The Publisher Audit Letter Arrives First
Northwind Logistics receives a software publisher's audit notice with a 30-day response window. The SAM team has never completed a full reconciliation. Discovery data shows 1,850 installations of a design suite against 1,200 purchased perpetual licenses, but 300 of those installations sit on a shared engineering lab image that is re-imaged nightly and was captured mid-refresh. The publisher's own tool reports 1,610 active devices. Your CFO wants to settle quickly to avoid legal fees; your IT director insists the lab image inflates the count. Two affiliates acquired last year run the same product under separate contracts, and nobody has confirmed whether the group-wide agreement covers them.
1. What should the SAM lead do in the first two weeks, and how should the conflicting counts be handled in the response to the publisher?
Read the worked answer
The first two weeks are about controlling the record, not conceding numbers. Sequence:
- Acknowledge in writing and freeze scope. Confirm receipt, request the publisher's methodology and the raw device list behind its 1,610 figure, and agree a data-cut date. Never let the audit period drift.
- Reconcile the three counts to one defensible number. The 1,850 discovery figure and 1,610 publisher figure differ by 240; the lab image explains part of the gap. De-duplicate by device and by user, exclude transient lab instances only where you can evidence the re-imaging cycle (build logs, image timestamps), and document every exclusion with its evidence.
- Segment by entitlement. Map installations to the 1,200 perpetual licenses, then separate the affiliate population. Affiliate usage is a contractual question before it is a counting question.
- Pull the group agreement and affiliate contracts. If the group agreement's definition of 'Affiliate' and its scope clause cover the acquired entities, those devices may already be licensed; if not, they are a true exposure.
- Do not settle in week one. A fast settlement before the count is defensible usually overpays. Give the CFO a bounded exposure range instead of a single scary number.
The judgement being tested: the largest number is not the liability. The liability is unlicensed deployment you cannot disprove, and lab/transient instances are exactly where that line is drawn.
2. The reconciliation shows roughly 250 genuinely unlicensed devices after exclusions. What is the right remediation posture, and what should be documented for the future?
Read the worked answer
Treat 250 as a compliance gap to be closed on a defined date, with the evidence trail built as you go.
Remediation:
- Buy or true-up for the 250 where the software is genuinely needed; de-install where it is not. Splitting the 250 between purchase and removal is usually cheaper than buying all of them and is defensible if removals are verified.
- Negotiate the true-up price against the group agreement rather than list price, and ask for the audit to be closed with a release for the audited period.
- Get written confirmation of the final reconciled position so the same gap is not re-litigated next year.
Documentation:
- A reconciliation workbook showing source data, de-duplication rules, exclusion criteria and approver for each adjustment.
- The licence-to-installation mapping, versioned and dated.
- A decision record on affiliate coverage and who owns it.
Prevention:
- Add the design suite to the recurring reconciliation cycle with a named owner.
- Fix the lab imaging process so transient installs are excluded by policy, not by manual argument at audit time.
- Keep an evidence pack (entitlement documents, purchase orders, deployment exports) ready so the next notice starts from a defensible baseline rather than a scramble.