Software license models, metrics, and true-up audits

Reference article · 5 min read

A software license is a counting rule attached to a price. The agency agrees to a metric, the publisher agrees to a scope of use, and the invoice follows from how many of the counted things exist on the date someone looks. Most license disputes are not about whether the software was used. They are about what counts as a user, a device, or a processor, who does the counting, and which date the count refers to.

Compliance letters and renewal shock usually trace back to a decision made years earlier: a metric that fit the agency at signing and no longer matches how it operates.

The models you will encounter

• Perpetual with annual maintenance. You run a version indefinitely and pay a yearly percentage for support and upgrades. Escalation lives in the maintenance line, and dropping maintenance often forfeits future versions, with reinstatement priced as back maintenance plus a fee.
• Subscription or term. Rights end when payment ends. Budgeting is smoother, but there is no residual asset, and a lapse in appropriation may be treated as termination rather than a pause. Non-appropriation language matters most here.
• Named user. Everyone authorized to use the software counts, whether or not they log in. Counts grow quietly through turnover when deprovisioning is slow, because many agreements count assigned identities, not active ones.
• Concurrent user. You pay for simultaneous sessions. This suits shift-based operations, but it needs metering both sides trust, and idle sessions hold seats.
• Device or endpoint. Counted per workstation, mobile unit, or vehicle. Shared devices are efficient here. Staff carrying three devices are not.
• Processor, core, or capacity. Common for databases and middleware. Price follows hardware, so a refresh to denser processors can raise the requirement even though use did not change.
• Population or transaction based. Priced on residents served, case volume, permits issued, or calls handled. A decennial census figure, an annual estimate, and a service area population are different numbers, so name the governing source in the contract.

Where counting breaks in practice

• Virtualization. Some publishers count the physical hosts a virtual machine could move to, not the hosts it runs on. An unpinned cluster can expand the countable footprint well beyond what is deployed.
• Non-production environments. Development, test, training, and disaster recovery copies are often licensable unless the agreement says otherwise. Warm and cold standby are usually treated differently, so write the difference down rather than assume it.
• Seasonal and part-time staff. Election workers, summer help, and interns can each consume a named seat. Ask whether seats may be reassigned, and after what interval.
• Contractors and other entities. Confirm in writing that contractors, volunteers, reserve officers, and staff of jurisdictions under an intergovernmental agreement may use the software on your behalf.
• Indirect access. Data reaching a public portal or another system through an interface can create obligations for people who never open the vendor's product, a common source of unexpected findings.

Audit and true-up clauses

An audit clause lets the publisher verify compliance. A true-up clause sets what happens when the count exceeds what was purchased. Read them together: the audit produces the number and the true-up prices it. Worth negotiating before signature:

• Frequency and notice. No more than once in any twelve month period absent a documented good faith concern, with advance written notice measured in weeks rather than days.
• Scope and method. Limit it to the licensed products, to systems the agency controls, and to a defined lookback period. Require any discovery script to be identified in advance and reviewed by agency security staff.
• Who performs it and who pays. Name acceptable auditors, require them to meet agency security and background requirements, and place the cost on the publisher unless a material shortfall is found, with material set at a stated threshold rather than any variance.
• Cure and remedy pricing. Allow a window to correct a shortfall by reducing use or purchasing. Fix the remedy price at contract or cooperative vehicle pricing, not undiscounted list, and exclude retroactive maintenance and penalty multipliers.
• Data handling. State what the auditor may collect, how it is protected, when it is destroyed, and that personally identifiable, criminal justice, and protected health data are out of scope. Findings may also interact with state public records law, so ask counsel.

Records the agency should keep

Keep these continuously, not when a letter arrives.

1. Every order form, quote, and amendment, paired with the use rights document in effect on the order date.
2. An entitlement register: product, metric, quantity, term dates, and the granting contract.
3. Dated deployment evidence from your own tools, including virtualization topology and an inventory of non-production copies.
4. Provisioning and deprovisioning records tied to personnel actions, so a seat count can be reconstructed for a past date.
5. Written vendor answers to licensing questions, filed with the contract. A sales email is weak evidence. An amendment is strong.

What to ask and how to start

Start with the few publishers holding most of your software spend. For each, record the metric, the licensed quantity, the date of the last verified count, and the next renewal date. Then put the hard questions in writing and ask for answers as contract language, not a policy page the publisher can revise:

• How are virtual and clustered environments counted under our agreement?
• Which non-production copies are included at no additional charge?
• Does interface-based access create licensable users?
• May seats be reassigned when staff leave, and how quickly?
• If a count is disputed, what is the process and who bears the cost?

The renewal, not the audit, is the leverage point: by then the publisher already has a number.

HQT advises state and local agencies on enterprise IT, including license position reviews before renewal.

Frequently asked questions