The First 72 Hours: What To Do When A Software Audit Letter Lands On Your Desk — And The Five Mistakes That Cost Companies The Most Money

The email arrives on a Tuesday afternoon. It is polite. It is addressed to someone in procurement or IT who has never seen one before. It references a section number in an agreement signed years ago by people who no longer work at the company. It asks for a call to “discuss your licensing position” and requests that you run an attached script and return the output within thirty days.
There is no dollar figure in it. That comes later — and by then, the number will have been built almost entirely out of information your own team handed over in the first week.

This is the central and counterintuitive fact about software license audits: the most consequential decisions are made before anyone knows what is at stake. By the time a seven- or eight-figure demand arrives, the evidentiary record supporting it is already closed, and your company built most of it.

The audit demand is not calculated from what you deployed. It is calculated from what you reported, measured the way the publisher's tools measure it.

You are not being singled out

Clients often assume an audit letter means the publisher suspects something. Usually it does not. Audits are a revenue channel, run on a schedule, and the volume is substantial.

Flexera's 2026 State of ITAM Report, drawn from a survey of ITAM professionals conducted in early 2026, found that nearly half of organizations — 48 percent — received a software audit in the prior twelve months. Microsoft was the most frequently reported auditor at 64 percent of those audited, with Oracle close behind at 50 percent. Oracle's reported audit activity jumped roughly fourteen percentage points year over year. Adobe and VMware activity also rose.

The cost side is where it stops being a compliance annoyance and becomes a balance-sheet event. Forty-four percent of organizations reported spending more than $1 million on software audits over a three-year period. In earlier Flexera data, the share of companies reporting audit costs above $10 million nearly doubled year over year, from 7 percent to 12 percent.

Two conclusions follow. First, receiving a letter is not evidence that you did anything wrong. Second, the process that follows is expensive enough that it deserves the same seriousness as any other bet-the-budget dispute — from hour one.

Hours 0 to 4: contain the response

The single most damaging thing that happens in a software audit usually happens in the first afternoon, and it is almost always well-intentioned.

A systems administrator receives the letter, wants to be helpful and cooperative, and replies directly to the auditor. In doing so, he or she confirms deployment figures from memory, describes the virtualization architecture, explains that a subsidiary has been using the software too, or apologizes for something. None of it is verified. All of it is admissible. All of it is now the publisher's baseline.

What to do instead

• Acknowledge receipt and nothing else. A one-line email confirming the letter was received, stating that the company is reviewing it and will respond through a designated point of contact, is sufficient and appropriate.
• Designate a single channel immediately. One named person routes all communications with the publisher and the auditor. Everyone else in the organization is instructed, in writing, to forward rather than respond.
• Engage counsel before substantive analysis begins. This is not merely about advocacy. Internal compliance analyses generated after an audit notice — spreadsheets, gap assessments, candid emails about whether the company is over-deployed — are discoverable unless they were created under privilege. Involving counsel at the outset is what makes it possible to assess your own exposure honestly without handing the publisher its case.
• Do not run the vendor's scripts yet. Measurement tools embed the publisher's licensing interpretations. Running one and returning the output is not neutral fact-gathering; it is agreeing to a methodology before you have read the clause that governs it.

Hours 4 to 24: preserve everything, change nothing

Two instincts surface once the seriousness registers, and both are dangerous.

The first is to clean up — uninstall software that may be over-deployed, decommission instances, tidy the environment before anyone looks. Do not. Depending on the contract and the circumstances, this can convert a commercial dispute into an allegation of spoliation or bad faith, and publishers have begun litigating precisely this point. In the Broadcom litigation now pending in the Northern District of California, the publisher's position is essentially that a customer cannot extinguish audit obligations by removing the software mid-review. Whatever the outcome, you do not want to be the test case.

The second is to delete — to purge old email threads about license planning or the failed true-up conversation from two years ago. That is worse.

What to do instead

• Issue a litigation hold. Immediately, in writing, covering procurement records, license entitlement documentation, deployment logs, correspondence with the publisher and its resellers, and internal discussions about licensing.
• Freeze the environment as it stands. Document its current state. Changes that were already planned and documented before the audit notice can generally proceed; changes prompted by the notice should not, absent advice.
• Gather your entitlements before you gather your deployments. Master agreement, every order form, every amendment, every assignment or novation from an acquisition, every reseller paper trail. Companies routinely under-count their own entitlements because the documentation is scattered across three departments and two acquisitions.

Hours 24 to 48: read the contract, not the letter

The audit letter describes what the publisher would like to happen. The contract describes what the publisher is entitled to make happen. In our experience these two documents diverge more often than they align, and the gap is where the leverage is.

Working through the actual audit clause, ask:

• What is the permitted scope? Audit rights are frequently limited to specified products, entities, or territories. Letters are frequently not.
• What notice is required, and was it given? Many clauses require thirty or more days' written notice, delivered a particular way, to a particular person.
• How often may the publisher audit? Once per year and not more than once in any twelve-month period is a common formulation. Sequential audits of different product families can breach it.
• Who is permitted to conduct it? A clause allowing an audit by the publisher “or its designee” is not the same as one permitting an independent accounting firm, and the identity of the auditor materially affects what you should agree to disclose.
• How long do record-retention obligations run — and do they survive termination? Retention periods measured from the expiration of support and subscription services are common and are often the provision customers overlook entirely.
• What triggers cost-shifting? Many clauses require the customer to bear audit costs only if the audit reveals underpayment above a stated threshold — often 5 or 10 percent. That threshold is a negotiating instrument, not a formality.
• What confidentiality protections apply to what you hand over, and is a separate audit NDA warranted before any data moves?

Note what is generally not in the clause: an obligation to run the publisher's tooling, an obligation to accept the publisher's counting methodology, an obligation to grant direct access to your systems, or an obligation to answer open-ended questionnaires about your architecture. Those are requests. They are frequently presented as requirements.

Hours 48 to 72: build your own number first

An audit is a valuation dispute conducted under the appearance of a factual inquiry. Whoever establishes the measurement framework first usually wins the argument that follows.

Before responding substantively, and under privilege, develop an independent internal picture: what is actually deployed, what entitlements actually exist, and what the defensible license position looks like under a reasonable reading of the contract. This accomplishes three things. It tells your leadership the realistic range of exposure rather than the publisher's opening number. It surfaces the contractual ambiguities worth fighting over. And it means that when the publisher's figure arrives, you are comparing two analyses rather than reacting to one.

Where the technical measurement is genuinely complex — virtualization, containerization, indirect or digital access, disaster-recovery environments, development and test instances — a licensing specialist working at counsel's direction is usually worth the cost several times over. The distinction matters: retained through counsel, that work carries a privilege argument. Retained directly, it generally does not.

The five mistakes that cost the most money

1. Treating it as an IT problemAudits are contract disputes that happen to involve technology. Routing one to the infrastructure team because it mentions servers is how companies end up bound by admissions no lawyer ever reviewed.
2. Volunteering scopeAnswering questions that were not asked, disclosing affiliates the publisher had not identified, and describing environments outside the audited product family all expand the audit at your own expense.
3. Accepting the publisher's mathDeployment counts under contested interpretations — core-counting in virtualized environments, user definitions that sweep in service accounts, indirect access theories — are legal conclusions dressed as measurements. They can be contested. They frequently should be.
4. Negotiating on the publisher's clockAudit findings tend to arrive near a quarter or fiscal year end, accompanied by a deadline and a discount that expires. The urgency is manufactured, and the resolution offered is almost always a purchase rather than a settlement — the compliance gap is forgiven in exchange for a subscription commitment considerably larger than the gap.
5. Waiting to involve counsel until there is a demandBy then the record is fixed. Counsel engaged at the demand stage is negotiating over evidence the company created without advice. Counsel engaged at the letter stage is shaping what that evidence is.

What resolution actually looks like

Most audits do not end in litigation. They end in a negotiated commercial resolution, and the quality of that resolution depends almost entirely on the strength of the customer's independent position and its credible willingness to litigate if pushed.

A well-defended audit typically produces some combination of a substantially reduced compliance figure, a release covering the audited period, an agreed and documented licensing interpretation going forward, amended audit provisions with tighter scope and notice requirements, and — where the publisher's conduct warrants it — a negotiated standstill on further audits for a defined period. What it does not produce is a rushed subscription commitment signed three days before the publisher's fiscal year closes.

When you need litigation counsel and not just a licensing consultant

Licensing consultants are valuable, and we work with them regularly. But certain features of an audit signal that the matter has already left the commercial track:

• The audit notice followed a decision not to renew, a migration announcement, or a corporate transaction.
• The publisher is asserting copyright infringement rather than breach of contract — a claim that carries statutory damages and fee-shifting exposure that a contract claim does not.
• The demand is framed against affiliates, divested businesses, or successors that you do not believe were ever licensed parties.
• Support or access to business-critical systems is being used as leverage.
• The publisher has raised litigation, or has filed.

Any one of those changes the analysis. Taken together, they mean the negotiation is happening in the shadow of a lawsuit, and it should be conducted by someone who is prepared to try it.

If an audit letter has arrived

Our practice is devoted to software licensing and technology disputes — audit defense, over-deployment and indirect access claims, failed implementations, and litigation against major publishers. If your company has received an audit notice, or expects one, the most valuable conversation is the one that happens before the first substantive response goes out.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.