WINNING STRATEGIES TO BEAT AUDITS FROM 5 TOP VENDORS

Transcription

1 AN ESSENTIAL GUIDE WINNING STRATEGIES TO BEAT AUDITS FROM 5 TOP VENDORS HOW TO TURN THE TABLES ON AN AUDIT - FROM RISK TO OPPORTUNITY

2 Introduction Many software companies use audits as a source of additional revenue, squeezing customers to boost their bottom line. For vendors, audits have shifted from an occasional activity to a significant source of revenue. While they tend to be aligned with contract renewal dates, they can in fact occur at any time of year. In an audit, the side with the best data wins. How many software vendors audits have you responded to in the past year? No of audits % % had four or more audits in the past year % had three or more audits in the past year % had two or more audits in the past year % had one or more audits in the past year 19% had no audits in the past year With Snow research indicating 81% of organizations report one or more software vendor audits in the past year, don t be surprised if you receive an audit letter. Customers at risk of receiving an audit letter tend to fall into two categories: those that are confident they are compliant (but likely could be wrong) and those that suspect they are out of compliance but keep their heads in the sand, desperately hoping they can avoid an audit. Audits put customers in a curious position of strength or weakness, depending on their situation. On the one hand, as vendors seek out easy pickings to meet their audit revenue goals, some customers will face potentially costly penalties. Strongly-positioned customers, on the other hand, can renegotiate existing agreements as well as have leverage for new license purchases. In an audit, the vendor will rely on data showing what they think you owe. Without data of your own, you have no option than to accept their version of the truth. You need to develop your own accurate view of software deployment, configuration, licensing and usage. Instead of being forced to accept vendor audit data, you can counter with accurate data that clarifies any variance. To build this view, you need the right people, process and technology in place. Page / 1

3 HOW SOFTWARE ASSET MANAGEMENT DRIVES AUDIT COMPLIANCE AND COST SAVINGS This paper introduces how Software Asset Management (SAM) provides complete visibility of all hardware, software and cloud assets across your entire estate, reconciled against your entitlements and contracts. This ensures you are in the strongest position to support audit compliance as well as put you in position to automate license optimization, drive the best deal for your organization at time of contract and renewals and identify future cost savings. It will also highlight critical audit strategies when dealing with 5 top vendors. Not all software vendors follow the same audit practices and behaviors. Strategic goals and focus vary from one vendor to the next, including who gets audited and how audits are carried out. For each vendor, there are guidelines and tips on how to handle an audit or contract negotiation. Page / 2

4 PREPARATION IS KEY The ironic fact about audits is they can represent an opportunity, depending on the amount of preparation you have done. Since audits often coincide with renewal periods, customers with deep visibility into their software usage can often negotiate better pricing for new licenses or agreements as vendors are eager to close business. GET VISIBILITY OF YOUR ENTIRE ESTATE Difficulty in establishing visibility of software usage increasingly stems from a shift in technology purchase decisions from IT to business units. Snow calls this growing divide between what IT knows about software usage and what is actually happening the Disruption Gap. Business users can download unauthorized software to devices, create and use subscriptions to SaaS applications and use mobile devices that could violate licensing agreements. A complete SAM practice, as opposed to one-time inventory reports, enables visibility at an employee, system and entitlement level, empowering you to quickly create compliance reports, enable decision making with usage trend information and identify optimization opportunities. ESTABLISH COMPLIANCE Tackling compliance starts with reconciling software usage against entitlements within license contracts. A SAM solution automates this reconciliation. Providing IT and other stakeholders with actual usage reconciled against entitlements establishes a complete compliance position, including an Effective Licensing Position (ELP). LEVERAGE YOUR POSITION TO TAKE ADVANTAGE After establishing compliance based on complete visibility of software usage across cloud, datacenter, user systems, and mobile this same view can be used to identify opportunities to optimize and reduce costs, such as excess licenses, duplicate user accounts, and over-entitled users. Key to finding such optimizations is fine-grained usage information showing not just whether or not an employee uses an application but what specific components are utilized. But this preparation and visibility can be difficult to establish without specialized solutions that provide detailed usage patterns across datacenter, cloud and mobile. Page / 3

5 AUDIT TYPES, WHERE THEY COME FROM AND HOW TO TREAT THEM OPTIMIZATION ASSESSMENTS AND LICENSING REVIEWS Many vendors pursue an audit strategy that at first looks like an informal request for information. These requests often arrive as a generic, impersonal request for the customer to collect and report data or as an offer for an assessment or review. They are often written in a way that makes it sound like the vendor is offering a free or helpful service. The important thing to know is that these are still effectively audit requests. These audits are an attempt to find customers out of compliance. Once non-compliance is identified, the vendor will then submit an audit finding requesting payment or may use the finding as leverage to get customers to purchase new product offerings from the vendor. AUDIT, THE FIVE LETTER WORD THAT MAKES YOU SAY FOUR LETTER WORDS In contrast to these informal audits, a true audit is nearly always a bad thing. Even if you are sure your organization is compliant, the timeconsuming effort and number of cross-functional employees that need to be part of the audit makes them expensive. Audits arise for several reasons. These include disgruntled or former employees sending a complaint via the BSA, your organization discontinuing maintenance on a large enterprise agreement or your organization completing a merger or acquisition that shines a target for compliance risk. While it is best to respond to these requests, it can be a double-edged sword. Respond and invite the vendor in, and they may find your organization is out of compliance. Don t respond, and you may find your organization is quickly in line for a true audit. These official audit requests must be responded to. Failure to do so could bring legal and financial damages that would only compound the result of the audit itself. If audited, you should immediately notify your legal and procurement leadership, your CIO and the executive board and begin the appropriate steps in preparing for the audit. Page / 4

6 MICROSOFT STRATEGIES TO DEAL WITH 5 TOP VENDORS Page / 5 FOR FURTHER SUPPORT, READ THE EBOOK: FIVE WAYS TO CUT SPENDING ON MICROSOFT SOFTWARE Microsoft employs two distinct methods for identifying unauthorized use of their products, a Review and an Audit. Some smaller organizations have also seen third-party communications asking them to self-certify their Effective Licensing Position. A Microsoft Review, or Software Asset Management Review offers greater flexibility and non-compliance can often be resolved by purchasing new technologies such as cloud platforms. Just because a Microsoft Review is a more lenient process does NOT mean you should ignore it. Although response is not a legal requirement, ignoring a Microsoft Review could bring about a full audit. It does, however, mean that you can request additional time to prepare for the Review and can leverage a Microsoft Certified Partner, like your reseller, to help you. Your reseller is especially important in helping reconcile what you have deployed against your Microsoft contracts. The actual review takes place once the data has been pulled to reconcile your deployment versus your entitlement. Microsoft will review your agreements and ask you to provide information on a License Verification Worksheet by a set date. Once you send that back, they will send you an estimated license ownership position within several days. This is where the trading begins. At the conclusion of the Microsoft Review, there are often offers to: 1. True-up to pay the difference in what you use versus what you have purchased 2. Move into the latest version of Microsoft technology, such as Cloud or Office Move onto the latest version of the same platform/ software suite at a discounted cost. A Microsoft Audit is very different. Microsoft Audits are conducted by a third-party audit company and you are legally obliged to comply. As with the Review, you should acknowledge the audit request. Microsoft understands business activities can impact your ability to respond quickly so valid business reasons for requesting more time are often accommodated. Microsoft will specify what they are auditing, be it a specific business entity, a certain contract or the whole estate. You will need the help and support of a Microsoft Certified Partner or an independent Microsoft licensing expert or SAM consultant. Even if your organization has a Microsoft Licensing expert, the manual process required to comply with the audit is time consuming and prone to costly errors. Audits can take a lot of time. Anywhere from three to 18 months can be spent on data gathering, evaluation of licensing entitlements and interviews. This effort is one of the main factors that make audits so expensive. Another is how audits are concluded. At the conclusion of an audit, you must pay list price for any non-compliant software on top of a settlement fee. The cost of the auditor is part of the penalty so an auditor that is a Microsoft SAM partner as opposed to an LLCdriven auditor will likely be less. Some key tips for Microsoft Reviews and Audits: 1. Do not ignore either request. A friendly Review letter that is ignored will often be followed by a not-so-friendly (and more expensive) Audit letter. 2. Do request an extension (maximum six months), giving yourself time prepare properly. 3. Do not purchase licenses in an effort to make up a compliance gap, this does not count toward audit results anyway. 4. Do engage with a Microsoft Certified SAM Partner to help you through the process. Remember that in an audit the side with the best data wins. If you have no data, you have no alternative but to accept the report from Microsoft or the auditor. A robust SAM solution will provide you with the accurate data ahead of either a Review or an Audit, arming you with the data you need to win.

7 ORACLE STRATEGIES TO DEAL WITH 5 TOP VENDORS FOR FURTHER SUPPORT, READ THE EBOOK: FIVE WAYS TO CUT SPENDING ON ORACLE DATABASES Oracle compliance can be complex, with multiple licensing metrics and variations depending how software is deployed. With this complexity, many customers choose an Oracle Unlimited License Agreement (ULA) in which an enterprise pays a single up-front fee to get as many licenses as they want for a specified set of Oracle products over a fixed time frame. These customers trade off simplicity for cost, avoiding complex and time-consuming license tracking that carries little guarantee of accuracy. Understanding even a few Oracle applications requires extensive training. With a typical enterprise utilizing dozens or scores of Oracle products, training staff to manage them all becomes untenable. Complexity extends to Oracle licensing metrics that range from per processor to proprietary definitions such as Named User Plus. Key recommendations to get visibility and control of your Oracle licensing: 1. Get an approved list of Oracle software products. 2. Identify which editions of Oracle you are using and why 3. Determine what comes bundled with these editions and what options are you using. Are they free or charge or limited use? 4. Identify which version of Oracle applications and Oracle Database you are using. Oracle deployment choices have licensing implications. For example, Oracle is very strict in the use of virtualization. Oracle s Supported Virtualization and Partitioning Technologies for Oracle Database and RAC Product Releases lists supported partitioning technologies. Oracle Partitioning Policy also sets strict rules determining the number of processor licenses required for a server. Be careful when asking Oracle to resolve questions around deployment as they may use such queries as the basis for a non-compliant audit result. Your choice of cloud provider could have a significant financial impact as Oracle charges different rates for depending on whether their products are deployed on Oracle s cloud solution or competing products such as Amazon Web Services (AWS). Specifically, a January 2017 licensing change says an AWS virtual CPU is now treated as a full core if hyperthreading is not enabled. A user renting two AWS vcpus therefore needs to pay for both, effectively doubling not only the number of Oracle licences required to run Oracle in AWS, but the cost as well. Key Oracle questions to answer if faced with an audit: 1. Are you using virtualization? How is it deployed? Virtualization greatly affects your deployment requirements and restrictions. Be careful you are not inadvertently overprovisioning. 2. Are you using Oracle in the cloud? Oracle is very interested in promoting use of their cloud platforms. They will target non-oracle cloud deployments in their audits and then leverage audit findings to pressure customers to shift the Oracle cloud. 3. Do you have Oracle based disaster recovery (DR)? DR environments must be fully licensed even if they are passive (i.e. the software is installed on the DR site but not running). Furthermore, simply testing a DR scenario requires the DR site to be licensed. Many customers expect their environment to be covered by the 10-day rule but this rule only applies when you have multiple server nodes connected to the same single storage array (i.e. Active/Passive Failover). Page / 6

8 SAP Like other large vendors, SAP often use audits as an opportunity to pressure customers to shift to new products. They will allow organizations to forego audit fees or true-ups if they purchase new products, especially strategically important ones like S/4 HANA. STRATEGIES TO DEAL WITH 5 TOP VENDORS If you ve recently received an audit letter, don t panic! Unlike most other vendors, SAP will give you adequate time to carry out changes and optimize your licenses before submitting the data requested by them. Even with this time allowance, manually gathering SAP data is highly time-consuming and inaccurate and will probably not enable you to defend your license position nor enable cost-optimization. Another option is use of an SAP-specific SAM product such as Snow Optimizer for SAP Software, an SAP native solution that enables data collation in days as opposed to weeks or months if done manually. Being well-prepared for an SAP contract renewal or audit pays significant dividends. Some of the key elements of this preparation involve uncovering the most value from unused licenses. The steps include: 1. Calculating the initial software asset value 2. Freeing up inactive user licenses 3. Rightsizing user licenses 4. Converting the unused licenses into credit. FOR FURTHER SUPPORT, READ THE EBOOK: FIVE WAYS TO REDUCE SAP LICENSING COSTS These activities are hugely accelerated by Snow Optimizer for SAP Software. Cashing in shelfware and transforming it into valuable assets provides an additional benefit in the form of optimized runtime licenses and removal of maintenance costs for unused software. Page / 7

9 IBM STRATEGIES TO DEAL WITH 5 TOP VENDORS FOR FURTHER SUPPORT, READ THE EBOOK: FIVE WAYS TO SAVE ON IBM SOFTWARE IBM aims to audit its customers every three to five years. Audits often coincide with the end of an Enterprise Licensing Agreement. If you think it s your turn soon, now is the time to get your estate in order. IBM AUDIT TIPS Audits can be an opportunity to renegotiate your license contract. IBM is heavily scrutinized by financial analysts and new product revenue looks a lot better than audit revenue. Use this to your advantage to negotiate trades of new licensing in lieu of audit revenue. IBM compliance managers often trading non-compliance threats for cloud purchases. When IBM acquires companies, it often modifies licensing rules and then audit customers based on these new rules. IBMhas a contract clause that customers are responsible for checking release notes on the IBM website to assess if licensing changes apply to the customer s environment. Get ahead of the game. Customers under audit should take as many proactive steps as possible to review their estate and track down issues that might be brought up by auditors. Take the audit at your own pace. It is in the interest of the auditors and IBM to complete an audit quickly but such a race against the clock is not necessarily in your best interest. Optimize the sub-capacity environment. For example, adding a new virtual machine to a fully licensed environment can be carried out without the need for additional licenses. Use the following steps when reviewing your IBM license estate: 1. Identify and evaluate all entitlements as this will guide your deployment strategy. Look for non-standard items such as contracts requiring licensing of warm-standby systems. 2. Identify all PVU-based products across your estate and ensure that ILMT agents are installed and reporting correctly. Ensure you are running the most current version of ILMT or sub-capacity licensing may be disallowed. 3. Ensure that you understand how Software Subscription and Support might affect your liability when upgrading previously retired products. 4. Understand the state hot, warm, cold of all servers running IBM products. Concessions can be made for cold backup servers. Page / 8

10 STRATEGIES TO DEAL WITH 5 TOP VENDORS VMWARE VMware product families include vsphere, vcenter, vrealize, and Horizon Suite, as well as the Fusion product family. VMware applications use multiple license metrics, including per-device, per-user, per virtual machine, perprocessor and per portable unit. The complexities of the license models and the virtual environment make it difficult to get visibility into cost structure, complicating management and rendering optimization efforts untenable. Not surprisingly, many organizations struggle to effectively manage their VMware licenses and investments. VMware license model complexity also creates complex, lengthy audits. VMware focuses on understanding where and how its customers use VMware software, especially for vcenters, and ESX/ ESXi hosts. Often within organizations, a disconnect occurs between server administrators and the Software Asset Management team. For example, if a server administrator increases resources to resolve performance issues without informing the procurement or SAM team, the impact on licensing may be overlooked. When VMWare audits coincide with renewal periods, customers can be in an advantageous position to negotiate a better software agreement or license deal as VMware sales teams are heavily incentivized to meet year-end targets. A SAM solution identifies all installs of VMware products, addresses any under-licensing or over-licensing risks, and gives insight into usage of VMware products. It also provides information that can be used by SAM administrators to be clearer on the financial consequences of their actions (such as increasing resourcing to resolve performance issues). Detailed usage stats empower customers to identify instances of unused software for the VMware products licensed per user, device, or virtual machine. The information enables you to ensure that all vcenters and ESX/ ESXi hosts have the right number of processor licenses. This intelligence from a complete SAM solution puts you in the best possible shape to drive a better deal with the vendor. Page / 9

11 WHEN SHOULD I LOOK OUT FOR AUDITS? You need to accept that a software audit can come at any time. There are however, some events that cause a vendor to step up audit activity. When companies launch new products they often leverage audits to pressure customers to shift to the new product lines (S/4 HANA as a prime example). Another example occurs when a company shifts from perpetual licensing to a subscription-based model and when companies shift to SaaS delivery models. WHAT SHOULD I DO FIRST WHEN I GET AUDITED? Most importantly, do not do anything that could have legal repercussions or gives the impression you have tried to manipulate the results of an audit. Do not delete instances of the software in question from numerous machines that you believe may be out of compliance. If an audit is resolved in court even the semblance of impropriety could be costly. HOW CAN I AVOID A MASSIVE AUDIT COMPLIANCE FINDING? If you think an audit is about finding the truth, you are mistaken they are about winning and losing. Vendors want to prove you owe them, and you want to prove that you don t. If you have a robust SAM solution that can create an accurate picture of what you are really using then you have taken the first step in winning. Not only will this data support you in the audit, if you find your organization has overbought, you have the upper hand for renegotiation of new software licensing. Remember, a software vendor is auditing because they have a legal right to do so and a fiduciary duty to protect their technology from unauthorized use. You needn t see them as the bad guy in an audit nor do you have to accept audit results will be bad. When presented with data that shows overspend, they understand the relationship with you is based on trust, trade-offs and negotiation. Q & A AUDIT AND CONTRACT NEGOTIATION Q&A Page / 1 0

12 CONCLUSION PREPARATION IS KEY When managing vendor software, audits or contract negotiations, make sure you have the support of a robust SAM practice that can give you an accurate representation of software usage to counter the view provided by the vendor. VISIBILITY ACROSS THE ENTIRE ESTATE IS REQUIRED Individual reporting by each department and site in your estate can lead to inaccurate and incomplete data. A comprehensive solution that can discover and normalize data across all locations and devices, whether desktop, datacenter, mobile or cloud is required. A SINGLE SOURCE OF TRUTH IS THE DIFFERENCE Remember that in an audit, the side with the best data wins. With no data or poorly cobbled together spreadsheets, you will be at a disadvantage in countering the vendor. Effective Software Asset Management gives the power back to you, with accurate visibility across the entire estate for deployment, configuration, licensing and usage. Time to act CONTACT SNOW TODAY TO FIND OUT HOW TO AVOID POTENTIALLY DAMAGING AUDIT RESULTS. If you are fortunate enough not to be facing a software vendor audit currently, now is the ideal time to identify and address risks. An audit letter could land on your desk at any point. Do not wait until that moment to act. Page / 11

13 Copyright 2017 Snow Software AB, All Rights Reserved (1)