SOFTWARE VENDOR AUDIT SURVIVAL GUIDE

Transcription

1 1 SOFTWARE VENDOR AUDIT SURVIVAL GUIDE UK + 44(0) USA marketing@livingstone-tech.com

2 2 CONTENTS We have been helping large scale organisations for over 15 years and utilising our extensive knowledge this guide is designed to help organisations prepare for and survive any software audit. 03 Introduction 04 The Change 05 What Does This Really Mean? 06 How Should An Audit Be Run? 07 Key Conversation Elements 09 Vendor Ready 10 Summary

3 3 INTRODUCTION There is a lot written about vendor audits. Understandably as it has risen fast on the CIO and CFO agenda over the last few years. Most of what is written is very valuable and I don t disagree with any of it get your processes in order, get your data in order and invest in controlling your software lifecycle. If everyone does this then essentially you should be able to eradicate risk and basically create an environment where an audit becomes pointless as you can self-state at any time and are compliant. Honourable and lofty intensions only, the real world works a little bit differently. Dan Ward, Consultant Partner Livingstone The time and money needed to get to that position is large and, let s face it, keeping everything running for the business remains their priority. So whilst a lot of companies are investing heavily in expanding their capabilities, with some success, the vendors keep coming with their letters. This article is taking a slightly different stance. I think there has been a subtle change in the vendor approach which in turn, has an influence on how the client should deal with these situations. Dan Ward, Consultant Partner

4 4 THE CHANGE When I first started working in the audit arena around 10 years ago the audits were just that an audit. They were generally pretty forensic and took a very long time. The vendor or appointed independent (and yes, I do use that word with a touch of scepticism!) laid out the plan and the approach and the client worked through it. Often this resulted in pretty large financial returns for the vendor, but what was critical was the number that could be run in parallel was very low. Thus, the vendors came upon the biggest issue in the Software Asset Management world how do you scale out operations when everything seems so limited by expert resource? Given the returns for vendors it was a nobrainer for them to build out their audit arms and specifically try to evolve tooling to reduce the burden on consultants and increase the number of reviews a consultant could handle at a given time. After all, while you might get a 1 million yield on a year-long forensic audit, if the same consultant can run 10 in 6 months with a lower yield of 500,000 per client, then the maths clearly justifies the change in stance. My take on this is based on the evidence we are seeing in our managed service base but the increase in volume of audits, particularly by the meta-vendors, is borne out by industry commentators such as Doug Henschen of Information Week In its 2012 Key Trends in Software Pricing and Licensing survey, analyst firm IDC and Flexera Software found that 64 percent of enterprises reported undergoing an audit or license review over the past 18 to 24 months. More than one-third of respondents (36 percent) reported being audited at least twice in that time period, while 10 percent reported more than three audits. Whilst they don t provide comparative numbers from previous years, I am willing to stake a fair amount it is on a pretty steep increase. So the change is simple; the vendors want to and are doing more audits, and what is more the audit teams (whatever the remuneration of the people that work in them) have set revenue targets for each quarter that they are working to. Audit/review/licence compliance or whatever the team is called is basically now just a sales function. Indeed, in some of the meta-vendors, it sits under the global sales lead!

5 5 WHAT DOES THIS REALLY MEAN? The complexity of software licensing requires specialist interpretation... Well in short this means the quality of the work has declined. Anyone who works in this industry will tell you that when you start to rely more on technology and introduce more, (cheaper) hands and eyes into the mix you will get a decline in quality. We are dealing with massive and complex data sets - even the most experienced campaigner will make some mistakes. We haven t worked on an audit in the last 2 years where the vendor or their appointed auditor hasn t made multiple mistakes. We now have a set list of common mistakes that we find with each major vendor audit. When we get the vendor submission back, we simply go through the checklist on behalf of our clients and tick off the issues naturally this has a dramatic affect on the whole engagement, which I will go into later in the article.

6 6 HOW SHOULD AN AUDIT BE RUN? What s the impact on the client? The impact really depends on the client s capability. If the client understands their data then this change is great news because you know 2 critical things: 1 2 The vendor WILL make mistakes with their data and interpretation of it. The vendor wants this done quickly so they can post a revenue number against the next financial milestone. This means that in reality what we are talking about here is a commercial conversation not a legal charge as can be insinuated. Sure, the data is important, but the reality is the data is a frame and a guide for the commercial conversation and like anything, when you control the data and the timeline, you control the situation and the outcome. What we are really playing is hunt the mistakes it changes everything. So how do we do that? We can t find the errors if we don t know our data and we can t know our data unless we spend time on it. Therefore, we need that time which means we must control the timeline before anything goes to the vendor it needs to be fully understood what that data actually means, how the vendor will use it and when they post it back you, how it should look. The best way to do this is to have parallel processes. As soon as the audit letter is received hopefully the client already has some protocols in place to gather the required data, review the up to date or relevant vendor licensing agreements and start to build out their license position. At the same time a set process is kicked off with the vendor and appointed 3rd party where the client sets the timetable.

7 7 KEY CONVERSATION ELEMENTS 1 Read your contract: Do a full review of the audit clauses which products do they cover, which entities are the agreements with? There are wide variations on clauses some are robust and others not as ubiquitous as the vendor may have you believe. Make sure that what you are being asked to comply with under contract is correct and accurate for all or any of your group or subsidiaries. 4 If the vendor or the auditor wants your data then you should look at performing the sorts of IT checks / security questionnaires you would with any other 3rd party that would have access to your data. Where will the data be held? Who will work on it? It was only last year that a meta-vendor was very publicly hacked after all. 2 A really interesting point is what actually is an audit as defined by the audit clause in your contract? I have never seen it properly defined and as the client you should not necessarily accept the vendor s view of what constitutes an audit. This is critical in deciding what data-sets you should provide is it critical for the objective to be met that they have the data they are asking for? I cannot think of a situation where a vendor needs raw tool or script outputs but they will certainly ask for it. 5 6 Full security and IT review of anything that the vendor wants you to run. You do this when you buy any software - it should be the same in this situation. Also have a think about who bears liability and to what level should anything go wrong. What represents a successful outcome for you as the client? There should be some positives that come out of this effort you are puttng in. Define them and if necessary, ensure the vendor commits to them. 3 Implement a robust overarching tripartite or separate NDAs vendors like to use the confidentiality clauses in the agreements the client has with them these are not robust enough when dealing with your sensitive, sometimes personal data.

8 8 MEANWHILE The team that is responsible for dealing with audit is appointed/agreed. Data points are established covering what you can get from your tools and the additional elements you need to understand based on the licensed products. This could include the following by way of example: 5 We often apply a rule of what a reasonable person would apply given a certain situation it is surprisingly successful. Is the interpretation logical? Based on what you have gathered pull together a license position the closest you can map to the way the vendor will do it will help. Tool extracts Virtualisation maps Hardware specifications Clustering Partitioning Screenshots Thin client groupings 6 Build out a timeline taking into account both work-streams that maps to closure at an important vendor timeline year end is great for obvious reasons. 3 4 Data is gathered. Full review of licensing terms pertaining to the audit this is really important as you need to find the grey areas. Essentially this is anything that isn t explicitly documented in the license. Once this is done it is a case of really understanding your data because then when you provide it to the vendor and they come back with their view you can see where they have done things that are wrong or indeed, as is sometimes the case, have missed things altogether. If it isn t explicitly documented for certain scenarios then the vendor will likely have an interpretation but it is just that an interpretation and it should make sense. If it doesn t it can be challenged.

9 9 VENDOR READY So now all the relevant documentation is in place, scope fully agreed and timeline agreed to provide the data to the vendor, send over the datasets and make the vendor or the auditor commit to a fixed timeline on raising additional queries and submitting their findings to you. Once you get the submissions back there is usually a fixed timeline in terms of settling. A useful point here is that you do not agree the findings until they are fully reviewed and understood. Often the vendor or auditor will just assume their view is accepted. Now it is time to find the mistakes and also the areas where an interpretive license rule has been applied. Trust me, look long enough and you will find it. I could provide a list of what to look for but that is part of our IP!! It should, hopefully. Remember, the commercial milestone for the vendor is looming and a number will likely have been forecasted for your estate. Therefore the conversation with the client goes something like this: We found some errors, we don t trust the data. We need this to be 100% accurate and we need faith in that, thus we have 2 options. Start again or we are prepared to spend XXX amount for XXX products by XXX date (make sure you have documented the outcomes you want i.e. make sure you are buying software that future-proofs your environment). So, you have found the issues. Now it is time to cut the auditor (if there is one) out of the equation and talk directly to the vendor. How you deal with this is really up to you but I am assuming you probably want to close the review and actually put a line in the sand from where you can accurately manage your estate for that vendor moving forward. This being the case the conversation is straight forward. You should have a view of what you think you need based on your data analysis and probably to an extent some of the auditor analysis (you will have made mistakes too by the way!) - does this feel fair?

10 10 SUMMARY Key Points: Line up to revenue target dates (quarter / year-end) Control the timeframes What do you really need to provide? Understand how your account rep is targeted What is the vendor forecasting for your engagement? Have your own set of requests Drown the vendor in data Pressurise timeframes for vendor analysis Don t accept the worst case Know your data Pick your battles on the grey areas

11 11 UK + 44(0) USA marketing@livingstone-tech.com INTELLIGENT SOFTWARE ASSET MANAGEMENT