Compliance – Part 1: Software Licensing

Compliance, is rarely fun, more the very the essence of red tape. But ignore it and the consequences can range from a, sometimes public, ticking off to corporate manslaughter charges. In future posts I’ll point out some useful resources to soothe the pain of tax, employment, health and safety and data protection compliance. I’ll kick things off though with some thoughts on software licensing. Although you won’t be bothered by government checking you’re behaving, the software industry tries hard to be more than scary enough.

As previously noted round here in a recent survey the FAST IiS Software Industry Research Board claimed 43% of organisations do not perceive a risk from a lack of compliance. I distrust surveys commissioned by Industry lobby / enforcements groups; nonetheless my experience suggests this figure is far higher amongst small businesses. With so much else to do tracking software licences is not high up the list.

What stands out amongst the hazards of piracy that FAST IiS are keen to publicise is their claim that that 55% of the companies surveyed in the last year were subject to a software publisher audit, a less awful sounding phrase than I suspect, the reality.

None of my SME customers have suffered that fate. If the figure is correct, the perhaps enforcers ignore the small fry. Well over half the businesses, including the self employed, in the UK are by any standards 'small' with less than a £100K turnover(1). If 55% of companies were 'audited' in the last year has have most larger companies been frisked? Perhaps it is more likely the figure does not reflect of reality.

Even laying morals aside, not that I'm suggesting one should, do not assume you are safe. Whistleblowers are after all protected by law, it only takes one to cry foul. Then consider how many applications phone home when installed and updated. How many of them are sending a hash of the applications license key from your IP address?

Amongst the dangers of piracy / license breaches, IiS FAST also quite reasonably highlight the risk of over purchasing. I frequently see it happen, typically because nobody has any idea where a licence is installed, or more commonly have simply mislaid the CDs and/or licence key. And regularly see money wasted because licences terms allowing more than one install are overlooked.

Carefully check the terms, stick those plus details of what you have and where it is installed in a spreadsheet linked to numbers written on the physical boxes of software and any licence documents. Keep everything in one place. Include a hardcopy of the spreadsheet plus copies of receipts for the software (auditors like receipts). The hard bit of course is keeping this up to date, but who said finding time for admin was easy?

When software is purchased online you end up with an installer file, licence key and receipt. Save each key in its own file plus a digital copy of the receipt, along with the downloaded installer. Stick them all in a single directory. Back that up to an optical disk. Put that in the cupboard with the rest of the software along with hard copies of the licence keys and receipts.

Make it clear employees should never install software, free or otherwise without permission.

Larger businesses demand automated software audit tools that track of exactly what each machine is running. But for smaller businesses with less than dozen PC’s all that’s needed is some simple old fashioned filling. Well, given today’s spreadsheet is over 30, arguably 40, years old, for IT that is positively archaic.


(1) Office for National Statistics [UK], UK Business: Activity, Size and Location 2008. TABLE B5.1