Home/PE Portfolio Software/Portfolio Audit Risk
PE Portfolio Software

Portfolio wide audit risk management.

Treat software audit exposure as a fund level risk to monitor and reduce, not a fire to fight one letter at a time.

Portfolio wide audit risk management is the practice of treating software audit exposure as a fund level risk to be monitored and reduced across every company, rather than a fire to be fought one letter at a time. Publishers run audit programmes continuously. A fund that owns ten or twenty companies is, in aggregate, almost always under audit somewhere, and managing that exposure centrally is far cheaper than reacting to each demand in isolation.

The major audit risks come from a known set of publishers: Oracle, SAP, Microsoft and IBM, and increasingly Broadcom for VMware, Salesforce and ServiceNow. Because the risk concentrates in these names, a fund can manage most of its exposure by focusing attention where the claims actually come from, rather than spreading effort evenly across every vendor.

How portfolio wide audit risk management works

The foundation is a shared register of audit posture across the portfolio. For each company and each major publisher it records the effective license position, the date of the last audit, the renewal date, and the size of any known compliance gap. With that register, a fund can see where exposure is concentrated, which companies are overdue for publisher attention, and where a small remediation now avoids a large settlement later.

The second element is readiness. An audit is far cheaper to settle when the company already holds a clean, current reconciliation of deployment against entitlement. Portfolios that maintain that baseline respond to an audit letter with data rather than panic, which shortens the process and lowers the settlement. The third element is response coordination. When the same publisher audits two portfolio companies, a coordinated response shares the analysis, presents a consistent position, and prevents the publisher playing one company against another.

Where portfolio audit risk concentratesIllustrative share of total portfolio audit exposure by publisher, showing concentration in a small set of vendors.Share of portfolio audit exposure by publisher (illustrative)Oracle28%SAP24%Microsoft18%IBM12%Broadcom for VMware10%Others8%
Illustrative share of total portfolio audit exposure by publisher, showing concentration in a small set of vendors.

Why central management beats company by company response

Audits handled in isolation are expensive in three ways. Each company rebuilds the same analysis from scratch. Each negotiates alone, without the leverage of the wider relationship. And each settles on its own terms, so the fund never builds a consistent position with a publisher it deals with many times over. Central management fixes all three. It reuses analysis, it brings the weight of the portfolio relationship, and it sets a posture the publisher learns to expect.

The economics are compelling because the downside is large. Inherited and disputed licensing has produced claims into the hundreds of millions at group scale, with SAP pursuing AB InBev for a reported 600 million dollars as reported in 2017. Mid market claims are smaller, but a single unmanaged audit can still erase a year of a company savings plan. Managing the risk before the letter arrives is the cheapest point to act.

The portfolio audit posture register and what each field drives
FieldWhat it recordsDecision it supports
Effective license positionDeployed usage vs entitlementRemediation priority
Last audit dateWhen the publisher last reviewedLikelihood of being targeted
Known compliance gapSize of any shortfallReserve and remediation budget
Renewal dateNext negotiation windowTiming of true up resolution
Response ownerWho coordinates the responseSpeed and consistency

Key takeaways

  • A fund of many companies is almost always under audit somewhere, so the risk is best managed centrally.
  • Audit risk concentrates in Oracle, SAP, Microsoft, IBM and increasingly Broadcom for VMware.
  • A shared audit posture register shows where exposure sits and where to remediate first.
  • Readiness, a clean current reconciliation, turns an audit response from panic into data.
  • Coordinated response prevents a publisher playing one portfolio company against another.

Recommendations for buyers

  1. Build a portfolio audit posture register covering every company and every major publisher.
  2. Maintain a current deployment versus entitlement reconciliation so any company can answer an audit with data.
  3. Prioritise remediation by exposure size, starting with Oracle and SAP.
  4. Coordinate responses when the same publisher audits more than one company.
  5. Resolve known gaps at renewal, the cheapest window, rather than waiting for a letter.

Managing the risk before the letter arrives

Portfolio wide audit risk management moves the fund from reaction to control, and the cheapest point to act is always before the audit letter lands. For the full approach see the PE portfolio software advisory hub and the PE portfolio advisory service. Related reading includes repeatable software diligence across a portfolio, vendor management across a PE portfolio, and software governance for PE portfolio companies. Legal interpretation of any audit clause or claim should come from your own counsel. This is commercial and licensing advisory, not legal advice.

Reading the signals that a publisher is about to audit

Audits are rarely random. They follow signals a fund can learn to read. A renewal negotiation that stalls, a refusal to expand a contract, a sudden interest in a company growth or its virtualisation, an acquisition that changes the corporate structure, all of these raise the probability that a publisher moves from selling to auditing. Change of control is itself a classic trigger, because a transaction gives the publisher both a reason to look and a counterparty with fresh capital. A fund that tracks these signals across its portfolio can often see an audit coming and remediate before the letter arrives, when remediation is cheapest.

The publishers also differ in how they operate. Oracle and SAP run formal audit programmes with defined cycles and tend to pursue large structured claims, often around virtualisation and indirect access respectively. Microsoft frequently works through softer reviews that can still escalate. IBM sub capacity terms create exposure where monitoring was not maintained. Broadcom, since taking over VMware, changed licensing in ways that have unsettled long standing deployments. Knowing each publisher posture lets a fund focus its readiness where the risk is real rather than spreading effort evenly.

Turning a register into a remediation programme

A register that simply records exposure is a watch list. The value comes from turning it into a prioritised remediation programme. For each material gap the fund decides whether to remediate now by truing up at a controlled renewal, to remediate by reducing deployment to match entitlement, or to hold and monitor where the exposure is small and the audit probability low. Each decision carries a cost and a timeline, and together they form a programme the operating team executes across the portfolio rather than a list the deal team worries about.

The cheapest remediation is almost always at renewal, because that is when the company has something the publisher wants and can trade a true up against a broader commitment. Waiting for an audit forfeits that leverage. By the time a formal audit is underway the publisher holds the initiative, the company is negotiating from a deficit, and the settlement reflects it. The whole point of portfolio wide management is to resolve exposure on the company schedule, at renewal, rather than on the publisher schedule, under audit.

Coordination across companies sharpens every part of this. Shared analysis means the second company audited by a given publisher benefits from the work done for the first. A consistent fund posture means the publisher learns what to expect and stops testing each company in isolation. And a single relationship view means the fund can trade across companies, settling one exposure in the context of a renewal at another, in ways that isolated companies never could.

The cost of doing nothing

The case for portfolio wide audit risk management is ultimately a comparison of two costs. Maintaining a register and a current reconciliation across the portfolio is a modest, predictable annual cost. An unmanaged audit is an unpredictable, potentially large one that arrives at the worst time, often during a renewal or a sale, with the publisher holding the initiative. The asymmetry is the point. A small known cost buys protection against a large unknown one, and it does so while also creating the leverage to resolve exposure cheaply at renewal.

The disputes that reach public record, such as SAP pursuing AB InBev for a reported 600 million dollars as reported in 2017, sit at the extreme end of the scale, but they illustrate the direction of the risk. Mid market exposures are smaller in absolute terms yet often larger relative to the company that has to absorb them, which is why managing them centrally, before the letter arrives, is the prudent default.

Frequently asked questions

What is portfolio wide audit risk management?
It is managing software audit exposure as a fund level risk across every company, using a shared register, maintained readiness and coordinated response, rather than fighting each audit in isolation.
Which publishers should a fund watch most closely?
Oracle, SAP, Microsoft and IBM have driven the largest claims, with Broadcom for VMware, Salesforce and ServiceNow increasingly active. Audit risk concentrates in this set, so attention should too.
How does readiness lower an audit settlement?
A company that already holds a clean, current reconciliation of deployment against entitlement responds with data instead of scrambling, which shortens the audit and reduces the settlement.
Why coordinate audit responses across companies?
When the same publisher audits two portfolio companies, coordination reuses the analysis, presents a consistent position, and stops the publisher playing one company against another.
How large can an unmanaged audit get?
At group scale, very large. SAP pursued AB InBev for a reported 600 million dollars as reported in 2017. Mid market claims are smaller but can still erase a year of a company savings plan.

Get ahead of the next audit letter

Book a confidential software M&A risk assessment and we will map audit exposure across your portfolio before a publisher does.

Book a confidential call