MANAGING THE SOFTWARE PUBLISHER AUDIT PROCESS

Transcription

1 MANAGING THE SOFTWARE PUBLISHER AUDIT PROCESS 3

2 THE USE OF BUSINESS SOFTWARE AND SPORTS ARE DEFINITELY QUITE SIMILAR; IF YOU WANT TO PLAY (USE THE SOFTWARE), YOU HAVE TO ACCEPT THE RULES. THIS INCLUDES THE RULES SET OUT IN THE LICENCE TERMS. IF THE RULES ARE NOT ACCEPTED AND CORPORATE SOFTWARE IS BEING USED ILLEGALLY, A REFEREE WILL HAVE TO IMPOSE FINES. BUSINESS SOFTWARE ALLIANCE (BSA) MICROSOFT WAS THE LEADING AUDITOR REPORTED ACROSS ALL ORGANISATIONAL SIZES. INTERNATIONAL DATA CORPORATION (IDC) 2012 Key Trends in Software Pricing & Licensing

3 All software publishers have a right to audit clause written into all their end user licence agreements ( EULA ) or subsequent terms and conditions of commercial agreements. These software audits challenge businesses to prove their licence compliance by evidencing what software licences they have procured against usage and/or consumption across their organisation. This translates to two main challenges; proving software compliance and maximising spend optimisation. Industry Changes How the Industry Has Evolved Software publishers, like the majority of industry sectors, have been unable to avoid the current economic uncertainty. Recent years have seen even the large software publishers, such as Microsoft, IBM and Oracle, experiencing sudden and unexpected drops in projected business activities due to their customers reducing IT expenditure or scaling back on both upgrades and infrastructure projects. As software purchases are either deferred or cancelled - software publishers are looking alternative options to achieve their revenue targets and satisfy shareholder demands. One option is for the publishers to invoke their contractual audit rights and target possible IP infringements. This is largely due to some organisations not effectively managing the use of software that has been procured for their business. Software publisher audits can be one of the most disruptive and costly events that an organisation, and especially Procurement/IT departments can face. The ability for organisations to demonstrate clear competence in their licence position and software management can nullify many of the associated financial, legal and resource costs of a software publisher audit, but proactive risk management is difficult to obtain based on the size and complexity and changes to IT environments. What s the impact of an Audit on an Organisation? The impact on an organisation depends on the level of SAM Maturity and their capability to manage the software audit engagement. If the organisation understands and can efficiently and accurately report on their usage and consumption data, then the impact could be reduced. If organisations can also demonstrate a maturity of management and control over their estate, then this could positively create a change in strategy of software publishers approach to auditing. During our audit defence experiences, we have made the following general observations - these are not applicable to all publishers and may not occur every time an audit is conducted but they may: Make judgements with the organisation s data and their interpretation of licence rules that may provide an alternative view to that which is settled Require the audit s conclusion is reached quickly this is normally aligned to reporting periods, but in some cases the speed of this conclusion isn t always a factor Lead with a conversation over a legal charge or IP infringement. The usage and consumption data will always retain maximum importance as well a full understanding of the nuances of the licence terms and conditions, as such an organisation s ability to control the data quality and credibility and when this is released is of paramount importance. Under most scenarios if you control the accuracy, release dates and other aspects of your data, then your ability to control the situation and the outcome will be improved. Unfortunately if the organisation cannot demonstrate how their software estate is managed across the software lifecycle; therefore resulting in limited control and capability, a software audit can have a considerable impact on: Resource Capability, availability and volume Unbudgeted software spend Investment in unnecessary software products Market trends and research suggest that proactive software asset management initiatives from the software vendors commence at the start of their financial year with more aggressive compliance enforcement towards the end.

4 Initial Contact from Software Publisher In general, across the market, publishers rarely lead with the word audit. The most common approach would be to try and work collaboratively with the customer to review their software licences to ensure the end users are getting the most from their investment with the publisher. The formal approach is to issue a letter to the CEO/CIO/CFO requesting a meeting to formally initiate a software licence review, however software publishers can use a number of opportunities to engage or re-engage prior to a formal letter being received. An organisation is more susceptible to receiving an audit request if: The organisation has recently completed a software audit from a different software publisher Major IT Change Programme(s) are planned to commence or are already in-flight e.g. Hardware infrastructure migrations, operating system upgrades etc. Major organisational changes are planned to commence or are already in-flight. e.g. Divestment or acquisition; especially if announced to the Stock Exchange or similar Tactical decision to move away from key technologies provided by the incumbent publisher. e.g. Moving away from Microsoft to Google Exit / Non-renewal of existing software contracts How to Approach a Vendor Audit Best practices suggest a software audit can be broken down into three phases: Phase 1 Communications Strategy Phase 2 Formal Audit Engagement Phase 3 Post Audit Activities Phase 1 Communications Strategy It is vital that any formal or informal audit request is managed centrally and from a global perspective (if applicable), so to help your business it is important to understand some of the following: You remain their customer and as such it is important to the publisher that a level of customer satisfaction is retained Unless evidence has been obtained, the publisher cannot know for certain that you are infringing their IP or have any compliance issues A virtual team should be created with a definitive central point of all communications. Based on the creation of the virtual team an internal review to ascertain the SAM capability will be undertaken which will naturally drive the organisations decision to either: Look to the external market and obtain the correct level of SAM expertise and support Commit to managing the audit engagement in-house Whichever approach is taken this should be shared with the publisher, any third party and the internal organisation structure. It is also important to note that customers have a business that takes ultimate priority and publishers accept there may be delays in initiating the audit process based on a number of internal, organisational and other factors. It is important that dialogue is maintained with the publishers to ensure mutual cooperation and a satisfactory mutually acceptable outcome is achieved. In summary, ensure all of the above is considered and make sure dialogue and updates are communicated in a timely fashion. Also make sure that any response is not rushed and all efforts to locate the most accurate information are taken.

5 Phase 2 Formal Audit Engagement In order to establish control and a positive outcome for customers once an official audit notice has been received, the following should be observed. The engagement model is split into four key components: Planning & Preparation: As with many engagements, Planning & Preparation is vitally important and this would be especially relevant in the software publisher audit process. Resources firstly need to be determined, allocated and aligned to areas of expertise to the part(s) of the process Data Collection: All areas of data required for the process must be assessed for accuracy, completeness and the impact Final Position: An agreed final position must be agreed internally and any subsequent mitigating information prepared in advance of any sharing with the publisher Formal Response: The Final Position is submitted to the publisher All Party Agreement and Closure: Commercial discussions along with the mitigating information is assessed and a mutual agreement reached between the publisher and the customer Phase 3 Post Audit activities Do not underestimate the importance of this phase. If you have witnessed at first hand the stress and disruption to your organisation that comes with a software publisher audit, you will understand and want to ensure that the time and effort applied to this exercise is not wasted or duplicated if a new audit request is received. It is important to ensure that all the applications associated with the software vendor are managed going forward. Initiating or Developing a SAM Programme As part of a Lessons Learnt exercise that will follow any audit engagement, one of the most recurring responses from customers is.we need to plan to ensure that a repeat of this exercise is much easier to execute.. To this end it is strongly recommended that a SAM programme is initiated from senior management with their support. Computacenter have been assisting customers in the development, design, execution and management of SAM programmes for in excess of 15 years. Our interpretation of the SAM landscape can be considered by addressing the following categories: Policy & Process Overview Policy & Process Design or Redesign Licence Compliance Assessment Ongoing Management Change / Release and other IT Management and its impact

6 How Computacenter Can Assist Computacenter has developed a wide range of Software Asset Management ( SAM ) and Licence Management ( LM ) services by engaging with its customers for over 15 years. Our approach also aligns with the ITIL framework of People, Process and Technology ensuring that all of these aspects are covered to attain the most effective SAM maturity for our customers. Computacenter s Solution: C 3 Software What is C 3 Software? C 3 Software is a suite of services that are designed to help organisations cut complexity and cost from software asset management. The services incorporate best-of-breed technology and expert skills and resources to enable organisations to address those software challenges. The services also aim to assist customers in designing a SAM programme that will provide resolutions to business challenges and goals through efficient SAM practices. Computacenter want to ensure the SAM journey customers take is measured and adequately allows for maturity to be increased over a given timeframe. It is as ineffective not doing anything as it is to try and ascend the maturity scale over too short a timeframe based on our experience of implementation and initial investment required. C 3 Software utilises the three aspects of the ITIL framework to create four main service categories: Licence and Software Asset Management Services Strategic Software Vendor Optimisation Services Policy and Procedure Consultancy Consultancy Advisory Services (including Audit Defence) Specific Consulting services aimed to deliver against bespoke customer requirements. Audit Defence services are contained within this to offer help and support services to assist customers in the Software Publisher Audit process Based on ITIL, Computacenter feel that their framework requirements are addressed as follows: People Our consultants have a breadth and wealth of experience in many different customer types, sizes and verticals and spanning both the design and delivery of all services above Process Computacenter s aim is to use industrialisation; in that the creation and delivery of processes and services are always being self-improved and developed for the benefit of all customers. Our internal governance challenge these processes and ensures effectiveness can be demonstrated prior to sale and delivery Technology In order to assist Computacenter s customers in selecting the right tool to fit their requirements and optimise their licensing investment we have partnered with License Dashboard to provide C 3 Software via a hosted solution running in Computacenter s secure datacenter. As C 3 Software is provided only on a subscription basis all infrastructure and associated information system costs are included with upgrades, maintenance and support being maintained by Computacenter. This means the client has no requirement to invest in the resources and skills required to manage the technology

7 Why Computacenter? Computacenter are uniquely positioned as we are a combination of a Reseller and Outsourcer with an in-house SAM practice. This means our advice is supported by vendor s sales training and resources that organisations don t have direct access to. We have the scale and experience of an outsourcer to manage the services for our customers and by having an in-house SAM practice partnered with specialist tool capability we can provide a more in-depth knowledge than many other resellers. By selecting Computacenter you can be confident of receiving best in class SAM resources to deliver a best practice solution that meets the your objectives throughout the software asset s lifecycle. By selecting Computacenter for SAM, you will benefit from: Collectively has over 25 years of software asset management industry knowledge to include Audit Defence engagements within the consultancy practice Software Audit and negotiation engagement process and tactics Access to industry leading licensing expertise to underpin clients technology and business strategy Proactive Licence reconciliation to identify and mitigate immediate and sustained compliance risks Software Audit Management expertise across all industry sectors i.e. Financial, Industrial and Commercial/Retail for Tier 1 Software vendors. Delivery of quantifiable cost savings and cost avoidance In addition, Computacenter s position as an industry leading software supplier and software asset management organisation means our customer can benefit from a linking of the two services. By linking procurement with asset management leads to: Quicker decision making A one stop shop for all software requests A complete process with a single organisation ensuring there are no gaps in the overall management of software from request, through procurement, into management and then retirement The client can potentially benefit from commercial innovation offsetting some cost of service via the supply of software via Computacenter. Computacenter has more than 25 years experience of sourcing and managing multi-vendor licences and over 80% of the FTSE 250 companies collaborate with Computacenter making us a partner of choice when it comes supporting our customers through a software audit irrespective of the stage we are engaged. We can utilise strong commercial vendor relationships with an organisation s strategic suppliers to ensure the best approach can be realised; to this end we have multiple accreditations with around 30 key vendors including Microsoft, Citrix, EMC, NetApp, Adobe amongst others. Due to the varying business delivery, Computacenter conduct technical, design, delivery and commercial services which include full end to end services to satisfy the expansive business requirements of organisations.

8 If you are thinking about, or are already involved in any of the following projects then Computacenter can help you assess the Software licensing implications and the impact to your business: Windows 7 upgrade Bring your own device Data storage and retrieval Big Data Information management Mobility and remote working Desktop, telepresence and collaboration Workplace transformation or upgrades Cloud Before starting any projects listed above Computacenter recommends that you consider the impact these may have on your Software licensing estate. To learn more about how Computacenter can help, speak to one of our experts, free of charge or contact your Computacenter Account Manager today on the details below: [email protected] Tel: Web: Computacenter (UK) Ltd Hatfield Avenue Hatfield Hertfordshire AL10 9TW United Kingdom +44 (0) [email protected] Computacenter is a leading independent provider of IT infrastructure services and solutions. From desktop to datacenter, we help our customers minimise the cost and maximise the value of IT to their businesses. We can advise organisations on IT strategy, implement the most appropriate technology, optimise its performance, and manage elements of our customers infrastructure on their behalf. Computacenter operates in the UK, Germany, France and the Benelux countries, as well as providing transnational services across the globe. Computacenter 2015