MI Solutions
Insights/Audits and compliance
Audits and compliance

Software License Audits: How to Prepare, Respond and Reduce Exposure

How software license audits work, which publishers audit most, what they cost, and how to prepare, respond and reduce your exposure.

By the MI Solutions SAM team12 min read2 exhibits

A software license audit is a publisher's formal check that you are using its software within the terms of your contracts. Most enterprise license agreements include an audit clause, and publishers use it regularly. An audit is not an accusation, but it is expensive if you are unprepared: findings are often priced at list, back-dated, and combined with pressure to buy more.

Who audits

Exhibit 1
Microsoft audits more organizations than any other publisherShare of organizations audited by each publisher in the past three years0%20%40%60%Microsoft50%IBM37%SAP32%Adobe24%Oracle24%ServiceNow21%Salesforce20%Source: Flexera, 2025 State of IT Asset Management Report (506 respondents).

The list is a mix of publishers with complex on-premises licensing, such as IBM, SAP and Oracle, and SaaS vendors whose contracts still include audit rights. Moving to the cloud does not remove audit risk; it changes where it sits.

What audits cost

45%of organizations spent more than $1 million on software audits in three yearsFlexera, 2025
23%spent more than $5 millionFlexera, 2025
50%were audited by Microsoft in that periodFlexera, 2025

The cost is not only the settlement. It includes internal time across IT, procurement and legal for weeks or months, advisor fees, and the commercial pressure that often follows: a finding that is "resolved" by buying a larger agreement than you need.

How an audit works

  1. Notice

    A letter invokes the audit clause, sometimes naming a third-party auditor.

  2. Kick-off

    Scope, timeline, data requirements and contacts are agreed.

  3. Data collection

    You provide deployment data, often through scripts or tools specified by the auditor.

  4. Analysis

    The auditor compares deployments with your entitlements.

  5. Draft findings

    You review and challenge errors.

  6. Settlement

    Any shortfall is resolved, typically by purchasing licenses.

Draft findings are a starting point

Auditors work from the data they collect and the entitlements they can see. Both are often incomplete. Challenging the draft with your own evidence routinely reduces the final number.

Exhibit 2
Challenging the draft findings can cut the exposure substantiallyFrom draft audit finding to final settlement, $K, illustrative server-software audit$2,400KDraft findingat list price−$520KEntitlementsthe auditormissed−$310KDecommissionedserverscounted−$280KNon-productionuse rights−$390KVirtualizationrulesmisapplied−$340KNegotiateddiscount onremainder$560KFinalsettlementIllustrative. Each reduction was supported by evidence the organization could produce: proof of entitlement,decommissioning records and contract terms.

Before an audit: be ready

See audit readiness for a full checklist.

During an audit: manage it

01Appoint one coordinator

All communication goes through one person, in writing.

02Agree the scope in writing

Products, entities, environments and time period.

03Review data before sharing

Share what the contract requires, accurately, and log what was sent.

04Challenge findings

Errors in counting, product mapping and use rights are common.

05Separate findings from purchases

Agree the findings first, then discuss commercial resolution.

06Get advice

For large audits, specialist support often pays for itself.

If you have just received a letter, start with the first 10 steps to take.

The best time to prepare for an audit is the year before the letter arrives. The second best is the day it does.

After an audit: reduce future exposure

Use the findings to fix the process that created the gap, update your license positions and schedule regular internal reviews. Most audit findings trace back to a small number of causes: servers built without license checks, virtualization changes, acquisitions, and missing proof of entitlement.

How MI One helps

Frequently asked questions

Can we refuse an audit?

If your contract includes an audit clause, refusing is usually a breach. You can, however, negotiate scope and timing.

Is a vendor "SAM engagement" an audit?

Not formally, but treat it with similar care. Data shared in a review can lead to commercial pressure.

How long does an audit take?

Anything from a few weeks to many months, depending on the publisher, the scope and how quickly data can be produced. A ready license position shortens it considerably.

Sources

See where your software budget goes

Bring your five largest vendors to a 30-minute call. Our SAM experts will show you where the savings usually hide, and how fast MI One can surface them.

Book a callFollow us on LinkedIn

Keep reading

SAM fundamentalsWhat Is an Effective License Position (ELP) and How Do You Build One?8 min read →Audits and complianceAudit Readiness: Building a License Position Before the Vendor Asks9 min read →Audits and complianceReceived an Audit Letter? The First 10 Steps to Take9 min read →