This free software license audit checklist gives software asset managers, IT managers, procurement leads and MSPs a repeatable audit for one vendor or product family at a time. It gathers proof of entitlement, counts installations and SaaS assignments under the licence metric that actually applies, and calculates an effective licence position for each product: surplus, compliant or short, with a price against every shortfall. The result feeds the next true-up or renewal. When a vendor has sent an audit notice, a seventh phase appears for the formal response: the audit clause, scope and NDA, what data leaves the building, and a line-by-line review of the auditor’s findings.
Every licence audit, yours or a vendor’s, compares two lists. The first is entitlement: what you can prove you bought, in which edition, under which metric and with which use rights. The second is deployment: what is installed, assigned or running, counted the way the licence terms count it. The difference, product by product, is the effective licence position, and it is the only number an auditor cares about.
Most disputed positions go wrong on the counting rule rather than the count. Software licensed per processor core is measured by the hardware it can run on, not by the number of copies installed. A per-user subscription is measured by assignment, whether or not the person ever signs in. A disaster recovery copy may be covered under one agreement and chargeable under another. That is why the checklist records the metric and use rights for each product before any comparison is made.
Sources: contracts, order confirmations, reseller invoices and the vendor’s licence portal.
Records: product, edition, metric, quantity, agreement number and maintenance status.
Weak spot: purchases with no paperwork, bought on a card or inherited through an acquisition.
Sources: endpoint management, discovery tools, SaaS admin consoles and the virtualisation platform.
Records: installs, assigned seats, last use, and host and core counts.
Weak spot: machines the tools cannot see, and duplicates that inflate the count.
This is a deeper, periodic exercise than the monthly licence check in the IT Asset Management Checklist, which keeps seats reclaimed and the register current across key products. The audit takes one vendor at a time, proves every entitlement, applies the licence terms and produces a position you would be willing to show the vendor. ISO/IEC 19770-1:2017, the IT asset management system standard that ISO last reviewed and confirmed in 2024, lists controls over under-licensing, over-licensing and compliance with licence terms among the requirements that set IT assets apart from other assets. It asks for a licence management process. This checklist is one way to run it.
Six phases run on every audit. Phase 7 appears only when a vendor audit notice has been received, and runs alongside Phases 2 to 5.
The answers on the first task decide whether the true-up tasks and the vendor audit phase appear.
The last task is an approval. The named budget holder decides, and nothing is ordered until they do.
Tasks 1 and 2 appear only when a true-up or renewal is due within 120 days.
Appears only when a vendor audit notice has been received. Run it alongside Phases 2 to 5: your own effective licence position is what you check the auditor’s findings against.
The metric decides what you count, and each metric has its own blind spot. Check your agreement for the exact definition, because two vendors can use the same word for different things.
| Licence metric | What is counted | Where the gap usually hides |
|---|---|---|
| Named user | People with access, whether or not they use it | Leavers and disabled accounts still assigned a licence |
| Device | Machines with the software installed or able to use it | Rebuilt devices counted twice; virtual desktops and shared machines |
| Core or processor | Physical cores on every host where the software can run | Virtual machines that can move to unlicensed hosts in the cluster |
| Concurrent user | Peak simultaneous use | No usage log to prove the peak you claim |
| SaaS subscription | Assigned seats for the billing term | Seats bought mid-term that cannot be reduced until renewal |
| Organisation-wide | All qualifying users or devices across the organisation | Acquired companies and contractors widening the qualifying count |
Timing matters as much as the count. In a Microsoft Enterprise Agreement, the annual true-up order must reach Microsoft between 60 and 30 days before the enrolment anniversary, and an update statement is still required when nothing has changed. Starting the audit about 120 days out leaves time to remove, reallocate and approve before the order is placed. Under a subscription enrolment, Microsoft allows subscription counts to go up or down once a year, so a reduction that misses the anniversary is paid for another twelve months.
Two dropdowns on the first task drive conditional logic. One shows the vendor audit response phase when a notice has arrived, the other shows the true-up tasks when an order is due within 120 days. A quiet internal review stays short.
The entitlement register and the effective licence position live in tables inside their tasks, so the second checker reviews rows, not attachments. A data set can hold each vendor’s products, metrics and agreement numbers and fill every new audit.
Contracts, discovery exports and removal records attach to the task they prove, and the activity trail shows who did each step and when. The purchase and settlement decisions are tasks assigned to the budget holder, so each approval sits beside its numbers.
CheckFlow’s recurring checklist software can start a yearly audit for each vendor on its own date, a few months before its true-up, and assign it to the software asset manager. Between audits, the monthly reclaim in the IT Asset Management Checklist and the renewal checks in the Monthly IT Maintenance Checklist keep the position from drifting.
Many per-user shortfalls begin as accounts nobody switched off. Leavers’ licences should come back on their last day through the Employee Offboarding Checklist, and disabled accounts that still hold a licence are caught by the Active Directory & Entra ID Account Cleanup Checklist. New applications enter the count through the New Software Implementation Checklist, which should record the contract and licence metric at go-live.
It is a comparison of what an organisation is entitled to use with what it has actually deployed, usually for one vendor or product family at a time. You can run it yourself, as a self-audit before a renewal or true-up, or the vendor or a firm acting for it can run it under the audit clause in your agreement. Either way the output is an effective licence position for each product: surplus, compliant or short.
It is the reconciled result of entitlement against deployment for each product, counted under that product’s licence metric and after its use rights are applied. A good ELP shows the quantity and value of every surplus and shortfall, the counting rules used and the evidence behind each entitlement, so someone else could reproduce it.
Do not ignore it, and do not send data straight away. Confirm the letter is genuine, read the audit clause to see what the vendor is actually entitled to, and name one point of contact. Agree scope, timetable and confidentiality in writing before any collection tool runs. Then build your own effective licence position in parallel, so you can test the auditor’s findings line by line instead of accepting them as given.
A true-up is a periodic order that brings a volume licence agreement into line with what you have added since the last count. In a Microsoft Enterprise Agreement it happens every year: the order is due between 60 and 30 days before the enrolment anniversary, and an update statement is required even if nothing has changed. A self-audit a few months earlier turns the true-up into a confirmation rather than a surprise.
A common pattern is once a year for the largest or most complex vendors, timed ahead of the true-up or renewal, and every two or three years for smaller ones. Audit sooner when something changes the count: an acquisition, a data centre move, a shift to cloud or a new virtualisation platform. Monthly reclaim and register checks keep the position close between audits.
No. ISO/IEC 19770-1:2017 specifies requirements for an IT asset management system: leadership and policy, core data management, licence management, internal audit and management review. It requires a licence management process but sets no counting rules for any vendor. Those come from your agreements and the vendor’s product terms, which is why this checklist records the metric and use rights for each product before comparing any numbers.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
