Software License Audit Preparation: A Practical Guide for Indian IT Teams

The Letter That Cost ₹38 Lakh

In March 2025, a 180-user engineering firm in Peenya received an email from a global software vendor. It was not a renewal notice. It was an audit notification, requesting a self-declaration of all installations of that vendor's products within 30 days. The company's IT manager did what most people do: he panicked, asked his team to run a quick scan, and sent across a spreadsheet. The spreadsheet was wrong. It counted only Windows machines. It missed 61 Linux servers running the same product under a different deployment model. It missed the laptops of contractors who had installed the software on their own. By the time the vendor's appointed auditor finished their own discovery, the shortfall was 210 unlicensed installations. The settlement: ₹38 lakh, plus a two-year true-up that added another ₹9 lakh. Had the IT manager spent two weeks building a proper entitlement baseline before replying, the number would likely have been closer to ₹11 lakh. That is the difference preparation makes.

Most companies in India with 20 to 500 staff do not have a license audit problem. They have a data problem. They do not know what they own; they do not know what they installed; they do not know the rules that bind the two. An auditor exploits that gap. This article is about closing it before the letter arrives.

What Actually Triggers a Vendor Audit

Audits are not random. Vendors have limited audit capacity and they deploy it against accounts where the probability of recovery is high. If you understand the signals, you can predict which of your vendors will knock on your door — and when.

The triggers you control

A failed self-declaration. If your vendor asks for a simple license position statement as part of renewal and your response looks vague or inconsistent, you become interesting. Vendors use the annual renewal questionnaire as a low-cost audit. Answer sloppily and you invite the full process.

A sudden drop in maintenance or subscription spend. Annual spend going from ₹18 lakh to ₹7 lakh without a stated reason (office closure, product retirement) triggers a review. Cloud-marketplace purchasing that bypasses the vendor's direct channel is another signal. If you buy Microsoft 365 through a CSP but Oracle through a local reseller and Adobe direct, that fragmentation is a flag.

Rapid headcount growth. A company going from 80 to 300 employees in 18 months will almost certainly receive a license review request from at least one major vendor. Auditor staffing is allocated to accounts showing fast growth and no corresponding license uplift.

A merger, acquisition, or funding round. When a company raises a Series B or is acquired, its license position enters due diligence. The acquiring company's procurement team will often request a full software asset register. The vendor notices the transaction (M&A databases are public) and requests an audit at the same time, so the settlement happens at the seller's expense, not the buyer's.

Whistleblower reports or tips. The Business Software Alliance (BSA) and similar bodies run reward programmes. Departing employees with a grudge are a real source. This is not fiction; we have seen it twice in Bangalore.

The triggers you do not control

Vendor revenue pressure. Quarterly earnings targets push audit teams to accelerate. Year-end (March and December for many vendors) is peak audit season.

Reseller complaints. If a reseller loses a deal, they sometimes supply the vendor with information about your existing installations.

Product end-of-life. When a vendor discontinues a product (Dell Boomi, SAP Business One stop-sale events, etc.), the migration window is often used as an audit opportunity to clean up unlicensed use of the successor product.

What the Auditor Will Ask For

Vendors generally follow the ISO/IEC 19770-1 framework for software asset management. In practice, the audit will be run by an external accounting or IT advisory firm (Deloitte, KPMG, Grant Thornton, or a specialist like SHI or Snow in the software licensing space). The request list is fairly predictable:

1. A complete inventory of all installations of the vendor's products, grouped by version and edition
2. Server and virtualisation host information, including vCPU count, hardware partitioning, and hypervisor type
3. User count, including contractors, temporary staff, inactive accounts, and shared logins
4. Copies of all purchase orders, entitlements, certificates, and renewal confirmations
5. A description of how the products are used (production, test, DR, sandbox)
6. Details of any third-party hosting or outsourcing partners running the software on your behalf
7. Evidence of license retirement (decommissioning, uninstallation, hardware disposal)

Two of these destroy most Indian SMEs. First is the definition of a user. Second is the treatment of test and DR environments.

Most vendors define a named user license as any individual who accesses the software, including contractors, part-timers, and staff on leave. Shared logins are treated as a distinct user per person, and in some vendor contracts (notably Microsoft's per-user CAL model) a shared service account that is logged in may consume multiple licenses or trigger a server license requirement. Oracle's standard is worse for shared usage: a multiplexing front end requires a license for every person who can access the application behind it, regardless of whether they actually log in.

Test and DR environments are almost always chargeable, despite what your procurement team believes. Oracle's Technical Support Policy explicitly requires licenses for all environments unless you have signed a specific Test Environment Addendum. SAP requires production plus non-production licenses. Microsoft's licensing for SQL Server allows failover only under specific Software Assurance entitlements. If your DR site is a warm standby, it is licensed. If it is a cold standby that is not powered, maybe not — but you need to prove it.

Building Your Entitlement Baseline

The single most valuable exercise you can do before an audit is to build a defensible register of what you are entitled to use, separate from what you actually exercise. An entitlement baseline is not a license inventory. It is a legal record of your contractual rights, mapped to the physical and virtual estate.

Step 1 — Consolidate every purchase ever made

Pull every invoice, purchase order, email confirmation, and reseller quote for the past seven years (many vendors have a contractual audit lookback of three to five years, but Indian contract law and internal record retention policy should encourage seven). Categorise into: perpetual licenses, subscription entitlements, maintenance contracts, and cloud/consumption commitments. Create a spreadsheet with columns for vendor, product name, version, edition, SKU, quantity, purchase date, expiry, reseller, PO number, and deployment target.

This is the tedious part. It is also the part that wins the audit. Vendors routinely lose records of small add-on purchases. If you cannot find the PO, you lose the credit. We have seen a company lose ₹4 lakh of SAP user entitlements because the original 2018 PO was on a reseller letterhead that had since been dissolved.

Step 2 — Define the deployment metric per product

Different products use different metrics. The audit is scored against the metric in your contract, not the one you prefer.

Step 3 — Map installations to entitlements

Now run a proper discovery scan. Not a walk-around. Not a spreadsheet from each department. Use a tool that talks to all your management planes: SCCM (ConfigMgr), Intune, Jamf (for Macs), and agent-based scans for Linux servers. Our software asset management practice uses Flexera, Snow, or ServiceNow SAM Pro depending on what the customer already has. For companies without a SAM tool, a one-off engagement is usually more cost-effective than buying a platform, and it produces a defensible inventory for the audit.

For Oracle and SAP, the vendor will use their own discovery tooling. Oracle has a script (historically the "Oracle Server Worksheet" combined with LMS scripts) that scans hosts and databases; SAP has the LAW (License Administration Workbench) report. If you have not run these yourself first, do so. The vendor will, and the vendor's numbers are not wrong.

Step 4 — Reconcile and quantify the shortfall

Reconcile in both directions. Do not just calculate the shortfall. Calculate the credit. Many Indian companies are over-licensed. Two examples we found last quarter: a 200-user company had 310 M365 E3 licenses because the previous IT manager never de-provisioned leavers; a company had 45 unused VMware Enterprise Plus CPU entitlements on a cluster that was retired in 2024. The vendor will not tell you. You have to ask.

When you present the reconciliation, present it as a single number: net consumption vs net entitlement. This is the number you will negotiate from.

Common Shortfalls We See (and What They Cost)

Across our work with over 1,200 organisations, the same ten mistakes recur. Here is what they look like, with typical remediation cost in 2026 rupees.

These numbers are wide ranges for a reason: they escalate with the vendor's audit fees, which are often recovered from you, and with the "penalty" element which is usually quoted as back-maintenance for the unlicensed period. Note that back-maintenance is a separate charge from the license purchase and is rarely waived entirely.

The Failure Story: What Losing an Audit Looks Like

In late 2023, a Bangalore-based logistics technology company with around 280 employees received an audit request from Oracle. The company had a 4-server Oracle Database Standard Edition 2 deployment for its transport management system, plus two test copies. They believed the test copies were covered under their support contract. They were not. Oracle's LMS script ran on the four production hosts and the two test hosts. The test hosts each ran on a 16-core machine with vCPU misconfigured as full cores instead of hyperthreaded cores. Oracle's policy at the time counted the physical cores of the host, not the virtual cores (the policy shifted in 2019 but legacy contracts remain confusing). The result was 64 cores of unlicensed database, back-maintenance for 34 months, and audit fees.

The opening demand was ₹1.42 crore. The company's IT team spent three weeks reconstructing purchase history — some of it from a reseller that had shut down, some from a CFO who had left. They engaged a SAM specialist. They admitted the test copies but disputed the core count on the ground that the virtual machines could not use more than eight cores each. Oracle's team negotiated. The final settlement was ₹46 lakh plus a two-year true-up commitment. That is a good outcome compared to the opening number. It is still ₹46 lakh that could have been ₹9 lakh. Preventing it would have required running the LMS script internally once a year and buying two Standard Edition 2 licenses for the test pairs.

Preparing for the Audit Itself

If you receive the request, do not immediately acknowledge the full scope. Most vendors' audit clauses give you 30 days to provide self-declaration. Use them. Rarely does a legitimate audit letter prevent you from requesting a two-week extension, in writing.

The practical sequence

Week 1 — Scope the request. Reply in writing acknowledging receipt and asking for the exact audit scope: which legal entity, which products, which date, which audit firm, and the proposed methodology. This forces the vendor to define what they are claiming. If the scope is unclear, you can push back.

Week 2 — Mobilise internally. Inform legal, finance, and the CIO/CTO. Do not let the vendor speak to your staff directly without an internal gatekeeper. Assign one point of contact internally, typically IT asset management or finance.

Week 3 — Run your own discovery. Use the same tools the auditor will use. You want your numbers to be tighter than theirs.

Week 4 — Prepare the baseline and gap analysis. Present the numbers by product, by metric, by shortfall and over-licensing. Include an explanatory narrative.

Weeks 5–8 — Negotiate. See below.

The audit firm will request access to systems. You are generally obliged to provide a data extract, not on-site access. Push for a script-based or API-based extract to avoid a physical audit. If the vendor insists on a remote session, screen-record it so you have a record of what was seen.

Negotiating the Settlement

The vendor's first number is designed to be reduced. It is based on their discovery, not on your contractual reality, and it often includes back-maintenance and penalty components that are more aggressive than the master agreement supports. Here is what actually moves the number.

Admit what is true, dispute what is not. Credibility is the most important asset in settlement negotiation. If you concede the obvious shortfall, the vendor's team will be more open on the contested items.

Quantify over-licensing. If you have 310 M365 E3 licenses for 200 active users, the vendor's own paperwork shows it. In many settlements, over-licensing can be credited against under-licensing of a different product (though rarely across product families).

Point out the vendor's discovery errors. Vendors' audit tools are not infallible. They frequently miscount cores on VMware or read vCPU as physical CPU. If your host has 2x 24-core processors, and 60 virtual machines running 4 vCPUs each, Oracle's LMS tool will sometimes report 240 processors. You have 48 physical cores. The difference is huge.

Trade toward strategic. If you are going to buy more from the vendor anyway, offer to move forward a planned purchase or commit to a multi-year agreement in exchange for a reduced settlement. Vendors will accept a rupee of future commitment to reduce a rupee of past settlement, because the sales team needs the number.

Separate license, back-maintenance, and penalty. Vendors will often quote these as a single number. Break them down. Back-maintenance is negotiable; penalty is often the audit fee which is sometimes capped under your master agreement. Read the audit clause.

Involve legal early if the number is material. Under Indian contract law, audit clauses are enforceable, but they are not unlimited. A vendor cannot unilaterally impose fees beyond the master agreement. Ensure any settlement is documented in a written agreement that discharges the past claim.

Avoid admitting fraud. If the shortfall involves deliberate circumvention (cracked license managers, patched executables), the matter is different. This is rare. If it happened, you should have legal counsel before responding.

Where Audit Preparation Is Not the Right Investment

We should be honest about the trade-offs. For some organisations, this work is not worth the time.

• If you have fewer than 25 employees and use only productivity software in the cloud, the audit probability is low and the shortfall is small. A one-hour internal review is enough.
• If your software is entirely SaaS with per-user monthly billing, true up is automatic; there is no lasting shortfall and no reason for a baseline register.
• If you are a 100% open-source shop, you have no licensing exposure — but you may have support contract exposure in other forms.

Where preparation pays back is in any company running enterprise software from Oracle, SAP, Microsoft, VMware, or Autodesk. In 2026, with CERT-In and DPDP Act obligations adding reporting duties on top of vendor contract risk, the audit file is also a compliance file.

The right size of investment for a 200-user company is around 40-60 hours of internal time, plus a one-time external engagement of ₹75,000–₹2,10,000 (2026 pricing) to run the discovery, build the baseline, and document the gap analysis. That is cheap compared to a settlement in the crores.

A Word on the Indian Context

Some things are local. Keep these in mind:

• GST treatment. Software license purchases attract 18% GST, and audit settlements typically do too. A settlement of ₹36 lakh plus 18% GST becomes ₹42.5 lakh. Budget accordingly. Also, back-maintenance bills from the vendor are subject to GST on the same rate. Reconcile your input credit carefully.
• CERT-In directions (April 2022). If the audit reveals vulnerabilities in the software stack or unlicensed patches in production, there is an obligation under CERT-In directions to report certain cyber incidents within 6 hours. An auditor request doesn't trigger it; a discovered vulnerability does. Coordinate with your security team.
• DPDP Act (2023). Audit discovery data will contain employee and user records. This data is personal data under the DPDP Act. If you share it with a vendor or external audit firm, ensure you have a data processing agreement in place and that the transfer is documented.
• Reseller chain risk. Many Indian SMEs buy through small resellers who disappear. The audit will still hold the vendor's claim, because the vendor's contract is with you. Keep your own copies of all POs and entitlements on your own storage, not on the reseller's portal.
• Vendor audits on Indian subsidiaries. Vendors do often audit the Indian entity separately. If your global parent has a license agreement, verify whether the Indian entity is a named affiliate or covered under it. Many Indian subsidiaries are audited as standalone accounts even when global arrangements exist.

The Next Step

If this article has made you think your entitlement register is not good enough, that thought is correct. The gap between what you think you have installed and what you can prove you are entitled to is where an audit takes you.

Start with one product. Pick the vendor with the most exposure — Oracle, SAP, Microsoft, VMware, or Autodesk. Pull the POs for that vendor for the last five years. Ask for an internal team to produce a list of every installation, and compare the two. Do not delegate this to a junior engineer and do not let procurement do it alone. The comparison must be run by IT, with finance checking the numbers.

If you would like an external pair of eyes, our team at SynergyScape runs this as a fixed-scope engagement: discovery, baseline, and gap analysis, typically three to four weeks. You can read more on our software asset management services page, or contact us to discuss scope. If you want to do nothing else this quarter, at minimum answer these questions in writing: how many Oracle databases do I run, how many SQL Server hosts do I have, and how many M365 E3 licenses do I own? Most companies get the first two wrong. Run the answer and you have started.