ServiceNow operates your instance, so the review needs no field visit, and 60 to 80 percent of findings trace back to how users were classified. Three knowledge checks along the way, and 3 clips from a senior licensing analyst.
This is a taught session, not a talking head. The instructor works through analyst grade slides, and three times the video stops on a question with four options on screen. Pause, commit to an answer, and the next slide explains which option is right and why each of the others is wrong. 3 times in the session the frame splits and a senior licensing analyst gives the view from inside real ServiceNow negotiations, and the instructor picks the clip apart when the slides return.
The full narration of this session, section by section, for reading and reference. Guest analyst clips are marked.
Welcome back, session thirty eight, and today is the compliance review. And I want to start by removing an assumption that a lot of people bring from other vendors, because if you have lived through an Oracle or a Microsoft audit you have a mental model that does not apply here. In those, a large part of the exercise is discovery. Scripts get run, data gets collected, there are field visits, and there is usually a lengthy argument about what the data even is, and all of that takes months, which gives you time. None of that applies to ServiceNow, because ServiceNow operates your instance. They can read activity in it. There is no discovery phase, there is nothing to collect, and the entire conversation is about interpretation rather than about facts. Three checks, homework, let's go.
Five objectives. First, understand the asymmetry, that a licence review here is data driven and needs no field visit at all. Second, know the triggers, rapid user growth, an approaching renewal, and organisational change, all three of which are predictable, which makes the timing predictable too. Third, name the three counts, fulfiller users against licensed fulfillers, ITOM managed resources against subscription size, and custom tables against package allowances. Fourth, expect the classification finding, because sixty to eighty percent of findings came from misclassified or occasional fulfillers, and integrations consumed fulfiller entitlements in thirty to fifty percent of estates. And fifth, answer from your own numbers, because the defence is a reconciled user model prepared before any review, and an explanation offered after a finding is a much weaker instrument than a document that predates it.
Four framings. No visit, because ServiceNow operates your instance and can read activity in it, so reviews are data driven rather than on site. Sixty to eighty percent, the share of findings traced to misclassified or occasional fulfillers, and I want to stress that this is almost never deliberate misuse and almost always classification. Thirty to fifty percent, the share of estates where service accounts and integrations consumed fulfiller entitlements that nobody had ever counted as people. And a position, which is what an opening true up number is, rather than a settlement, and rather than a calculation you are obliged to accept as given. The note underneath is the useful reframing. The asymmetry is not that they can see your data. It is that they routinely look at it and most customers do not, and that particular gap is one you can close in a single quarter with no permission from anybody.
Guest analyst clip. The absence of a discovery phase changes the shape of this in a way I think is underappreciated, and it cuts both ways. In a traditional audit, the discovery phase is where a prepared customer buys time. You negotiate the scope, you argue about the measurement method, you take three weeks to run the scripts, and while all of that is happening your team is quietly fixing what can be fixed. That is not cynical, it is normal practice, and every experienced software asset manager knows it. Here you get none of that. The data already exists, they already have it, and the first conversation can begin with a number rather than with a methodology. So the preparation window does not exist during the review. It exists before it. Which means the entire discipline shifts from being reactive to being scheduled, and honestly that is easier, it is just less familiar. The customers who handle this well are not the ones who negotiate hardest once a review opens. They are the ones who ran the same three counts themselves last quarter, found the same things, and fixed what they could, so that when the conversation starts they are discussing a gap they already knew about rather than being introduced to it.
The preparation window does not exist during the review, it exists before it, which makes this scheduled rather than reactive. So what starts one.
Four triggers. Rapid user growth, where they are seeing a sharp increase in fulfiller activity against a licensed count, and the move is to reconcile at the moment of growth rather than waiting to be asked about it. An approaching renewal, which is the highest risk window precisely because exposure settles best inside a renewal, and the move is your own review nine to twelve months out, which is module six. Organisational change, mergers and divestitures, which reliably prompt entitlement questions, and the move is session thirty seven's checklist run at deal close. And feature activation, because turning on ITOM, HRSD, or CSM capability draws licensing attention, and the move is session thirty six's capability gate asked before the switch gets flipped. Now the note, which is the whole opportunity. Every one of these is visible to you before it is raised with you. Growth, a renewal date, a corporate event, and a feature switch are all things you know about first.
What a review actually checks, and it is a short list. Fulfiller users against licensed fulfillers, the dominant count and the one module three spent five sessions on, and this is where most of the exposure lives. ITOM managed resources against subscription size, which is session seventeen's managed configuration item count, the one that grows without anybody hiring and which you can measure yourself. Custom tables against package allowances, which is session thirteen's register, a number that only ever moves upward unless somebody deliberately retires something. Three counts, all measurable in advance, and none of them requires a tool you do not already have, because all three are queries against your own instance run by your own team. And that is what makes preparation possible here, because you cannot prepare for an audit whose scope is unknown, and you can absolutely prepare for one that checks three things you could count this afternoon.
Knowledge check one. Why is a ServiceNow review different from a traditional on premise software audit? A, it is not, the process is the same. B, the vendor operates your instance and can read usage directly, so there is no discovery phase to negotiate. C, because subscription contracts cannot be audited. D, because findings are always smaller. Pause here, and ask who holds the data in a SaaS relationship.
The answer is B, no discovery phase. In an on premise audit a very large part of the exercise is establishing what the data even is, which creates both time and room to prepare, whereas here the vendor already has it and the entire conversation is about interpretation from the first meeting. Answer C is simply wrong, because contractually a review can absolutely become a formal audit, and we will come back to why it usually does not. And the practical consequence of all this is worth stating plainly. Every hour you spend in a ServiceNow review arguing about data collection is an hour completely wasted, and every hour you spend on classification is an hour extremely well spent, because classification is the only thing genuinely in dispute.
Where the exposure actually comes from, and across roughly thirty to forty reviews and renewals it almost always traced back to how users were classified rather than to any deliberate misuse. Four cards. Fulfiller creep, sixty to eighty percent of findings, made up of admins, occasional users, and people who were given a role once to solve an access problem and simply kept it. Integration drift, service accounts and integrations consuming fulfiller entitlements in thirty to fifty percent of estates, because nobody ever counted them as people. Why it is not misuse, because every one of these was an administrator solving a real problem, and the finding is a classification gap, and treating it internally as misconduct makes it considerably harder to fix. And it is measurable now, because an inventory of every non human account against its licence weight is the quietest line in any finding and the easiest one to fix before anybody raises it.
Knowledge check two. A review finds a hundred and forty fulfiller entitlements consumed by service accounts and integrations. What is the right response? A, dispute it, integrations are not users. B, reconcile the inventory, reclassify what genuinely can be, and settle the rest as part of a forward looking position. C, pay it, the count is from their system. D, escalate to legal immediately. Pause here, and ask whether the count is wrong or whether the classification is worth examining.
The answer is B, reconcile then settle forward. Integrations frequently do carry fulfiller weight under the product definitions, so answer A is an argument you will lose on the contract wording, and losing it early costs you credibility on the points you could have won. Answer C concedes a number before establishing whether every one of those accounts genuinely needs the entitlement it currently holds, and in practice a meaningful share of them do not. So the productive path is an inventory of every non human account against its licence weight, correcting whatever can be corrected, and then settling the remainder forward, which is session fourteen's lesson, that a true up settles best as terms you actually wanted anyway.
The defence, and it is a document rather than an argument. It is the same baseline, session thirty six's standing document maintained quarterly, and the pleasing thing is that the artifact which produces your negotiating position is the identical artifact that answers a compliance claim, so you are not building two things. Reconciled rather than just exported, meaning entitlement mapped to actual role usage with the classification decisions written down and dated at the time they were made. Prepared before rather than explained after, because an accurate documented user model is a far stronger position than any explanation offered once a finding is already on the table. Correct internally first, reclassifying what should be reclassified before the conversation starts, so that it begins from your numbers rather than from theirs. And the definition clause underpins all of it, session thirty four's fulfiller definition, because you genuinely cannot defend a classification against a definition that was never written down anywhere.
Guest analyst clip. There is a difference between a document that predates a question and a document that answers one, and it is the single biggest factor in how these conversations go. If a customer produces a user classification model during a review, it is treated, entirely reasonably, as an argument. It was made by an interested party after the question was asked, and everybody in the room knows that, including the customer, which is why it is usually delivered slightly apologetically. If the same customer produces a model that was built eighteen months earlier, updated quarterly, with dated decisions and the reasoning attached, it is treated as evidence. Same spreadsheet, completely different weight, and the only difference is when it was made. And I have watched this change outcomes materially, because once your model is evidence rather than argument, the conversation stops being about whether your numbers are credible and becomes about the specific gap between two sets of numbers that both sides accept. That is a much smaller and much more manageable conversation. So the value of the standing baseline is not really that it is accurate, although it is. It is that it is old, and you cannot manufacture old.
The value of the baseline is not that it is accurate, it is that it is old, and you cannot manufacture old. Which is the strongest argument for session thirty six that I can give you. Now, where does this end up.
Where exposure actually gets resolved. Contractually a review can become a formal audit, and in practice most of them stay commercial, and understanding why tells you where to aim. Four cards. The renewal is the venue, because ServiceNow prefers settling exposure inside a renewal rather than invoking formal audit clauses, and the reason is straightforward, the renewal is where the account team gets paid. Which is good news for you, because a commercial settlement can be traded against terms, quantity, and duration, whereas a formal finding is simply a number you pay. Opening numbers are positions, because an opening true up figure is a starting position rather than a settlement, and it is built to be absorbed rather than to be precise. And settle forward, which is session fourteen's move, converting exposure into a forward position carrying the caps and definitions you wanted anyway, rather than making a payment for the past that buys you nothing at all.
Knowledge check three. You are told the review will settle inside your renewal rather than as a formal audit finding. Is that good or bad for you? A, bad, it means the exposure inflates the renewal. B, broadly good, because a commercial settlement can be traded against terms and duration where a formal finding is simply a number you pay. C, neutral, the amount is the same either way. D, bad, you lose the right to dispute. Pause here, and ask what you can trade in one venue that you cannot trade in the other.
The answer is B, broadly good. A commercial settlement puts the exposure into a conversation that also contains term length, clause language, and quantity, all of which are things you can trade, whereas a formal finding is just a bill with a due date. Answer A names a completely real risk, and I want to acknowledge it properly rather than dismiss it, because the exposure genuinely does enter your renewal and it genuinely does inflate the opening number, which is exactly why your own review has to precede theirs. But note what is happening here. The vendor's preference for a commercial settlement is genuinely aligned with your own interest, and that alignment is unusual enough in this relationship that it is worth recognising and using.
Four moves, all available before anybody asks. One, count the three counts, fulfillers, managed resources, and custom tables, which are the exact three a review checks and all of which are measurable from your own instance. Two, inventory the non humans, every service account and integration against its licence weight, which is the quietest line in any finding and the easiest to fix early. Three, write the classification down, dated decisions against a written definition, so that your model predates the question rather than responding to it. And four, reconcile at the trigger, growth, renewal, corporate event, and feature activation, because you see all four of those before they do and that is the entire advantage you have. The note is the one I would leave you with. Findings almost never reflect misuse. They reflect a classification gap that nobody was ever asked to close, which means closing it is administration rather than remediation, and that distinction matters enormously for how you raise it internally.
Guest analyst clip. I want to say something about how you handle this internally, because I have watched the internal handling do more damage than the finding. When a review lands, there is a strong instinct to establish who is responsible. Somebody gave out those roles. Somebody built those integrations. And you can construct a narrative in which people were careless, and it will be a completely false narrative, because what actually happened is that administrators solved real access problems using the tools they had, and nobody ever told them there was a licensing consequence or gave them a way to check. If you run the internal conversation as an accountability exercise, two things happen and both are bad. The people who know the most about the estate become defensive, and the people who would otherwise volunteer information stop volunteering it, so your reconciliation gets worse just when you need it to be excellent. What works is stating clearly at the outset that this is a classification gap rather than a conduct issue, and that nobody is in trouble, and then asking for help. I have seen teams find hundreds of accounts in a fortnight when it was framed that way, and the same teams find almost nothing over months when it was framed as an investigation.
Frame it internally as a classification gap rather than a conduct issue, because the people who know the estate best are the ones who go quiet if you get that wrong. Session thirty nine takes the relationship itself, run deliberately, the account team, the partners, the roadmap pressure, and the annual calendar that governs all of it.
Three sentences. ServiceNow operates your instance so a review is data driven with no field visit and no discovery phase, which means the conversation is about interpretation rather than about what the data is. The three counts are fulfiller users against licensed fulfillers, ITOM managed resources against subscription size, and custom tables against allowances, and sixty to eighty percent of findings trace to fulfiller misclassification with integrations consuming entitlements in thirty to fifty percent of estates. And the defence is a reconciled user model prepared before any review rather than an explanation offered after a finding, while exposure usually settles commercially inside a renewal, where it can be traded against terms rather than simply paid.
Homework, about an hour, five items. Run the three counts, fulfillers against licensed, managed resources against subscription, and custom tables against allowance, on one page, dated, because the date is doing real work as we discussed. Inventory the non human accounts, every service account and integration with the licence weight it carries, and expect to find several that nobody in the organisation could name. Check your gray zone, users holding a fulfiller role who did no fulfiller work at all last quarter, because that population is where sixty to eighty percent of findings live. Find your definition, session thirty four's clause, because if the contract does not define fulfiller activity then your classification has nothing to be defended against and you are arguing from preference. And check your triggers, whether you have had rapid growth, an approaching renewal, a corporate event, or a feature activation in the last year, because any of them makes a review meaningfully likelier.
Five guides. The ServiceNow audit defence pillar has the triggers, the user type table, the fulfiller creep and integration drift benchmarks, and the reconciled model defence, and it is today's session in written form. The ServiceNow license audit guide covers what a review checks, why most stay commercial rather than formal, and where organisational change fits as a trigger. Avoiding true up surprises is about settling forward rather than paying backward, plus the first seven days after a claim lands. Fulfiller versus requester licensing explained is the classification that produces most findings, with the activity evidence that makes a reclassification defensible. And ServiceNow audit management in 2026 runs the review process end to end and shows what a prepared customer does differently at each stage. Next time, the relationship run deliberately. See you there.