The First 72 Hours: what to do when a software audit letter lands on your desk
The First 72 Hours: what to do when a software audit letter lands on your desk
That crucial first period can be the difference between a reasonably smooth experience, or a significantly costly one.
Published on 11th August 2026
The email arrives on a Tuesday afternoon. It is polite. It is addressed to someone in procurement or IT who has never seen one before. It references a section number in an agreement signed years ago by people who no longer work at the company. It asks for a call to “discuss your licensing position” and requests that you run an attached script and return the output within thirty days.
There is no dollar figure in it. That comes later — and by then, the number will have been built almost entirely out of information your own team handed over in the first week.
This is the central and counterintuitive fact about software license audits: the most consequential decisions are made before anyone knows what is at stake. By the time a seven- or eight-figure demand arrives, the evidentiary record supporting it is already closed, and your company built most of it.
The audit demand is not calculated from what you deployed. It is calculated from what you reported, measured the way the publisher’s tools measure it.
You are not being singled out
Clients often assume an audit letter means the publisher suspects something. Usually it does not. Audits are a revenue channel, run on a schedule, and the volume is substantial.
Flexera’s 2026 State of ITAM Report, drawn from a survey of ITAM professionals conducted in early 2026, found that nearly half of organisations — 48 percent — received a software audit in the prior twelve months. Microsoft was the most frequently reported auditor at 64 percent of those audited, with Oracle close behind at 50 percent. Oracle’s reported audit activity jumped roughly fourteen percentage points year over year. Adobe and VMware activity also rose.
The cost side is where it stops being a compliance annoyance and becomes a balance-sheet event. Forty-four percent of organisations reported spending more than $1 million on software audits over a three-year period. In earlier Flexera data, the share of companies reporting audit costs above $10 million nearly doubled year over year, from 7 percent to 12 percent.
Two conclusions follow. First, receiving a letter is not evidence that you did anything wrong. Second, the process that follows is expensive enough that it deserves the same seriousness as any other bet-the-budget dispute — from hour one.
Hours 0 to 4: contain the response
The single most damaging thing that happens in a software audit usually happens in the first afternoon, and it is almost always well-intentioned.
A systems administrator receives the letter, wants to be helpful and cooperative, and replies directly to the auditor. In doing so, he or she confirms deployment figures from memory, describes the virtualisation architecture, explains that a subsidiary has been using the software too, or apologies for something. None of it is verified. All of it is admissible. All of it is now the publisher’s baseline.
What to do instead:
- Acknowledge receipt and nothing else. A one-line email confirming the letter was received, stating that the company is reviewing it and will respond through a designated point of contact, is sufficient and appropriate.
- Designate a single channel immediately. One named person routes all communications with the publisher and the auditor. Everyone else in the organisation is instructed, in writing, to forward rather than respond.
- Engage counsel before substantive analysis begins. This is not merely about advocacy. Internal compliance analyses generated after an audit notice — spreadsheets, gap assessments, candid emails about whether the company is over-deployed — are discoverable unless they were created under privilege. Involving counsel at the outset is what makes it possible to assess your own exposure honestly without handing the publisher its case.
- Do not run the vendor's scripts yet. Measurement tools embed the publisher's licensing interpretations. Running one and returning the output is not neutral fact-gathering; it is agreeing to a methodology before you have read the clause that governs it.
Hours 4 to 24: preserve everything, change nothing
Two instincts surface once the seriousness registers, and both are dangerous.
The first is to clean up — uninstall software that may be over-deployed, decommission instances, tidy the environment before anyone looks. Do not. Depending on the contract and the circumstances, this can convert a commercial dispute into an allegation of spoliation or bad faith, and publishers have begun litigating precisely this point. In the Broadcom litigation now pending in the Northern District of California, the publisher’s position is essentially that a customer cannot extinguish audit obligations by removing the software mid-review. Whatever the outcome, you do not want to be the test case.
The second is to delete — to purge old email threads about license planning or the failed true-up conversation from two years ago. That is worse.
What to do instead:
- Issue a litigation hold. Immediately, in writing, covering procurement records, license entitlement documentation, deployment logs, correspondence with the publisher and its resellers, and internal discussions about licensing.
- Freeze the environment as it stands. Document its current state. Changes that were already planned and documented before the audit notice can generally proceed; changes prompted by the notice should not, absent advice.
- Gather your entitlements before you gather your deployments. Master agreement, every order form, every amendment, every assignment or novation from an acquisition, every reseller paper trail. Companies routinely under-count their own entitlements because the documentation is scattered across three departments and two acquisitions.
Hours 24 to 48: read the contract, not the letter
The audit letter describes what the publisher would like to happen. The contract describes what the publisher is entitled to make happen. In our experience these two documents diverge more often than they align, and the gap is where the leverage is.
Working through the actual audit clause, ask:
- What is the permitted scope? Audit rights are frequently limited to specified products, entities, or territories. Letters are frequently not.
- What notice is required, and was it given? Many clauses require thirty or more days' written notice, delivered a particular way, to a particular person.
- How often may the publisher audit? Once per year and not more than once in any twelve-month period is a common formulation. Sequential audits of different product families can breach it.
- Who is permitted to conduct it? A clause allowing an audit by the publisher “or its designee” is not the same as one permitting an independent accounting firm, and the identity of the auditor materially affects what you should agree to disclose.
- How long do record-retention obligations run — and do they survive termination? Retention periods measured from the expiration of support and subscription services are common and are often the provision customers overlook entirely.
- What triggers cost-shifting? Many clauses require the customer to bear audit costs only if the audit reveals underpayment above a stated threshold — often 5 or 10 percent. That threshold is a negotiating instrument, not a formality.
- What confidentiality protections apply to what you hand over, and is a separate audit NDA warranted before any data moves?
Hours 48 to 72: build your own number first
An audit is a valuation dispute conducted under the appearance of a factual inquiry. Whoever establishes the measurement framework first usually wins the argument that follows.
Before responding substantively, and under privilege, develop an independent internal picture: what is actually deployed, what entitlements actually exist, and what the defensible license position looks like under a reasonable reading of the contract. This accomplishes three things. It tells your leadership the realistic range of exposure rather than the publisher’s opening number. It surfaces the contractual ambiguities worth fighting over. And it means that when the publisher’s figure arrives, you are comparing two analyses rather than reacting to one.
Where the technical measurement is genuinely complex — virtualisation, containerisation, indirect or digital access, disaster-recovery environments, development and test instances — a licensing specialist working at counsel’s direction is usually worth the cost several times over. The distinction matters: retained through counsel, that work carries a privilege argument. Retained directly, it generally does not.
The five mistakes that cost the most money
1. Treating it as an IT problem: audits are contract disputes that happen to involve technology. Routing one to the infrastructure team because it mentions servers is how companies end up bound by admissions no lawyer ever reviewed.
2. Volunteering scope: answering questions that were not asked, disclosing affiliates the publisher had not identified, and describing environments outside the audited product family all expand the audit at your own expense.
3. Accepting the publisher’s maths: deployment counts under contested interpretations — core-counting in virtualised environments, user definitions that sweep in service accounts, indirect access theories — are legal conclusions dressed as measurements. They can be contested. They frequently should be.
4. Negotiating on the publisher’s clock: audit findings tend to arrive near a quarter or fiscal year end, accompanied by a deadline and a discount that expires. The urgency is manufactured, and the resolution offered is almost always a purchase rather than a settlement — the compliance gap is forgiven in exchange for a subscription commitment considerably larger than the gap.
5. Waiting to involve counsel until there is a demand: by then the record is fixed. Counsel engaged at the demand stage is negotiating over evidence the company created without advice. Counsel engaged at the letter stage is shaping what that evidence is.
What resolution actually looks like
Most audits do not end in litigation. They end in a negotiated commercial resolution, and the quality of that resolution depends almost entirely on the strength of the customer’s independent position and its credible willingness to litigate if pushed.
A well-defended audit typically produces some combination of a substantially reduced compliance figure, a release covering the audited period, an agreed and documented licensing interpretation going forward, amended audit provisions with tighter scope and notice requirements, and — where the publisher’s conduct warrants it — a negotiated standstill on further audits for a defined period. What it does not produce is a rushed subscription commitment signed three days before the publisher’s fiscal year closes.
Have you had an audit letter arrive on your desk recently?
How did you deal with it - calm and measured, or blind panic?
You don't have to go through it alone - whether it's your first, fifth or fiftieth time, we're always here to help.
Get in touchSource
Image Credit
Nuttawan Jayawan via Vecteezy