Software licensing audits are a big challenge for IT departments. 65% of respondents to a 2012 Gartner survey reported that they had been audited by at least one software vendor in the past 12 months, a figure which has been on a steady upward trajectory for a number of years.
Often, companies being audited for software compliance will actually deal, at the front-line, with a 3rd party audit provider. One of the big names in this niche is KPMG, whose freely-downloadable November 2013 report, “Is unlicensed software hurting your bottom line?”, provides a very interesting window into the software compliance business.
The report details the results of a survey conducted between February and April 2013, with respondents made up “31 software companies representing more than 50 percent of the revenue in the software industry”.
Revenue is driving software audits
The survey results show, rather conclusively, a belief in the business value of tackling non-compliance:
- 52% of companies felt that their losses through unlicensed use of software amounted to more than 10% of their revenue.
- Almost 90% reported that their compliance program is a source of revenue. For about a tenth, it makes up more than 10% of their overall software revenue. For roughly half, it is at least 4%.
Compliance audits are increasingly seen as a sales process
- In more than half of responding organisations, the software compliance function is part of Sales. This is reported as being up from 1 in 3, in an equivalent 2007 survey.
- In 2007, 47% of compliance teams were part of the Finance department. This figure has plummeted to just 13%.
This shift is not universal, and some companies seem committed to a non-Sales model for their compliance team. A compliance team member from one major software vendor talked to me about the benefit of this to his role: He can tell the customer he is completely independent of the sales function, and is paid no commission or bonus based on audit findings. Many other vendors, however, structure audits as a fully-commissioned role. As the survey points out:
- Only 20% of companies pay no commission to any individuals involved in the compliance process.
- In 59% of cases, the commission structure used is the same as the normal sales commission program.
There is further indication of the role of sales in the audit process, in the answers to the question on “settlement philosophy”. More than half of the respondents reported a preference for using audit findings as leverage in a “forward-looking sales approach”, rather than wanting to seek an immediate financial settlement.
Almost half of vendors select audit targets based on profiling
The biggest single selection reason for a compliance review was nomination by the sales account team (53%), with previous account history in close second place (50%).
Interestingly, however, 47% reported selecting customers for review based on “Data analytics suggesting higher risk of non-compliance”, with 7% stating that random selection is used. It seems that audits are still a strong likelihood regardless of an organisation’s actual compliance management.
Auditors prefer their own proprietary tools to customers’ SAM tools
There seems to be a distinct lack of regard for Software Asset Management tools. 42% of respondents seek to use their own discovery scripts in the audit process. Only 26% of the vendors stated that they use customers’ SAM tools, and remarkably this is down from 29% in 2007, when one might expect few SAM tools would have been found on customer sites anyway.
This echoes the experience of a number of customers with whom I have previously spoken, and it can be a real source of annoyance. How, some argue, is it fair that license models are so complex that it takes a secretive proprietary script, only available to the auditor, to perform a definitive deployment count?
Other observations
- Software tagging has not been widely adopted: Less than half of respondents do it, or have plans to do so.
- SaaS reduces the role of the software auditor. Only 15% reported any compliance issues, and more than half don’t even look for them.
- Few companies seek to build protection against overdeployment into their software. From conversations I have had, most seem to want to encourage wide distribution. Some desktop software was deliberately released in a manner that has encouraged wide, almost viral distribution. In at least one case, an acquisition by a larger company has been the trigger for a significant and aggressive audit program, targeting almost every large company on the assumption that the software is likely to be found there.
Conclusions?
It is very clear from the survey results that many large software vendors have established their compliance program as a significant revenue generator, and with a significant shift of these functions into the sales department, we can probably assume that there is a broad intent to maintain or even grow this role.
Whether this is even compatible with a more collaborate model of software compliance management is highly questionable: the business case for the status quo seems very sound, from the vendor’s point of view. With so many vendors only trusting the discovery scripts used by their auditors, the situation for customers is nearly impossible: how can they verify compliance if the only counting tool is in the hand of the vendor?
The light at the end of the tunnel for many customer may be SaaS: SaaS software tends to be more self-policing, and consumption models are often simpler. However, it brings its own challenges: zombie accounts, decentralised purchasing, and a new set of inconsistent consumption models. Meanwhile, hosted software does not go away.
Evolving ITSM 