Initial claims ran 40 to 70 percent above the defensible number once entitlements were applied, and unguarded early disclosures drove much of what was left
Most avoidable liability is created by helpful early disclosures rather than by real overuse. The first two weeks set the rules for everything after them.
Prepared by Redress Compliance · August 19, 2026 · Vendor audits defended. 40 to 50 audits, 2024 to 2025.
Executive summary
Inflated openings: initial claims ran 40 to 70 percent above the defensible number once entitlements were applied. The opening figure is a position, not a measurement.
Measurement errors: 1 in 3 audits relied on a script or count that double counted or ignored contractual rights. Verify the method before the number becomes a finding.
Process leakage: unguarded early disclosures, not real overuse, drove much of the avoidable liability. Helpful answers in week one become the claim in week ten.
The timing usually favors the vendor. Audits land before a renewal so the finding and the renewal become one conversation, and separating them is the buyer's job.
Why do audits happen, and when?
They are a revenue mechanism as much as a compliance check. Vendors run them when the data suggests growth, after a merger, when usage patterns change, or on a contractual cycle.
Three triggers worth recognizing
- Growth signals: downloads, support tickets or new registrations that imply expansion.
- Corporate events: mergers, acquisitions and divestitures that change the entity count.
- Contract timing: the run up to a renewal, when a finding becomes negotiation leverage.
Understanding the trigger tells you what they expect to find
The right to audit, and its limits, live in your agreement. The practices that reduce exposure are described in the asset management standard, and many vendors follow the conduct guidance published by the industry body.
How should you respond to the notice?
The first response sets the tone and the rules. Acknowledge the notice, confirm the governing clause, and route everything through a single point of contact.
Three moves in the first week
- Acknowledge without conceding: confirm receipt without accepting any preliminary number.
- Cite the clause: hold the vendor to the contractual notice period, scope and method.
- Single channel: route all communication and data through one named owner.
What not to do in the first two weeks
Do not let technical staff answer measurement questions directly, do not install measurement tooling without review, and do not share deployment data outside the contractual scope. Most avoidable liability is created here.
The software audit defense playbook
The response sequence, the scope discipline, and the buyer side moves from notice to settlement.
Get the brief →What 40 to 50 vendor audits showed
Across roughly 40 to 50 vendor audits Morten Andersen helped defend between 2024 and 2025, the opening finding consistently overstated the real exposure. Three patterns recur.
- Inflated openings: initial claims ran 40 to 70 percent above the defensible number once entitlements were applied.
- Measurement errors: 1 in 3 audits relied on a script or count that double counted or ignored contractual rights.
- Process leakage: unguarded early disclosures, not real overuse, drove much of the avoidable liability.
Vendor measurement scripts are built to find usage. Reconciling their count against your own records routinely removes a large part of the gap before any negotiation starts.
- Your agreements decoded into plain English before the auditor interprets them for you
- Entitlements, caps and protections verified across your whole contract portfolio
- A defensible position paper generated in minutes rather than weeks
What is each side actually trying to win?
Four stages, and the goals diverge at every one. Knowing which lever governs each stage is what keeps the process inside the contract.
| Stage | Vendor goal | Buyer goal | Key lever |
|---|---|---|---|
| Notice | Establish scope and access | Confirm contractual limits | The audit clause |
| Data collection | Maximum measured usage | Accurate, scoped measurement | Independent verification |
| Findings | A high opening claim | Apply entitlements and rights | Reconciliation evidence |
| Settlement | A back dated penalty | A forward looking purchase | The renewal as trade |
Separate the two questions the vendor wants merged
What is actually owed, and what you intend to buy next, are different questions. Audits land before renewals precisely so they become one conversation.
The settlement shape matters as much as the number
A back dated penalty and a forward looking purchase can carry the same headline figure and behave completely differently across the following three years.
How do you control scope and data?
Scope and data discipline decide most disputes. The vendor wants the widest possible measurement; your job is to keep the audit inside the contract and verify every number before it becomes a finding.
Three controls that hold
- Hold the scope: limit the audit to the entities, products and period the contract allows.
- Verify the method: understand exactly how each number was produced.
- Apply your rights: count entitlements, migration rights and prior agreements against the claim.
Why independent verification matters
Vendor scripts are built to find usage, and they often double count, ignore virtualization rights, or miss entitlements you already hold. That is the 1 in 3 figure, and it is recoverable with records you already have.
The lifecycle discipline is written down
The asset management lifecycle that keeps those records current is defined in the published lifecycle standard, which is neutral ground both sides should respect.
Where the common advice on audits is wrong
The common advice is to cooperate fully and quickly, on the theory that transparency shortens the process. We disagree.
Cooperation is not the same as unscoped disclosure
Process leakage rather than real overuse drove much of the avoidable liability in the audits defended. The technical answer given helpfully in week one is the finding argued about in week ten.
The buyer side move is to acknowledge without conceding, hold the vendor to the clause, verify every number independently, and separate the settlement from the renewal. The cost picture sits in the audit cost report and the estate baseline in the spend health check.
What the audits measured, 2024 to 2025
Two cuts of the defense file, and both describe the opening rather than the outcome.
Once entitlements, migration rights and prior agreements were applied against the claim as presented.
Relying on a script or measurement that double counted, ignored virtualization rights, or missed entitlements already held.
Neither figure requires the vendor to be acting in bad faith. Both require the buyer to check before agreeing.
Your first five moves
- Acknowledge the notice without accepting any preliminary number, because the opening claim ran 40 to 70 percent above the defensible figure.
- Route every communication and data request through one named owner, since unguarded disclosures rather than real overuse drove the avoidable liability.
- Hold the vendor to the contractual notice period, scope and method, and limit the audit to the entities, products and period the clause allows.
- Verify how every number was produced before it becomes a finding, because 1 in 3 audits relied on a count that double counted or ignored your rights.
- Separate the settlement from the renewal. The audit defense practice keeps those two questions apart, which is exactly what the timing is designed to prevent.
Frequently asked questions
Why do vendors run audits?
They are a revenue mechanism as much as a compliance check, triggered by growth signals, corporate events, or simply the run up to a renewal.
How inflated is the opening claim?
It ran 40 to 70 percent above the defensible number once entitlements were applied. The opening figure is a position rather than a measurement.
What creates the avoidable liability?
Process leakage. Unguarded early disclosures rather than real overuse drove much of it, which is why the first two weeks matter more than the settlement.
What should the first response be?
Acknowledge receipt without accepting any number, cite the governing clause, and route all communication and data through one named owner.
What should be avoided early?
Technical staff answering measurement questions directly, installing measurement tooling without review, and sharing deployment data outside the contractual scope.
How often is the count wrong?
In 1 in 3 audits. Vendor scripts are built to find usage and often double count, ignore virtualization rights, or miss entitlements already held.
Why does the timing matter?
Audits land before renewals so the finding and the renewal become one conversation. Separating what is owed from what you intend to buy is the buyer's job.
What controls scope?
The audit clause. Limit the audit to the entities, products and period the contract allows, and verify the method behind every number produced.
Is full cooperation the fastest route?
Cooperation is not the same as unscoped disclosure. The helpful technical answer given in week one is the finding argued about in week ten.
What shape should a settlement take?
Forward looking rather than back dated. The same headline figure behaves completely differently across the following three years depending on which it is.