Category: Audit Series

Does it ever feel like you’re fighting an uphill battle when it comes to your Microsoft software audits? You try your best to keep up with the auditor’s demands, collecting data and checking licensing details, but it all amounts to you owing far more than you feel could be possible? This is a very common situation, as we have helped clients who despite their best efforts to work with the auditors, have found themselves being forced to pay out millions more than they need to. At MetrixData 360, we have Microsoft’s software audits down to a science and we have seen patterns in the common mistakes people make before we are called onto the job. So here are the most common mistakes companies make in a Microsoft software audit and what you can do to avoid them.

Common Microsoft Audit Mistake #1: You’re Trusting Microsoft’s Audit Team Too Much

Microsoft will often bring on a third-party auditing firm like Deloitte and KPMG, and it’s tempting to fall into the mindset that they are the professionals in this situation — that they know best. We have often seen companies that go along with the auditor’s every demand and who take the software auditor’s findings as though they were set in stone.

Solution: Remember Who the Software Auditors are working for

Microsoft hired these auditors and Microsoft may even pay them based on how large a compliance gap they can find. It’s not to say that the auditors won’t do their job properly, but they have no incentive to investigate grey areas or ambiguous findings when they could instead just assume that the most expensive case is the scenario and call it a day. These expensive assumptions can greatly over-inflate your compliance gap while lining the pockets of Microsoft and their team.

When the software auditor’s hand over your Estimated License Position at the end of their investigation, the important thing to remember is that it is, in fact, an estimate. It’s not a receipt like the kind you would get in the restaurant, think of it instead as the beginning point of your negotiations and it is important to challenge any findings you don’t agree with.

Common Microsoft Audit Mistake #2: You’re Handing Over Everything Without Question

Microsoft’s auditors can be an intimidating bunch and having Microsoft ticked off at you is not a good feeling. So, there can be a knee-jerk reaction to play nice, do damage control by complying with demands, and exposing your entire software environment to the auditors as a sign of good faith, to show you have nothing to hide. However, we have often seen how this can backfire on many well-meaning companies since not everything that the software auditors will ask for will be relevant to the software audit. One client that we helped through a software audit was asked for information that wasn’t relevant to the audit and would be used in a later case against them.

Solution: Ask Questions

You can and should ask for justification on any data requests, especially if you think they are outside of the scope of the audit. We did that for a client, and it resulted in the audit being brought to a standstill which lasted months, with the auditors going silent. Our client received valuable time to prepare their own defense and carry on with their business. There are some requests that you can push back against and some which you will have to comply with. Knowing which request is which will greatly benefit you during a software audit against Microsoft.

Common Microsoft Audit Mistake #3: You Have no Single Point of Contact

Who are the software auditors talking to? Where do they go when they want something? And who is tailoring a response for them? This is often a simple question that for many companies goes unanswered during their Microsoft audit to produce devastating results. If just anyone is talking to the software vendor, including people who may not have the best information to answer the question completely, then the end result is that you do not know what Microsoft knows, where the software vendor is getting these assumptions from and, therefore, having no way to correct or challenge any misplaced information.

It also makes it quite difficult to structure a proper defense for yourself if you do not know what the vendor could possibly use in their own argument, making you essentially blind during the software negotiation process at the end of the software audit.

Solution: Establish a Single Point of Contact as Soon as You Received Your Audit Notification

Establishing a single person or team who will be in charge of interacting with the software auditors should be one of the first things you do when you receive your software audit notification. This Single Point of Contact (SPC) will review all data before it is passed onto the software auditor in order to maintain a clear understanding of your company’s stance with the vendor. The SPC will also review any data requests that the software auditor provides in order to ensure it is relevant to the scope of the audit.

In the event that an employee is interviewed by the software auditor, the SPC will prep the employee to ensure that the employee is ready to address the questions with a full understanding of the answer.

Common Microsoft Audit Mistake #4: You Trust your Microsoft Sale’s Rep Too Much

Microsoft sales reps are often friendly in nature and may come across as though they have your company’s best interest at heart. Due to this seemingly friendly nature, many companies will trust their sales reps to understand their business needs and their compliance requirements. This trust has resulted in companies wasting time and energy purchasing licenses they don’t need while remaining exposed to compliance risks during their next software audit.

Solution: Know What You Want

Don’t let the sales rep tell you what to do because it is important to remember that at the end of the day, Microsoft’s sales reps have the main goal of selling you more licenses regardless of whether it is of any advantage to you. This is why it is so important that you have a good understanding of what you want and how many licenses you need in order to remain compliant and get your company to where you want to go from a software perspective. This type of visibility into your software environment is typically only achieved through software asset management if your software environment is large enough.

Common Microsoft Audit Mistake #5: You have no SAM Tool or Software Asset Management Strategy in Place

Software asset management is perhaps one of the best defenses you can deploy when it comes to protecting yourself against the heavy fines of a software audit. However, very few companies have a software asset management strategy in place and only consider employing SAM in their software environment after they have received their audit notice. To ensure the strongest defense, however, SAM should be a year-round endeavor, to ensure you don’t fall back into the SAM bad habits that opened you up to compliance risks in the first place.

Solution: Have a Strong SAM Strategy Long Before

Implementing a strong software asset management strategy not just during the event of a software audit but for all year round comes with many benefits including but not limited to:

MetrixData 360: Microsoft Audit Specialists, Here to Help

At MetrixData 360, we have gone up against Microsoft on multiple occasions for close to a decade now. We have been tenacious in our approach to defend our client’s interest and our success can be found in the millions of dollars we have saved our clients over the years. We take a data-first approach, where we build a defense against the onslaught of auditors that allows us to beat Microsoft at their own game. If you’d like to learn more about our tireless defense of your business’s interests, you can contact us today and we can get started helping you through your next Microsoft Audit because MetrixData 360 has your back!

Book a Meeting with Your Audit Defense Today

At the beginning of a software audit, the software vendors will introduce you to your auditors. These people may be from an external auditing firm, like Deloitte or KMPG, or be part of an internal auditing team from the software vendor themselves. It might be tempting to assume that these auditors are the experts and will provide all the assistance you need to get through your software audit smoothly.

However, at MetrixData 360, we know firsthand how very little these auditing teams are invested in looking after your company’s interests or even represent your case accurately. We firmly believe that you will need a software audit defense team of your own to verify the auditor’s findings, and working with an external SAM team is an excellent way to create a strong defense.

But what exactly is the difference between blindly trusting the software auditors and getting your own team to defend you?

Software Auditors are hired by the Software Vendor

The first and most important thing to note when you are working with a software auditor vs. a SAM expert is that the software auditor has been hired by the software vendor and that will greatly affect their motivation during the audit. They may be paid based on how large a compliance gap they can find, and this will create a bias in their efforts.

If there are any grey areas or missing data, they will assume the most expensive scenario is the reality, and it is unlikely they will dig any deeper than that. Why would they? Further research will either present no effect or possibly negatively affect their final payment. 

SAM Experts are Neutral Third Parties

Software Asset Management Professionals, on the other hand, are people that your company hires, so they are here to represent your interests. Their goal is to keep things as legal, accurate, and cost-effective as possible. Where there are grey areas, they will seek out the answers — whatever those answers may be. At MetrixData 360, we always pride ourselves in defending the best interests of our clients and we usually charge based on a flat rate or on a contingency basis, and our approach has often led to whittling down seemingly huge compliance gaps to much more manageable levels (or even nothing!).

Software Auditors will Ask for Data Outside the Scope of Your Audit

We have often run up against software auditors who collect data that has nothing to do with the audit they have been hired to investigate. The reasons for this may vary: perhaps they aren’t finding the results they need within the scope of the audit and they are trying to spread their investigations elsewhere, or perhaps the software vendor is looking for data with a competitive edge that has everything to do with your next true-up and nothing to do with the audit you’re in right now. Blindly handing over data simply because it is what the software auditor asked for can easily put you at a disadvantage as you help the software auditors build a case against you!

SAM Experts Know What Data the Auditors Need and Which They Don’t

We recently helped our client drive their Oracle audit to a stalemate (a valuable thing, as it gave our client the time they needed to thoroughly prepare a defense for the audit that followed) simply because the software auditors asked for a piece of data, and we asked them to provide proof for how that data was relevant to the audit (hint: it wasn’t, and it would have been used against our client later).

SAM experts know how audits work. In fact, at MetrixData 360 we have it down to a science, and they know when a piece of data needs to be handed over and when the software auditors have taken too much liberty poking around your software environment. They can defend your best interests by keeping you from handing over documents the auditors don’t need to see.

Software Auditors will not Accept Data from Your SAM Tools

It doesn’t matter if your SAM tool is high powered or accurate, it might even be approved by the software vendor who is auditing you, but software auditors will usually refuse to accept data unless it is drawn by their own tools. There are a few reasons for this, but it is mainly because the auditors want consistent data that is arranged in a certain way to save themselves time.

However, this is a terrible situation for you, because you do not know what their SAM tool will pick up. It may not take into consideration the unique licensing metrics and complexities of your software environment, and it may come up with a wildly inaccurate number that will leave you blindsided and scrambling to disprove.

Your software architecture is delicate. What will happen if the auditor’s tool needs to be installed into your software environment and the tool damages it? Your first job during the software audit is to defend and prove the accuracy of your own tool.

SAM Experts Work with Your Tools and Come with Their Own

At MetrixData 360, we work with what you give us. If you have your own SAM tools, we can work with the data it provides us and supplements any missing data with our own tools. If you don’t have your own tools, we can use ours exclusively, so there’s nothing to worry about.

With a SAM expert on the team, you shouldn’t have to resort to throwing all the hard-earned data that you’ve gathered with your SAM tool in the trash just because the software auditors aren’t used to working with the format your data is presented in. We often advise advocating for the validity of your own SAM tool by asking your software auditors to use data samples to determine accuracy or agree to use the software auditor’s tools only to supplement for missing data.

Get Data Experts that Represent Your Interests!

Software audits are not everyone’s cup of tea, and the software auditors that attend them often do not make the matter easier. Between unreasonable requests, ELPs that claim you owe thousands more than you actually do, and aggressively short turnaround times, software auditors can make the challenge of defending yourself that much harder if you are left to rely only on their services.

It’s important that you have someone in your corner backing you, someone who knows the intricate and unique inner workings of your software environment and knows how to defend your interests so that you are paying only what you need. MetrixData 360 can give you that kind of support. We have helped many companies fight their way out of seemingly hopeless situations and saved them millions of dollars in the process. If you’d like to learn more about how MetrixData 360 can help you during your next software audit, you can check out our Audit Defense Service Page.