Licences nobody counts: the vendor audit will come on its own

The finance director of a company with a hundred and twenty staff asks a simple question before the budget meeting: how many seats of the office suite do we pay for, and how many people use it? The IT person opens the vendor portal and reads out a number. Then somebody from the engineering team mentions the design software on the four workstations in the back office, and the question is repeated for that product, and then for the accounting package, the CAD viewer, the remote support tool, the database under the old ERP.

By the end of the afternoon there is a spreadsheet with gaps in every column. Some products are paid for by direct debit on a card nobody can name. Some were installed from a disc years ago and nobody knows what the licence allowed. One is counted per user by the vendor and per computer by the company, and the two numbers have never matched.

Nobody set out to lose track. Software arrived one purchase at a time, through three different budgets, and nothing was ever asked to be the list.

Why the vendor knows and you do not

Every vendor runs a counting operation. Their software reports back what is installed and who signs in, their licence desk reconciles that against what was invoiced, and when the two drift apart a letter goes out. It asks for a self-declaration, or for a review, or for the installation of a tool that will count on their behalf. The letter is polite and it is not optional under the contract you signed. The company receiving it usually learns, in that moment, that it has never counted anything.

Where the exposure accumulates

Per-user pricing in a company that cannot list its users. Flat per-user plans look simple until you have to say who a user is. The warehouse shared login, the contractor who left in the spring, the mailbox that only forwards: each is a seat, or is not, depending on the licence text.

Installed is not the same as used. The audit tool counts installations. The workstation that was re-imaged with the full suite because that was the image, the laptop in the cupboard, the virtual machine someone cloned: each one is a copy in the vendor’s count and nothing in yours.

The contract is in a drawer. What a licence allows is written in a document from the year of purchase: how many devices, whether a home installation is included, whether a virtual machine counts, whether usage in a second country is permitted. The people who negotiated it have moved on and the document has not been read since.

Bundles hide the real unit. A suite priced per user includes six products, of which the company uses two. That is not an exposure, it is waste, but it sits on the same invoice as the exposure and makes both harder to see.

Growth happens without a licensing event. Twenty new hires get set up by copying the previous person’s profile. Nobody buys twenty seats, because nobody was asked. The vendor’s count moves on the day of the hire; the company’s count moves at renewal, if then.

Nobody owns the list. Finance sees invoices, IT sees installations, department heads see tools they bought. None of them has the whole picture, and the audit letter is addressed to the board.

What a licence inventory contains

What is installed, counted by machine. Every workstation, server and virtual machine, with the software on it. Device management that you run can report this; a spreadsheet can hold it; either beats a guess.

Who uses it, counted by person. Sign-in records from your directory where the product uses it, and a named owner where it does not. The leaver process is where this list gets corrected, as we describe in Offboarding an employee: how many accounts stay open.

What the contract allows, in one sentence per product. Not the contract itself: the metric it counts by, the number you bought, the date it renews, and the clause that lets them audit you. Written by someone who read the document, and dated.

The gap, stated. Installed minus licensed, used minus paid for. The first number is the exposure; the second is the money being spent on nothing. Both belong in the same table because the second usually pays for closing the first.

A date to count again. Once a year at least, and before any renewal, because a renewal conversation with a vendor who knows your numbers better than you do is not a negotiation.

Where open source changes the question, and where it does not

Software under an open licence removes the per-seat count. There is no audit letter about how many people run a web browser, an office suite under a free licence, or a Linux server. For a company that has decided to own its IT, that is one of the real attractions, and it is why the audit we describe on the homepage is designed to price every licence, including the ones worth keeping.

It does not remove the inventory. An open-source product still has a version, a support arrangement if you have bought one, and a licence whose terms matter the moment you modify it or build on it. The accounting package the auditor expects, the design tool your clients send files for, and the ERP the warehouse runs on will mostly stay commercial, and they are precisely the products the letters are about. Open source shortens the list; it does not excuse you from keeping it. Pricing the whole estate, commercial and free, is part of knowing what leaving each piece would cost.

A test for this afternoon

Pick the one product your company would least like to receive a letter about. Write down three numbers on one line: how many copies are installed, how many people used it last month, how many seats the current contract covers. Allow yourself one hour and no help from the vendor.

If all three are on the line and come from something you can show, the inventory exists and only needs to be extended to the next product. If one of them is missing after an hour, that is the product to start with, because the vendor already has all three.