Expert: Don Sadler - 7/13/2005

Question
Hello,

I hope you can help me. I am looking for information on electronic auditing of software which calculates the number of users at a particular time.

I can't find anything on the net about it! I would like to know what products are required for the audit and the practical issues which arise from carrying out the audit, ie: does it disrupt the software being used by a user at that particular time? I am not sure whether or not it is fairly new and this is why I have been unable to find anything related.

If you can please offer me any info, or referral to a website where I may gain info it would be much appreciated!

Thanks for your time

OAH
Researcher  

Answer
Ommera,

I wanted to also refer you to this Google search that may give you some useful leads.

http://www.google.com/search?as_q=metering+software+&num=100&hl=en&btnG=Google+S...


Best regards,

Don


===========================================

Ommera

I presume you are talking about auditing in the context of validating the accuracy of software metering.  Metering means counting the number of simultaneous users for the purpose of staying within whatever licensing restrictions you may have.

If so, I am unable to offer any insight.  Typically, the issue that auditors encounter is simply whether or not such metering is being done.  If there is no metering, you certainly have a finding and an exposure.

Some versions of S/W have built-in metering such that when installed, it either asks for the number of licenses or that information is already built in and it will not allow simultaneous usage to exceed that number.  In other cases, it will not enforce the license but merely report to the Administrator that actual usage exceed licenses and provide a channel for ordering additional licenses.

In other cases, a third party product is used to meter S/W usage. Usually, these can be configured to monitor usage of multiple applications and either enforce licenses or report excessive usage as you wish.

From an audit stand point, having metering will meet certain control objectives.  How the metering is done (enforced or reported) must also be considered.  If a company knowingly violates their license agreements, they are subject to a number of civil and possibly criminal legal actions.

Here are some resources for your consideration:

The Software & Information Industry Association
http://www.spa.org/

Incidentally, they offer a professional certification in S/W management that is cheap and easy - your company should fund your certification - more info here: http://www.spa.org/piracy/seminars.asp

Business Software Alliance (BSA)
http://www.bsa.org/usa/
or
http://www.bsa.org if outside the USA
Also look here (http://www.bsaengineers.com/) for free tools

Hope this helps.