For London SMEs, software licence compliance is one of the least visible costs of running a business and one of the most exposed. Most organisations hold licences for desktop applications, cloud subscriptions and line-of-business systems, yet few maintain a register that matches what is installed, assigned and paid for. When a vendor requests an audit, any gap between entitlement and usage becomes a financial exposure, often in the form of back-dated charges. This guide explains where audit risk originates, how to reduce both penalties and wasted spend, and which controls a business can run without adding internal headcount.
Table of Contents
- Quick Takeaways
- What Licence Compliance Means for an SME
- The Real Cost of Non-Compliance
- Building an Accurate Licence Register
- Managing Cloud and Subscription Licences
- Choosing a Licence Management Approach
- Responding to Audits and Reducing Waste
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Keep the contract as the source of truth | Licence rights are defined by the agreement, not the invoice. Store the signed contract and order form for every product in one shared location. |
| Register every entitlement | Record the vendor, edition, licence model, quantity, assigned user or device, renewal date and internal owner for each product. |
| Reconcile before the vendor does | Discrepancies found internally can be corrected on your timetable. Discrepancies found in an audit are typically billed as retrospective charges. |
| Review cloud seats monthly | Microsoft 365 and similar tenants can keep paid seats assigned to inactive or departed accounts. Remove or reassign them as part of joiner, mover and leaver steps. |
| Calendar notice dates, not only renewals | Many contracts require notice before a renewal to change quantities or tiers. Missing that window usually commits the business to existing terms. |
| Assign one accountable owner | Shared responsibility for licences generally results in no one reconciling the register. Name a single owner who reports to a director. |
What Licence Compliance Means for an SME
Software licence compliance means that every installed or accessed software product is covered by a valid entitlement, and that the entitlement’s terms, such as user count, device scope and permitted use, are followed. A licence grants a right to use software. It does not confer ownership. This distinction matters in an audit because the vendor’s contract defines what is permitted.
One published guide on software licence compliance sets out four main licence types, and the reconciliation method differs for each. For most SMEs, the practical categories are per-user, per-device, subscription and volume or site licences. Each needs its own register entry and its own check.
A licence that cannot be matched to a named user, device or installation count is a liability until it is proven otherwise.
The Real Cost of Non-Compliance
The financial impact of poor licence management usually appears in two forms. The first is a retrospective charge, where an audit identifies more installations or users than the entitlements cover. The second is a quieter loss, where the business pays for licences it does not use. Both reduce margin, and neither is visible in routine IT operations.
Retrospective true-up charges
When a vendor identifies unlicensed use, the usual outcome is a true-up invoice for the missing entitlements, sometimes with additional fees set out in the contract. The terms vary by agreement, which is why the contract should be read before any audit notice arrives. A business that can show a documented position negotiates from a stronger footing than one reconstructing usage under time pressure.
Pro tip: Store the signed contract, order form and purchase invoice for each product in one shared location with a named owner. Audit responses are slowed more by missing paperwork than by any technical gap.
Shelfware and duplicate subscriptions
Shelfware refers to licences that are paid for but not used. In SMEs it commonly builds up when staff leave without licences being reassigned, when trial subscriptions convert to paid plans, or when two teams buy the same tool separately. Each item may be small, but across a year of renewals the total often exceeds the cost of a structured review.
Building an Accurate Licence Register
A licence register is the single record that links each entitlement to a product, a quantity, a holder and a renewal date. Without one, compliance depends on memory and on vendor portals, which rarely agree with each other. A spreadsheet is a workable starting point for a small estate, provided it is maintained on a set schedule.
Fields every register should hold
At a minimum, the register should record the vendor, product and edition, licence model, quantity purchased, assigned users or devices, purchase and renewal dates, notice periods and the internal owner. Each entry should reference the contract document rather than restate its terms, so that the agreement remains the authority.
Reconciling the register against installed software
Reconciliation compares the register with what is actually installed or accessed. In Windows and Microsoft 365 environments, device management and tenant reporting can supply the installed and assigned data. Discrepancies should be logged, classified as over-licensed or under-licensed, and corrected within a defined period. A common mistake is to reconcile once at purchase and never again.
Managing Cloud and Subscription Licences
Cloud subscriptions have changed the compliance question. Licences are assigned to user accounts within a tenant rather than installed on a single machine, and most renew automatically. Microsoft 365 is the most common example among London SMEs, and its assignment model means that inactive accounts can continue to consume paid seats.
Assigned licences for inactive accounts
A practical control is a monthly review of accounts that have not signed in for an agreed period, followed by removal or reassignment of their licences. Joiner, mover and leaver procedures should include licence changes as a standard step. A managed IT provider can carry this routine work, but the business remains responsible for the decision.
Tiered plans and feature entitlements
Subscription tiers differ in included features. Moving an entire organisation to a higher tier to serve a few users is a frequent source of avoidable cost. Assigning plans by role, rather than by default, typically reduces spend while keeping compliance intact, provided each change is recorded in the register at the time it is made.
Choosing a Licence Management Approach
Three approaches are common among London SMEs. Each can work, but each carries different demands on time, expertise and ongoing accountability.
| Approach | Best suited to | Main limitation |
|---|---|---|
| Manual spreadsheet register | Small estates with one clear owner and few cloud tenants | Becomes unreliable as users, devices and subscriptions grow, and depends on consistent manual updates |
| Dedicated software asset management tool | Businesses with many devices and applications that need automated discovery | Requires configuration, ongoing administration and someone to interpret the findings |
| Managed IT service with scheduled licence reviews | SMEs that want the register maintained, reconciled and reported without building the capability in-house | The business must define scope clearly in the service agreement and retain decision rights |
In practice, a spreadsheet works while the estate is small and one person owns it. A dedicated tool becomes worthwhile when reconciliation no longer fits into a monthly routine. Outsourcing suits businesses that need the work carried out consistently. iTO.London provides a virtual IT department that includes cloud subscription management and quarterly technology reviews, which is a practical place to hold licence reconciliation as part of managed IT support.
Pro tip: Whichever approach is chosen, agree in advance who approves licence purchases. Much unplanned licence spend originates from purchases made outside the approval process.
Responding to Audits and Reducing Waste
An audit notice should be treated as a formal contractual matter. The first step is to read the audit clause in the relevant agreement, confirm the scope and timetable, and name the person who will coordinate the response. Information requests should be answered accurately and in writing. Reconciliation figures should not be shared until they have been checked internally.
Responding to an audit notice
Accurate records shorten this process considerably. Where discrepancies exist, a documented position with a clear remediation plan is generally more productive than contesting findings without evidence. Legal advice is appropriate where contract terms are unclear or the claimed shortfall is significant.
Running a quarterly licence review
A quarterly review keeps the register current and surfaces waste before renewal dates. It should cover unassigned licences, duplicate tools, upcoming notice periods and any product that no longer supports a business process. Findings are most useful when summarised for the business owner on a single page with recommended actions.
Pro tip: Calendar each contractual notice date as well as the renewal date. Notice windows determine whether quantities or tiers can still be changed, and a missed deadline is rarely reversible until the next term.
Frequently Asked Questions
How often should a London SME review its software licences?
Cloud subscriptions warrant a quarterly review, with assignments checked as part of every joiner, mover and leaver event. On-premises products can be reconciled at least annually, with an additional check before each contractual notice date.
Does a software audit always result in a fine?
No. Under-licensed use is usually settled through a true-up invoice, and any additional fees depend on the terms of the agreement. Accurate records are the most significant factor in limiting the outcome.
What is the difference between software asset management and licence compliance?
Software asset management is the wider discipline of tracking and governing software across its lifecycle, including purchasing, deployment and retirement. Licence compliance is the part that confirms actual use matches the entitlements held.
Can a managed IT provider take responsibility for licence compliance?
A provider can maintain the register, run reconciliations and report findings. The business remains responsible for purchasing decisions and contract commitments, so the scope of the service should be defined in writing.
Is a spreadsheet enough for a small business?
For a small estate with a single owner, a spreadsheet is sufficient if it is reviewed on a fixed schedule and linked to the contract records. It becomes unreliable as the number of users, devices and cloud tenants increases.
We welcome feedback from readers who have managed a licence audit or reduced licence spend, and we would value hearing which steps proved most useful in practice.
We would love your feedback and any insights you would share with others. What perspective would you add?