How to Get Ready for a Software Audit

Most software audits begin long before the audit letter arrives, often months earlier, when a change in the business catches the attention of a publisher's account team. By the time the formal notice lands, the publisher has usually done its homework, and the organizations that respond well are the ones that have done theirs.

The financial stakes make that preparation worthwhile. In Flexera's 2025 State of ITAM Report, 45% of organizations reported paying more than $1 million in software audit costs over the previous three years.

Preparation is also getting harder. A decade ago, most of what a publisher could audit sat in the data center and was licensed per device. Today, software spend is spread across SaaS subscriptions, public cloud, licenses moved to the cloud under bring-your-own-license terms, tools purchased on corporate cards, and AI services priced by consumption or by the token. Each comes with its own metrics and contract terms, and many are purchased without ITAM or procurement involved, which makes it difficult to say with confidence what the organization owns, what it uses, and what it owes.

A useful way to gauge readiness is to ask whether your organization could answer five questions today:

1. Who are your top 10 publishers by spend and by risk?
2. When do those contracts renew?
3. Could you prove your license position for your largest publishers within 30 days?
4. What does the audit clause in each of those contracts actually say?
5. What did you renew last cycle that had little or no usage?

When Anglepoint polled attendees of the From SaaS Sprawl to Audit Defense webinar, 25% said they could answer all five. Most had gaps in at least one area, which is common and fixable, and the webinar's procurement and licensing experts focused on four places to start: understanding what triggers an audit, being able to prove your license position, controlling the response, and putting the right team in place.

Understand What Can Trigger a Software Audit

Software audits rarely come out of nowhere. Publishers, and the third-party audit firms they engage, watch for signals that a customer's license position may have changed, and in many cases the customer's own sales representative is the one who recommends an account for review.

Common triggers include:

• Rapid growth, or mergers and acquisitions that bring new companies and contracts into the estate
• Reorganizations and leadership changes, especially when they become public
• Products that have reached end of support or end of life but are still in use
• Major cloud migrations that move existing licenses to AWS, Azure, or Google Cloud
• The 180 to 90 days before a significant renewal, when account teams begin asking more questions
• Declining spend, which publishers often describe as a "shrinking customer"
• The publisher's own quarter-end or fiscal year-end targets
• Internal whistleblower reports

Cloud migrations deserve particular attention. Bring-your-own-license arrangements can deliver meaningful savings, but the rules for running existing licenses in the major public clouds include detailed provisions on processors, virtualization, and where workloads can run, and a misstep can turn expected savings into a compliance finding.

Declining spend is the trigger that tends to surprise organizations. Reducing a commitment with a publisher is often the right business decision, but the publisher will want to understand why, and an audit is one way to recover lost revenue. It is also worth remembering that not every audit ends in a penalty; in some cases, the outcome is a required upgrade because the licensing terms have shifted.

None of this means organizations should avoid acquisitions, cloud moves, or contract reductions. It means that when one of these events is approaching, ITAM and procurement should review the license position with the affected publishers first, while there is still time to address what they find.

Can You Prove Your Software License Position?

Audit readiness is ultimately a data problem. Contracts show what the organization purchased, discovery tools show what is deployed, SaaS management platforms show who holds a subscription, and procurement systems hold the purchase history. The challenge is bringing those sources together into a single, credible view of the organization's position that can stand up to a publisher's review.

That view is an effective license position, or ELP, which compares entitlements against actual deployment and consumption while applying the publisher's licensing rules. Done well, it shows whether the organization is compliant and where it may be paying for more than it uses.

Few organizations can build an ELP for every publisher at once, so prioritization matters. A practical starting point is a list of the 10 publishers that represent the greatest spend and risk, noting which of them audit frequently and tracking each one's renewal dates, contract terms, and internal owners. If 10 feels like too many alongside active renewals and RFPs, start with one, learn that contract thoroughly during its renewal cycle, document what you find, and then apply the same approach to the next.

Two habits make this work much easier to sustain. Keeping agreements in a contract lifecycle management system means no one has to search through inboxes and shared drives when a notice arrives, and routing SaaS purchases through procurement or ITAM keeps the inventory complete as new tools enter the business.

The audit clause itself deserves close review, since agreements vary widely on audit frequency, notice periods, scope, the data a publisher may collect, and who bears the cost. When a contract is silent on audits, the publisher is left to interpret the terms, and publishers often have larger legal teams than their customers. Legal and ITAM are most effective when they review these provisions together, with legal interpreting the obligations and ITAM explaining how the software is actually deployed and used.

Conduct a Dry Run Before a Publisher Asks

One of the most valuable exercises an organization can complete is a dry run: choosing a high-risk publisher and building its license position internally before anyone asks for it. The exercise quickly shows whether the team can locate every agreement and amendment, identify where the software is deployed, apply the right licensing rules, and explain any gaps between entitlement and consumption.

Most dry runs uncover issues. Discovery data may be incomplete, a contract amendment may be missing, a business unit may have purchased additional SaaS subscriptions outside the approved process, or a cloud migration may have changed the licensing requirement. Finding those issues on your own schedule gives the organization time to address them before they become audit findings.

The value extends well beyond audit preparation. The same data helps procurement negotiate from facts at renewal, helps ITAM identify licenses that can be reclaimed, and gives the organization its own numbers to compare against the publisher's.

How Should You Manage a Software Audit?

Even a well-run ITAM program can create unnecessary risk if the audit response is disorganized. Publishers often contact several people at once, such as someone in procurement, a technical lead, legal, or an application owner, and when each responds independently the organization can end up sending conflicting reports or sharing data before anyone has reviewed it.

We outlined six steps to keep the process under control:

1. Control the notification. Make sure everyone likely to receive an audit letter knows to route it to a single place.
2. Mobilize the team and involve legal early. Move quickly to organize the response, but hold off on sending any data.
3. Name a single point of contact. One authorized person should manage all communication with the publisher.
4. Review your rights. Many requests are soft audits that the contract may not require you to answer, so legal should confirm what is required before anyone responds, and some requests can simply be declined.
5. Run your own assessment in parallel. Build an independent view of your license position rather than relying on the publisher's.
6. Validate before resolving. Compare the publisher's findings with your own and understand every difference before moving into negotiation.

The principle that connects all six steps is control of information: knowing what the organization is obligated to provide, providing only that, and having its own numbers ready when the publisher presents theirs.

Build the Audit Response Team Before You Need It

When we asked attendees whether they had a documented, organized audit response process, only a few said they did. For many organizations, the first audit letter is still the moment the response team comes together.

No single function can manage an audit on its own. ITAM understands what is deployed but may not own the vendor relationship, procurement holds the contracts and renewal history but not the deployment detail, legal knows what the agreement requires but needs ITAM to explain how the software is used, and business owners understand why they use an application but not necessarily how that use affects licensing.

A typical audit response team includes:

• ITAM or SAM
• Procurement and sourcing
• Legal
• Risk or compliance
• Relevant technical teams
• Application and business owners
• A designated point of contact for publisher communication

Defining who gathers data, who validates it, who approves external communication, and who can make commercial decisions is much easier before an audit than during one, and a RACI makes those responsibilities clear. Procurement is a team sport, and audit defense works the same way. Organizations that build this partnership in advance can respond to each new notice with a process everyone already knows, turning what would otherwise be a crisis into a routine.

Start Preparing Before the Audit Letter Arrives

SaaS, cloud, and AI will continue to change how software is purchased, deployed, and licensed, and publishers will continue to adjust their models in response. For most enterprises, an audit is a matter of when, not if.

Preparation does not have to happen all at once. Starting with the highest-risk publisher, organizations can pull the relevant contracts, review the audit clause, build an effective license position, and document who does what when a notice arrives, then repeat the process for the next publisher. The same work strengthens the broader ITAM program, supporting better renewal planning and helping reduce spend on software that is no longer needed.

How Anglepoint Helps

Recognized as a Leader in SAM Managed Services by Gartner and IDC, Anglepoint is a neutral partner that does not conduct audits on behalf of publishers and does not sell software. Its licensing and audit experts, including former auditors, help organizations build effective license positions, interpret publisher licensing rules, review contract terms, and respond to active audits.

Anglepoint's Software License Management services support each area covered in this article, from publisher prioritization through audit response. Ready to understand where your organization stands? Talk to an Anglepoint licensing expert.

For the full discussion, including common audit triggers, the six-step response process, and guidance on building the response team, watch the From SaaS Sprawl to Audit Defense webinar.