Audits look random from the inside. They are not. Vendors run audit programmes as revenue operations, and the accounts they select share a small number of characteristics.
Knowing the software audit triggers will not make you immune. It will tell you which quarter to be ready for, which is most of the benefit.
The pattern behind selection
An audit costs the vendor money and burns goodwill with a customer. They run it when the expected recovery justifies both, which means they are looking for accounts where a shortfall is likely and where the commercial relationship is already going the wrong way.
Put another way: audits are aimed at customers who are spending less than they used to, or are about to.
The triggers most often reported
Your spend went down
The clearest one. You cut seats at renewal, dropped a module, or let a product lapse. Revenue that was forecast has gone missing, and an audit is the fastest way to look for it somewhere else in your estate.
This catches people out because the cut was legitimate. You genuinely stopped using the thing. The audit is not a punishment for that, it is an attempt to recover the number.
You declined a migration
Particularly to cloud. If the vendor’s strategy is moving customers onto a hosted product and you said no, you have become an account that needs a different route to the same revenue. Refusing a migration is one of the most consistently reported triggers there is.
Your agreement is expiring
Timing here is not coincidental. An audit finding that lands during a renewal negotiation is worth far more to the vendor than the same finding six months later, because the shortfall can be folded into a bigger forward commitment instead of settled in cash.
If you receive a notification within a couple of quarters of a major renewal, assume the two are related and plan the negotiation as one conversation rather than two.
You merged, acquired, or divested
M&A creates genuine licensing complexity, and vendors know it. Most agreements restrict transferring licences to a new legal entity, and most integrations move software around long before anyone reads that clause. Divestitures are worse, because entitlements rarely split cleanly.
You told them something
The underrated one. Headcount announcements, a press release about a new data centre, a case study naming your architecture, a conference talk by one of your engineers, a job posting listing the exact versions you run. All of it is public, and all of it is read.
Two things that raise your exposure quietly
Virtualisation. The gap between the hardware a product runs on and the hardware it could theoretically run on is where a great many claims live. Policies here are frequently not contractual, which is a fight worth having but a fight nonetheless.
Vendor-side changes you did not notice. Licensing metrics change. Products get repackaged, editions get merged, a metric moves from installs to employees. Your deployment did not move, but the ruler did.
That last one is the reason we track vendor changes at CopperFeed. A pricing or packaging change you missed is an entitlement change you cannot see in your own inventory, and it will surface at the worst possible moment. Related: Legacy Plan Sunsets.
What to do with this
Not paranoia. Timing.
- Assume the quarter after any significant cut is your risky one. Do the internal reconciliation then, while nobody is asking for it.
- Reconcile before a renewal, not during. Knowing your own position ahead of the conversation is the whole game, and it is much cheaper before there is a claim on the table.
- Treat M&A as a licensing project. It will not be on anyone’s integration checklist, and it should be.
- Keep a file of what changed. Dated notes on metric changes, repackaging and tier retirements for your major vendors. When an auditor asserts your entitlement means something different from what you understood, that file is the argument.
If a notification has already arrived, the mechanics are in Software License Audits: Why You Got Picked and What Happens Next. Oracle works differently enough to warrant its own page: Oracle License Audits.
Triggers here are drawn from published practitioner and consultancy accounts rather than from vendor disclosure, since no vendor publishes its selection criteria. Treat them as informed pattern-matching. General guidance, not legal advice.