Software Audits from Oracle, SAP, Microsoft, and Salesforce: What You Should Know

Getting an audit notification from your software provider can be nerve-wracking, but after reading this you’ll realize this is less likely due to something you’ve done wrong and more likely a tactic to throw you off-course.
If you’ve never been through an audit before, you don’t know what to expect, what to do, or how to make sure it’s over as quickly as possible with minimal expense to your organization.
In this article, we’re going to make all this crystal clear by outlining the audit processes of large enterprise software providers like Oracle, Salesforce, SAP, and Microsoft. There are a few key things you need to take into account that apply to all of these providers: ● Use your contract as your best weapon to defeat audits. Take action if there is any sort of grey space in terms of what is allowed by the supplier.
- Use your contract as your best weapon to defeat audits. Take action if there is any sort of grey space in terms of what is allowed by the supplier.
- You’ll do best if you bring in outside assistance. An expert who has experience guiding businesses through software audits will be a huge help throughout the process.
- You need to control all the information that is shared with the supplier in your own format and spreadsheets.
- The more you are proactively sharing information with suppliers, the less basis they have to bring up an audit.
- Audits are brought forth to customers for many commercial reasons. The more proactive you (the customer) are with sharing information, addressing audit risks in meetings, and creating a paper trail, the less likely your supplier is to audit you.
What is a Software Audit and How Did Your Company Get Selected for One?
A software audit is both a technical and contractual review of your organization’s use of a specific software platform within your IT environment. Most large enterprise software companies like Oracle and SAP have separate departments that focus purely on license compliance audits. These teams look and feel like a shared service organization inside of a large software company. They work with a customer’s account management team to take an aligned, yet separate and distinct, position on behalf of their software company. We will discuss the similarities and differences between these different teams later in the article. One common similarity across all of these suppliers is that the audits will compare your usage and processes to any specifications, standards, or contractual agreements in place.
Why your company? Why did you get singled out for an audit?
There are three primary operational/contractual triggers for a software audit:
- If there is any sort of consumption-based pricing in your contract;
- If you have any sort of restricted-use license in which you are only allowed to use a license for certain functionality; or,
- If you have recently acquired or divested a company.
While not mutually exclusive, you’ll also find the timing of these audits is very suspect and robotic in nature. The two primary timing triggers are:
- Anytime a large software company needs to identify “unearned revenue” to meet quarterly revenue targets; and,
- A pending contract renewal.
These large enterprise software companies know that it’s very common for their customers to be out of compliance due to the sheer size and scope of their operations. This is augmented by the fact they know anytime there is employee turnover within a customer’s IT organization (especially their “software asset management” department) the company is susceptible to additional compliance risk as a result of lost tribal knowledge of the environment, past internal audits, etc. Taking all of this into consideration makes it relatively easy to understand why a company like Oracle can confidently predict net new revenue from their existing client base. In addition to market pressure for additional revenue, a customer’s upcoming contract renewal also serves as an all too common trigger. The general rule of thumb we tell clients is anytime you have a contract renewal coming up nine to twelve months, your supplier is likely to introduce an audit. Your supplier will use this as an opportunity to distract you and gain the upper hand in an anticipated contract negotiation that hasn’t even started. Suppliers do this because it automatically puts you in a defensive position. Naturally, you will be forced to concentrate on defeating the audit instead of allocating that same time to figuring out what you need for the upcoming contract renewal. They want to gain as much leverage and understanding of your business as possible before going into a renewal negotiation. The audit is merely a tactic large software providers use to 1) seek out unearned revenue for their company to meet revenue targets and 2) gain the upper hand in your contract renewal negotiations in the hopes of minimizing any revenue loss from your account. The fact of the matter is that it’s very common for customers to be unintentionally out of compliance. Knowing this, it’s important you know what to do in order to defend your company from what is potentially a very costly situation.
Here’s an example to help illustrate this tactic
By way of an audit, an ERP provider could discover you are misusing the license, giving the supplier reason to charge you a larger fee. Often, sales revenue targets for these audits are about 30% of your annual maintenance/subscription costs. Let’s say you are spending $1M on core licenses, the audit will likely lead to around $300k in costs on top of that. If you can defeat the audit and keep your core license costs at $1M, then you will be happy and reward yourself for fending off the extra charges. In reality, the supplier didn’t expect the $300k in the first place, the audit was just a way to distract you from putting time and effort into your upcoming renewal negotiation. It’s a win-win situation for them - if they win the audit, they put the money towards their sales revenue to meet their quota; if they don't, they’ve distracted you from being prepared to save money on your upcoming contract negotiation. As a sales rep, finding new business is much harder than auditing an existing customer. Suppliers will target big companies because they don’t have perfect internal controls and mistakes are likely to happen.
What to Do When You Get an Audit from Oracle
When Oracle conducts an audit, they engage their License Management Services (LMS) team to run the process. The audit process often involves installing software code within your secure environment. It is a listener software that will hit your mainframe servers and figure out how many other systems are connected. This is important because, historically for this on-premise software, you are licensed based on the interconnectedness of both physical and virtual server environments. Your supplier wants to know how much “value” you are getting from their platform so the software they install provides a report of how many systems are interconnected. In a nutshell, the software delivers a report that illustrates when your technical architecture is in non-compliance. This automatically gives Oracle the upper-hand as it forces the customer to validate the information. The best tactic to defeat this process is to never allow the software in your environment to begin with. You have the right to refuse listening software within your Oracle contract. Unless your contract explicitly calls out installing software, tell Oracle that installing software does not comply with your IT security protocols. Look to determine if you have audit language specified in your contract. The older the contract you have with Oracle, the more likely you have the right to refuse the audit, or to at least not allow the listener software to be installed within your environment. If this is the case, tell Oracle that instead of installing the software, you will run the audit yourself using their tools and spreadsheets with no software included. This means you are in control of what information is being shared with Oracle. Controlling the information is incredibly important in any audit, especially when suppliers are involved.
What to do when Salesforce Conducts an Audit
Salesforce audits customers when there is a restricted-use license available. When this happens you need to think critically about negotiating with Salesforce. Salesforce is Software as a Service (SaaS) in the cloud which means they have more ability to freely monitor your utilization of licenses within your environment and can freely audit for misuse. When you have a Restricted Use License (RUL), you have permission to use the product for a specific business purpose leveraging a certain number of standard and custom objects. Standard objects are modules within the Salesforce platform, such as contacts, accounts, or prospects. A custom object is something that was built by a Salesforce developer specifically for your company. The license limitations in an RUL are a contractual limitation, not a technical one. A contractual limitation means there is legal language on your Order Form specifying how the license may use a predetermined number of standard/custom objects even though there is a set quantity limitation, technically there is no way to shut off access to other custom objects for that user. This license is often in place for a subset of users who only need limited access to your tool. For example, an employee who is only viewing the data and not editing it. If this group starts editing objects, it becomes in and of itself a compliance issue. Salesforce makes it easy for the end-user to accidentally do this without realizing they are in breach of the license. They will use this opportunity to accuse you of using the license incorrectly and request that your organization upgrade these licenses to full users and will seek compensation since the inception of the misuse. Contractually, Salesforce has the right to charge you full retail price for those non-compliant users. Another time when Salesforce audits come into play is when a client is on a SELA Agreement (Salesforce Enterprise License Agreement).
How do you get around Salesforce RUL audit problems?
The best thing you can do is to establish quarterly check-ins with your account team at Salesforce. Use these meetings to stay on the same page with your account team and create a paper trail that shows how your users are engaging with the platform. If you are accused of breaching restricted use, but have established quarterly check-ins with a paper trail, you can respond to Salesforce by saying “We met with your team and they didn’t bring anything up during our meeting so why should we believe you now?” Without quarterly check-ins and a paper trail, you get into a he-said-she-said argument. Often times, the employee in breach of license may have accessed the wrong objects once or twice throughout the life of an account. Salesforce will create an argument that the license has been systematically misused for a long period of time. We treat this event like a litigation. If you don’t have a paper trail of record, then you have no legal foundation for a defense. When comparing the perspective outcome of the party that has records and the other that does not, the person with records almost always wins in court. Keep careful documentation about your interactions with Salesforce, and have open conversations about audit and license use risk. This will build a strong foundation and reduce the risk of an audit.
How to Handle an Audit from SAP
An audit by SAP is very similar to an audit by Oracle in that, historically, their licensing model is primarily “consumption-based.” This means your price is based on your company’s revenue, profit, services used, how many suppliers you have, or any number of a series of variables. This model falls under the concept of Value-Based Pricing and is a subjective assessment of value captured from the utilization of the software. SAP will use many of the same tactics as Oracle which we’ve outlined above. One thing to specifically note about SAP is that they very frequently introduce audits during merger & acquisition (M&A) announcements. When supporting clients with M&A IT Sourcing, we commonly tell our clients to “get ready for the ‘ransom letter.’” These aren’t our words but rather those of our clients who received notifications from suppliers such as SAP immediately after announcing a large acquisition to the market. Want to know if you’re susceptible to these ‘ransom letters?’ Take a look at your contract and keep an eye out for any language within your contract that indicates they will “readdress the terms of the contract if you the customer acquires or divests entities during the term of the contract.” If you have this language within your contract you will more than likely receive a similar notification within 1 month of publicly notifying your M&A intent. In order to defeat an SAP audit, take the same approach we would take with Oracle and then protect yourself moving forward by changing your pricing model to a fixed baseline model that is attached to the reasonably certain variables in your company such as the number of employees.
What to Do When Microsoft Audits You
Microsoft’s audits vary depending on the products and services within your contract. Similar to Salesforce, Microsoft will commonly focus on those licenses that have restricted use. A very common audit for those clients with perpetual Microsoft Office licenses is the 1-to-1 validation of windows desktop licenses to computers within a customer’s environment. Similarly, for those clients with an active Office 365 subscription, Microsoft will look closely at the utilization of subscriptions that are inherently limited in their intended use. This is augmented by a deep analysis of computers and users in your ecosystem to ensure the capabilities being used are properly licensed. If you are paying for any physical or virtualized servers from Microsoft within an SCE agreement, you will commonly be audited to ensure your consumption metrics are within your contracted allocation. Frequently with Microsoft, you are leasing the utilization of servers either on-premise or in the cloud. Generally speaking, if you have a physical piece of hardware from Microsoft on-premise, they will almost certainly conduct an audit at renewal time to monitor utilization as part of their “optimization analysis.” In a nutshell, they will try to move you from an on-premise environment to the cloud. Conceptually this is fine but they will use that audit as leverage to do a lift and shift into Microsoft Azure. Microsoft Azure is a very attractive product for the sales team because they are heavily incentivized to get your company into the cloud. The market is looking at how Microsoft’s cloud growth is going year after year and as a result, the company wants to increase its usage. Essentially, Microsoft will audit to try and sell you on Azure. This isn’t necessarily a bad move to make but knowing key motivators will keep you ahead of the game and alleviate any potentially detrimental surprises.
What Happens Next?
If you’ve been audited by any of your enterprise software providers, we recommend bringing in outside help to guide you through the process. Leveraging their experience and expertise will go a long way to mitigate both short and long term risk that can easily rise into the millions. Don’t solely believe what your account executive is telling you, oftentimes they don’t have all the information needed and they are heavily incentivized by their employers. Your outside expert will be able to comb through your contracts, identify risks/opportunities, and drive both cost savings and containment. With the proper assistance, you’ll be able to confidently stand your ground and mitigate risks before they are realized.
More resources
From Fortune 500 giants to fast-growing innovators, TNG has helped clients save 20% – 40%+ on enterprise software contracts — even when they thought it was impossible

Inc. Magazine Unveils Its First-Ever List of the Midwest’s Fastest-Growing Private Companies— The Inc. 5000 Series: Midwest
The Negotiator Guru Ranks No. 15 on the inaugural 2020 Inc. 5000 Series: Midwest
NEW YORK, March 25, 2020 – Inc. magazine today revealed that The Negotiator Guru is No.15 on its inaugural Inc. 5000 Series: Midwest list, the most prestigious ranking of the fastest-growing private companies in Illinois, Indiana, Iowa, Kansas, Michigan, Minnesota, Missouri, Nebraska, North Dakota, Ohio, South Dakota, and Wisconsin.
Born of the annual Inc. 5000 franchise, this regional list represents a unique look at the most successful companies within the Midwest economy’s most dynamic segment—its independent small businesses.
“We’re honored to be recognized in the Inc. 5000 list as one of the fastest growing private companies in the Midwest,” said Dan Kelly, Founder and Senior Partner. The Negotiator Guru also ranked #2 in the state of Minnesota and #5 in the category of Business Products and Services. “Our success is a direct result of the value we’ve delivered with, and for, our global enterprise client base. Congratulations to the TNG team!”
The companies on this list show stunning rates of growth across all industries in the 12 Midwest states. Between 2016 and 2018, these 250 private companies had an average growth rate of 360 percent and, in 2018 alone, they employed more than 27,000 people and added $13 billion to the Midwest’s economy. Companies based in the Chicago, Detroit, and Cincinnati areas brought in the highest revenue overall. Complete results of the Inc. 5000 Series: Midwest, including company profiles and an interactive database that can be sorted by industry, metro area, and other criteria, can be found here starting March 25, 2020.
“The companies on this list demonstrate just how much the small-business sector impacts the economies of each Midwest state,” says Inc. editor in chief Scott Omelianuk. “Across every single industry, these businesses have posted revenue and growth rates that are beyond impressive, further proving the tenacity of their founders and CEOs.”
About The Negotiator Guru
The Negotiator Guru is the leading advisory firm for Salesforce contract negotiation. Our team of Senior IT Sourcing Experts provides industry leading IT contract negotiation services for a global client base. Clients engage us to source, negotiate, and manage highly complex IT contracts, transactions and suppliers. Through our deep business understanding and senior expert negotiation skills, we work closely with clients to deliver immediate and long-lasting financial impact to all stakeholders.
Founded in 2015, The Negotiator Guru is a private company based in Minneapolis, Minnesota. For more information, visit www.thenegotiator.guru. More about Inc. and the Inc.
5000 Regional Series
Methodology
The 2020 Inc. 5000 Regional Series is ranked according to percentage revenue growth when comparing 2016 and 2018. To qualify, companies must have been founded and generating revenue by March 31, 2016. They had to be U.S.-based, privately held, for profit, and independent—not subsidiaries or divisions of other companies—as of December 31, 2018. (Since then, a number of companies on the list have gone public or been acquired.) The minimum revenue required for 2016 is $100,000; the minimum for 2018 is $1 million. As always, Inc. reserves the right to decline applicants for subjective reasons.
Ready to explore joining the TNG family?
Contact us today to set-up a client intake assessment where we identify your cost savings opportunity for free!
------------------------------------------------------------------
Explore other TNG Featured Articles, Follow The Negotiator Guru on LinkedIn, Follow Dan Kelly on LinkedIn and Twitter. Learn more about What We Do.
About Inc. Media
The world’s most trusted business-media brand, Inc. offers entrepreneurs the knowledge, tools, connections, and community to build great companies. Its award-winning multiplatform content reaches more than 50 million people each month across a variety of channels including websites, newsletters, social media, podcasts, and print. Its prestigious Inc. 5000 list, produced every year since 1982, analyzes company data to recognize the fastest-growing privately held businesses in the United States. The global recognition that comes with inclusion in the 5000 gives the founders of the best businesses an opportunity to engage with an exclusive community of their peers, and the credibility that helps them drive sales and recruit talent. The associated Inc. 5000 Conference is part of a highly acclaimed portfolio of bespoke events produced by Inc. For more information, visit www.inc.com.

Why are Companies Hesitant to Engage Outside Consultants?
Why is it that companies are sometimes resistant to engaging with a cost savings firm like The Negotiator Guru (TNG)? Furthermore, why is it that a company refuses to engage with an advisory firm (like TNG) after they know there is a guaranteed ROI? Is there any rational reason for this or is it purely an emotional response?We at TNG find ourselves asking these questions far too often…
We know humans can be complicated (😊), but we wanted to dig deeper into what sometimes appears to be irrational behavior that negates shareholder value creation opportunities. As a result, we conducted ethnographic research on the cause of this behavior with the intent of identifying key trends, by persona. Here are a few of the key insights we discovered:
- IT Leadership (CIO, VP of IT, etc.) fears they will hurt the relationship with the software publisher/service provider leading to service degradation.
- Purchasing/Procurement/Sourcing representatives have huge egos and thrive on taking credit internally. Furthermore, they are worried about their job security if someone else can achieve a greater result.
- CFOs think they only way to achieve such savings is by changing vendors (ex: Salesforce to Microsoft) or by cutting products/services.
- Business leadership think it will take too much time to achieve the prospective savings which will negate the realized ROI.
- Executives at publicly traded companies are generally risk adverse and think it’s safer to use a big 4 consulting firm (that’s already “in the system”) even though they will likely cost more and achieve much less (since they’re a generalist vs. specialist).
We’ve heard different variations of these key objections for years. What makes us most proud is that some of this feedback came from a few of our past clientele who decided to overcome their natural resistance as they knew what was best for their organization. Per the recommendation of these past customer respondents, we've outlined what they experienced (vs. initial perceived resistance):
- Vendor Relationship – While it may be slightly uncomfortable at the beginning (depending on how much Right Sizing and/or Right Pricing opportunities TNG identifies), the vendor relationship and service quality improves at the conclusion of the TNG engagement. The vendor is engaged with the customer in a strategic manner and the customer can now feel confident they are only paying for what they need at a fair price.
- Procurement Job Security – TNG acts like a force multiplier for existing Procurement teams. As such, TNG simply seeks to enable high impact results vs. seek credit.
- Vendor/Product Change – Vendor changes are extremely rare. TNG simply identifies how internal stakeholders use the respective software platform (via their proprietary persona analysis) and identifies cost savings opportunities without sacrificing functionality/service quality.
- Time/Cost to Achieve – Internal business stakeholders are rarely involved in the process after the Discovery phase is complete.
- Niche vs. Generalist – The speed and consistency in which TNG can delivery results is a direct result of their focus and dedication focusing on their core competency, such as Salesforce.
Interestingly, our analysis identified the following key insights regarding business leaders' intention for engaging an outside advisory firm (summarized for brevity):
- IT Leadership sometimes feel uncomfortable being the “tough voice,” so they hire a 3rd party who brings the credentials to speak from an authoritative position.
- C-Suite Executives simply want to motivate (prove to) their Procurement/Business Teams that the “great deal on the table” is not so great after all.
- Procurement leadership wants to be armed with accurate price benchmarking or contract term knowledge. They recognize they can’t be experts in everything and value niche expertise from specialists vs. generalists.
- Board members want to do anything possible to reinforce their fiduciary duty to their shareholders…this includes identifying, and executing on, every available cost savings opportunity.
- Contract negotiators want to understand the software publisher’s sales playbook and internal incentive process…not just general market intelligence.
We hope that you find these key insights helpful as you contemplate and reflect on your own personal resistance to engaging an outside advisory firm. TNG prides itself to make every engagement as risk-free as possible for our clients. Furthermore, TNG will only accept a client if we know there is a major impact opportunity…if not, we will simply give you some free advice. Ready to explore joining the TNG family? Contact us today to set-up a client intake assessment where we identify your cost savings opportunity for free!

Why Salesforce Commerce Cloud Negotiations are Different
What is Commerce Cloud
The Salesforce Commerce Cloud is one of the fastest growing segments within the Salesforce ecosystem of products and services. The Commerce Cloud provides an enterprise grade e-commerce solution that which is a direct competitor to e-commerce heavyweights including, but not limited to; Shopify, Magento (Adobe), SAP, Oracle, just to name a few.
Since about 2018, Salesforce has highlighted the e-commerce cloud as a strategic growth channel for its existing customers. In other words, Salesforce has focused on deploying their “land and expand” sales strategies to deploy the e-commerce platform amongst its Sales and Service Cloud customers. There are clearly significant customer experience opportunities that can be enabled when e-commerce is connected directly to your CRM. Ironically, the TNG team is engaged by both new and existing Salesforce customers to assist with commercial negotiations related to the on-ramp and off-ramp of Commerce Cloud. Our clients seem to either love or hate the Salesforce Commerce Cloud depending on their specific use case. No matter where you land on the love/hate spectrum, it’s important to understand key negotiation opportunities/risks that are specific to the Salesforce Commerce Cloud.
History of SF Commerce Cloud
Salesforce acquired Demandware on June 1st, 2016 for $2.8 Billion USD. Some say that Salesforce was “forced” into the acquisition based on a synergistic customer portfolio (with Demandware), a lackluster homegrown solution filled with development challenges, and a competitor landscape (including Oracle, Adobe, etc.) who were making significant strides in the space.

In our opinion, Salesforce acquired Demandware primarily to purchase a pre-existing retail customer base that can be cross-sold Salesforce native functionality like Sales and Service Cloud. Salesforce had historically been lacking both North American and European retail customer penetration so this allowed an easy on-ramp. Fast forward to 2021 and Salesforce is still lagging (compared to their normal market penetration) in retail customer acquisition globally. Furthermore, we have seen many legacy Demandware customers transition away from the Salesforce Commerce Cloud and migrate over to easier-to-use platforms like Shopify. Having the e-commerce competitive landscape in mind is important when exploring/negotiation a commercial relationship with Salesforce either as a new or existing customer.
Why these negotiations are different
Salesforce typically organizes their sales team by industry, region, and product line (cloud). Their sales team incentives are consistently changing but are largely established by industry and product line. Furthermore, customer pricing is influenced based on industry, annual contract value, and customer revenue. To be most effective at any commercial negotiation it’s important to have as much data as possible. This includes identifying the supplier’s interests and best-in-class rates on a product-by-product basis based on your unique footprint. We call this our Right Price Benchmarking service which is included as part of our Full Negotiation Service or also offered as a standalone product for those that just want the data. Salesforce, and for that matter all e-commerce solution providers, are fully aware that switching costs from one e-commerce platform to another is an undesirable expense. They know that once they get you onto their platform that you will need to be really upset to create a reason to leave. The fact of the matter is that plenty of customers do leave Salesforce’s Commerce Cloud for one or multiple reasons. Our research, and real client experiences, have identified one consistent trend amongst those looking to leave: Out of control run costs. No matter whether you’re a new or existing customer to Salesforce it’s important to be as prepared as possible when engaging Salesforce. Take a look at the section below for some key insights specifically related to negotiating a Salesforce Commerce Cloud contract.
Key Insights/Tips
Now that you understand the history and key motivations related to Salesforce’s Commerce Cloud you should be able to apply the below key insights most effectively.
- Salesforce is heavily focused on capture net new retail customers. Your Salesforce sales team is heavily incentivized to find and convert customers on existing e-commerce platforms.
- If you are a current Salesforce customer and exploring the Commerce Cloud, be focused on “lift and shift” credits from Salesforce that help mitigate any change costs. Depending on your situation, you can negotiate credits to be applied immediately, over the contract term, via discounts on other products, etc.
- It’s very important you conduct a thorough assessment of your options and the overall total cost of ownership impact of your potential options. For example, a one-time credit on the Commerce Cloud license fees may produce far lass benefit to your organization than a % discount on your existing license footprint with Salesforce.
- It’s important to understand who has decision-making authority inside of Salesforce. It largely depends on what you’re asking for, the overall relationship impact, and the attractiveness of you the customer. The only way to successful navigate the Salesforce ecosystem is to hire a firm that deals with Salesforce everyday and has ex-Salesforce employees (excuse the shameful TNG plug).
- Literally 90% of current Salesforce customers that engage TNG are paying for more digital capability than they need. Those same customers are also overpaying for licenses that that they don’t even need. It’s very important you conduct a Right Sizing assessment to ensure you’re only procuring what you need.
- Specific to Commerce Cloud, this includes forecasting your Gross Merchandise Value (GMV) projections for each contract year.
- Similar to the above point, our research empirically proved that 100% of our customers (no matter new or existing Salesforce customers) have committed to higher revenue targets than needed in the interest of “getting the best deal” without TNG support;
- This creates a material risk to the Salesforce customer when they don’t hit those targets.
- Generally speaking, a longer contract term will drive a lower GMV price point;
- Even if you feel very confident in your GMV projections, focus on usage and price-point flexibility within your Commerce Cloud contract to eliminate surprises and capture cost savings if revenue actuals exceed projections.
- Note: If you are in an industry that is undergoing significant industry consolidation (M&A activity) then you should provide yourself the flexibility to acquire and/or divest mid-contract with Salesforce.
Negotiating with Salesforce is more of an art than a science. It’s important that you understand all of the facts before negotiating with Salesforce. Please feel free to contact us for some additional helpful tips as you start to explore the Salesforce Commerce Cloud. (And yes, we’re happy to help even if you’re in the 19th hour of negotiations 😊)

