Five (5) steps to achieve a Successful Software Audit.

Size: px

Start display at page:

Download "Five (5) steps to achieve a Successful Software Audit."

Maud Adams
8 years ago
Views:

1 Five (5) steps to achieve a Successful Software Audit.

2 Market indicators and analysts confirm that Software Compliance Audits are steadily increasing across the globe. Gartner predicts that software audits are on the rise 2

3 Specifically, 61% of Gartner s survey recipients have been audited by at least one software vendor in the past year the highest percentage of any comparable survey and up from 54% in Forrester noted in their 2nd March 2011 report that there are various motivators for this citing increased technological development (virtualisation); market consolidations via acquisitions; complicated licensing metrics; the bundling of license and maintenance agreements and evolving licensing and entitlement practises as contributory factors to these increased activities. Gartner noted the lack of investment in robust IT Asset Management Programs as a key factor. What is a Successful Software Audit? A successful software audit consists of the following key elements: Understanding what licenses the organisation ARE using and how this reconciles back to what licenses the organisation SHOULD be using; Internal Processes and Procedures that clearly demonstrate the organisations control and governance within the environment; The audit should be a Business as Usual activity and the outcome should present no surprises to the organisation; The audit itself should be a fact finding engagement that is nonadversarial between the vendor and the organisation; and In the event that any True Up s are identified, this is achieved in the Spirit of Partnership and appropriate enablement steps are taken to incorporate into the governance process moving forward. 1

complicated licensing metrics; the bundling of license and maintenance agreements and evolving licensing and entitlement practises as contributory factors to these increased activities.

4 What are the Five (5) steps you can implement to achieve a Successful Software Audit? There are five (5) key steps to implement within your organisation to assist in ensuring you have a Successful Software Audit. These five steps are all underpinned by an effective Software License Management Program: 5 Key Steps to Achieve Success Assign Ownership Partnership What do you have Software License Management Assign Ownership Project Management Executive Sponsorship Appropriate & Correct Resource Allocation Managing the Approach Test the Status Quo How are you using it Test the Status Quo Regularly test the landscape Perform internal sampling Confirm Accuracy of Discovery Tools & Processes Record changes Understand What do you Have Formal software compliance policies Contractual Management System Management Overview of Footprint License = Reflection of value Partnership Not an Us vs. Them Situation Reconcile Needs to Purchases Leverage Investment Predictability in Spend Understand your Deployment Automated Software Inventory Management Control- based metrics & Usage policies Licensing Education Adherence to contractual T s & C s Vendor Business Practises 2

These five steps are all underpinned by an effective Software License Management Program: 5 Key Steps to Achieve Success Assign Ownership Partnership What do you have Software License Management

5 These 5 key areas are all essential elements in achieving a solid Software License Management Program. 1. Assign Ownership Effective Project Management of any engagement ensures that the correct level of Executive Sponsorship is involved. As many technical resources required to support such an engagement have other jobs, It allows for the Appropriate & Correct Resource Allocation while ensuring that the approach adopted is effectively managed. 2. Understand what you have A License is a Reflection of value and needs to be recorded and managed as such. Formal software compliance policies at the time of purchase can and do change in order to keep up with the technological advances of the program functionality. Ensuring a consistent and up to date Contractual Management System enables an organisation to have the integrated reporting functionality allowing for the effective Management and understanding of their Software licensing Footprint and associated terms and conditions. 3. Understand your Deployment Control- based metrics & Usage policies need to be implemented to ensure that organisations employee base is aware of what can and cannot be installed on the company assets issued to them. The installation of an Automated Software Inventory Management System is required to ensure that the actual deployment taking place within the IT environment reconciles back to the defined usage policies. Licensing Education and Enablement is paramount in ensuring that the deployment practises adhere to the contracted Terms and Conditions and Vendor published Business Practises governing specific distinctions pertaining to topics like Multiplexing and Disaster Recovery sites. 4. Test the Status Quo Once you understand what you have and how you should be using it, Regularly test the landscape. Your Performing internal sampling rapidly enhances your ability to Confirm the Accuracy of internally deployed Discovery Tools & Processes. As the IT environment is dynamic, Record changes measured in order to map trends and demonstrate the steps being taken to implement good governance standards and procedures. 5. Partnership At the end of the day, your organisation decided on a specific technological platform that aligned with your business requirements. The business relationship is that of a partnership between the organisation and the vendor and this does not come to a rapid halt the day the organisation receives the audit notification. This partnership needs to continue throughout the engagement: it is Not an Us vs. Them Situation and both parties need to continue working together in order to Reconcile the Needs to Purchases while Leveraging the Investment made. All organisations, vendors and end users alike, want Predictability in Spend and this can be achieved when the business relationship is that of partnership: the two go hand in hand. 3

As many technical resources required to support such an engagement have other jobs, It allows for the Appropriate & Correct Resource Allocation while ensuring that the approach adopted is effectively

6 Software License Management Programs There are two kinds of License Management Programs, the first reactive and the second proactive: 1. Software License Compliance This is seen as a reactive approach as it focuses primarily on the Right of Verification/ Audit and the organisations Contractual Obligations. Tactically, effort is made in Implementing and managing a controlled environment, Understanding the Licensing Entitlement and Organisation Compliance Awareness. References: [1] George Lawrie. 9 July Defuse Software License Time Bombs With Software Asset Management. Available: [2 J.Disbrow A.Bona S.Buchanan F.DeSalvo F.O Brien J.Rosenberger 2 March Survey Analysis: Survey Shows Another Increase in Software Vendor Audits; IT Asset Managers Should Prepare Now. Available: ID: G Software Asset Management Conversely, Software Asset Management (SAM) is seen to be more Proactive in its nature as it focuses on the Sustainability & Integrated Corporate Governance for Continuous improvement. Constant effort is placed on Leveraging the Licensing Investment through the Control & Protection of software Assets throughout life cycle and ensuring consistent Predictability in Spend. 4

Tactically, effort is made in Implementing and managing a controlled environment, Understanding the Licensing Entitlement and Organisation Compliance Awareness. References: [1] George Lawrie.

7 Denise Lee Associate Director Risk Advisory (National) Cell: Dave Kennedy Service Line Leader Risk Advisory (Johannesburg) Cell: Derek Schraader Director Risk Advisory (Cape Town) Cell: Craig Turnbull Director Risk Advisory (Johannesburg) Cell: Feel free to reach out to your local Deloitte office. Deidre Botha Director Risk Advisory (Pretoria) Cell: Reyaaz Jacobs Director Risk Advisory (Durban) Cell: Jens Kock Director Risk Advisory (Namibia) Deloitte Namibia Cell:

za Derek Schraader Director Risk Advisory (Cape Town) Cell: +2779 499 9046 Email: dschraader@deloitte.co.

8 Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Deloitte is the brand under which tens of thousands of dedicated professionals in independent firms throughout the world collaborate to provide audit, consulting, financial advisory, risk management, and tax services to selected clients. These firms are members of Deloitte Touche Tohmatsu Limited (DTTL), a UK private company limited by guarantee. Each member firm provides services in a particular geographic area and is subject to the laws and professional regulations of the particular country or countries in which it operates. DTTL does not itself provide services to clients. DTTL and each DTTL member firm are separate and distinct legal entities, which cannot obligate each other. DTTL and each DTTL member firm are liable only for their own acts or omissions and not those of each other. Each DTTL member firm is structured differently in accordance with national laws, regulations, customary practice, and other factors, and may secure the provision of professional services in its territory through subsidiaries, affiliates, and/or other entities Deloitte & Touche. All rights reserved. Member of Deloitte Touche Tohmatsu Limited Designed and produced by Creative Solutions at Deloitte, Johannesburg. (804644/mar)

It s all about the results Moving from process to outcome management for strategic project execution with the Results Management Office

It s all about the results Moving from process to outcome management for strategic project execution with the Results Management Office Why do 90% of organisations fail to effectively execute their strategies?