read the contract in front of you and involve counsel. Clauses commonly address written notice, frequency limits, normal business hours, use of the vendor's staff or an independent auditor, the agency's duty to provide records and sometimes to run a measurement tool, payment for any shortfall, and who bears audit costs.

If an audit notice arrives, treat it as a contract matter. Name a single point of contact, route it through procurement and counsel, and ask the vendor to state the scope and legal basis in writing. Complete an internal reconciliation before producing anything. Review every export before release, and be deliberate about running vendor scripts on networks subject to criminal justice, health, or other security requirements.

What to ask and what to require

Questions worth asking before signing:

How is this metric measured and audited, and what evidence will you accept?
Do non-production, test, training, backup, and disaster recovery instances consume licenses?
Are licenses transferable between departments, or to a successor entity after consolidation?
What entitlement and usage reporting will the vendor provide, and how often?

Terms worth requesting in the contract:

Defined audit procedure. Advance written notice, no more than once per year, business hours, and a scope limited to the licensed products.
Shortfall priced at contract rates. True-up and audit settlements at negotiated pricing rather than list price, with a cure period to correct deployment instead of paying.
Reduction rights at renewal. The ability to decrease quantities without penalty.
Non-appropriation. Clear treatment of licenses and data if funds are not appropriated.
Auditor conditions. Confidentiality, background screening where applicable, and no software agents installed without written approval.

How to start

Rank vendors by annual spend and take the largest first.
Collect the governing contracts and order documents into one place.
Pull deployment and sign-in data for those products.
Reconcile, and record the gaps in both directions.
Correct over-deployment and cancel unused quantities before the renewal notice deadline.
Assign a named owner and calendar the renewal and reconciliation dates.

HQT works with state and local agencies on IT asset and license inventory, reconciliation, and renewal planning as part of broader enterprise technology support.

Frequently asked questions

What is the difference between a true-up and a software license audit?

A true-up is a scheduled reconciliation built into some enterprise agreements, where the agency reports what it deployed during the term and pays for any additions, usually at agreed contract pricing. An audit is the vendor exercising a contractual right to verify compliance, often on its own timing, and a shortfall found that way is commonly priced less favorably. Both measure the same thing, but a true-up is planned and budgetable while an audit generally is not.

How much notice does a vendor have to give before a software license audit?

There is no general rule; the notice period comes from the audit clause in the specific agreement, and terms differ by vendor and change over time. Many clauses call for advance written notice, limit audits to once in a given period, and require that the work happen during normal business hours. Read the contract that governs the product in question and have counsel confirm what the agency agreed to before responding.

What records should an agency keep to prove its software licenses?

Keep the signed agreement, order forms, quotes, purchase orders, invoices, and any amendments or negotiated addenda, along with proof of active maintenance or subscription status. Vendor portal screens and reseller confirmations are useful supporting evidence but should not be the only record. Store these where procurement and IT can both reach them, and keep them for at least the retention period in the agency's records schedule.

How can an agency avoid paying for software licenses nobody uses?

Compare assigned licenses against last sign-in or last-use data on a regular schedule, and again well before each renewal notice deadline. Tie license release to the offboarding process so that separations and transfers free seats automatically instead of waiting for an annual cleanup. Reductions usually can only take effect at renewal, so the reconciliation has to finish before the cancellation window closes.

Do test, training, and disaster recovery environments need their own licenses?

It depends entirely on the product's license terms, and this is one of the most common sources of unexpected shortfalls. Some agreements include limited rights for non-production or standby use, some require separate licenses, and some allow a cold standby but not a warm one. Ask the vendor to point to the specific language before standing up the environment, and record the answer in the entitlement file.