Software Audit Risk Assessment

Question 1 of 7

🔍

Have you been contacted about an audit by any vendor in the last 12 months?

Oracle, IBM, SAP, and Microsoft all have active audit programmes. Contact from a vendor licensing team often precedes a formal audit.

No audit contact from any vendor

Informal enquiry from one vendor

Formal audit notice received

Active audit in progress

Immediate defence needed

Question 2 of 7

📊

Do you maintain an accurate software asset inventory?

An accurate inventory is your primary audit defence. Without it, vendors can claim any deployment level they choose.

Yes — automated SAM tool with regular reconciliation

Mostly — manual inventory updated quarterly

Partial — major products tracked, gaps exist

No reliable software inventory

Question 3 of 7

📜

Do you have documented proof of your software entitlements?

Entitlement records (purchase orders, licence keys, agreements) must be matched against deployments. Missing records = assumed non-compliance.

Complete entitlement records for all vendors

Good records for major vendors, gaps for others

Partial records — many missing or incomplete

Entitlement records not maintained

Question 4 of 7

⚙️

How confident are you in your virtualisation licensing compliance?

Virtualisation is the #1 audit risk area. VMware, Hyper-V, and cloud deployments create complex licensing scenarios.

Fully compliant — verified independently

Mostly confident — standard deployment

Uncertain — complex virtualisation environment

No visibility into virtualisation licensing

Question 5 of 7

👥

Do you have controls to prevent unauthorised software installation?

Shadow IT and uncontrolled installations create compliance gaps that auditors specifically target.

Strict controls — whitelist, MDM, policy enforcement

Moderate controls — admin rights restricted

Limited — some users have local admin

Minimal controls — users can install freely

Question 6 of 7

📦

How many major software vendors does your organisation use?

Each vendor is a potential audit source. More vendors = more audit exposure. Oracle, Microsoft, SAP, and IBM are the most aggressive.

1-3 major vendors

4-6 major vendors

7-10 major vendors

10+ major vendors

Question 7 of 7

🛡️

Do you have an audit response plan and designated owner?

A pre-prepared audit response plan with legal review and designated ownership dramatically improves audit outcomes.

Yes — documented plan with legal review

Informal process — designated owner exists

No plan — would respond reactively

No awareness of audit risk or response process

Need Expert Enterprise Software Advisory?

View Your Results