Received a Software Audit Notice? Here's What Your Business Should Do

A software audit notice feels alarming. The right response is systematic, not panicked. Here's what to do.

A letter arrives — or an email, or a phone call. It's from Microsoft, the Business Software Alliance (BSA), or a law firm acting on their behalf. They want to audit your software licenses. What happens next determines whether this costs you a manageable remediation fee or a significant penalty.

Most businesses can resolve software audit situations without major consequences if they respond correctly. Here's how.

Who Sends Software Audit Notices?

Microsoft: Microsoft conducts self-audit programs (like the Microsoft True-Up or Software Asset Management review) and enforcement actions directly.

Business Software Alliance (BSA): BSA is an industry association that investigates reports of software piracy on behalf of members including Microsoft, Adobe, Autodesk, and others. They can initiate audits based on tip-offs, including from disgruntled former employees.

Law firms: Some publishers use law firms to send audit demand letters on their behalf.

Independent auditors: For large companies, publishers may send independent third-party auditors.

Knowing who sent the notice helps determine the appropriate response and urgency.

What to Do Immediately

Step 1: Don't Ignore It

Ignoring an audit notice makes the situation significantly worse. It signals non-cooperation and typically escalates to legal action. Respond within the timeframe specified in the notice.

Step 2: Read the Notice Carefully

Understand what's being requested:

• Which software publisher is involved?
• Which software products are in scope?
• What documentation are they requesting?
• What is the response deadline?

Some notices are "self-audit" requests where you provide the documentation. Others request access for a third-party auditor.

Step 3: Engage Legal Counsel if the Notice Is from a Law Firm

If the notice comes from a law firm, engage your own legal counsel before responding. Do not admit anything in writing until you understand your position.

For direct notices from Microsoft or BSA (without legal threats), you typically have more time and room to work cooperatively.

Conduct an Internal Self-Audit First

Before responding to the auditor, know what you have. Conduct your own internal inventory:

What to document:

• Every computer and device in the business
• What software is installed on each
• Evidence of licensing for each product (purchase receipts, license agreements, keys, subscription proof)

Software most commonly audited:

• Microsoft Windows (is each PC properly licensed?)
• Microsoft Office (2021, 2019, or Microsoft 365 subscriptions)
• Adobe Creative Cloud or legacy Creative Suite
• AutoCAD and Autodesk products
• CorelDRAW
• Accounting and ERP software

Use tools like Belarc Advisor (free) on each computer to generate a software inventory. The Microsoft 365 Admin Center shows your current subscription licenses.

Understanding Your Licensing Position

Once you have an inventory, compare what you have against what you're licensed for:

If you're fully licensed: You have documentation for every installation. Respond confidently with the documentation.

If you have a gap: You're using software without valid licenses. Your options are:

1. Purchase the required licenses before responding
2. Uninstall the unlicensed software before responding
3. Disclose the gap and negotiate a settlement (publishers often prefer cooperative resolution)

Never fabricate or backdate licenses. This transforms a civil compliance matter into a potential criminal fraud issue.

The Difference Between Voluntary Compliance and Enforcement

Software publishers generally prefer voluntary compliance — it costs them less and maintains goodwill. An enforcement action costs both parties money in legal fees.

Voluntary compliance path: You respond cooperatively, provide an accurate inventory, acquire the necessary licenses, and the matter closes.

Enforcement path: If you ignore the notice, dispute without basis, or significantly underreport, the publisher pursues legal remedies.

In Vietnam, intellectual property enforcement has strengthened in recent years, particularly for software used in commercial settings. The Ministry of Science and Technology and the police have conducted enforcement operations with BSA.

Penalties for Unlicensed Software in Vietnam

Under Vietnamese law, civil penalties for copyright infringement include:

• Compensation for damages suffered by the rights holder
• Seizure and destruction of infringing copies
• In serious cases, criminal prosecution

For commercial contexts (businesses using unlicensed software for commercial gain), penalties are more severe than for personal use.

Publishers calculate damages based on the retail price of all unlicensed copies. For a business found to have unlicensed copies of Windows on 10 computers plus unlicensed Microsoft Office, the retail value can reach 50-100+ million VND before legal fees and penalties.

How to Get Properly Licensed Quickly

If you have a licensing gap, getting compliant quickly is your best option:

Microsoft 365: Subscription is available immediately. Microsoft 365 Business Basic provides email, Teams, OneDrive, and web versions of Office for approximately 150,000-180,000 VND/user/month. You can buy the exact number of seats you need.

Perpetual Office licenses: Purchase from authorized resellers. Vietify is a Microsoft partner and can provide properly licensed Microsoft products with documentation.

Windows: OEM licenses come with new hardware. Volume licenses (MOLP) are available for businesses with multiple PCs. Retail boxes are available from authorized retailers.

Software Asset Management (SAM) as Long-Term Protection

The best defense against future audit risk is ongoing Software Asset Management — knowing what you have, what you need, and keeping them aligned.

Key SAM practices:

• Maintain a current software inventory (spreadsheet or tool)
• Document all licenses and store them securely
• Review license usage quarterly
• Track renewals and avoid gaps in subscription coverage
• When employees leave, reclaim licenses promptly

Contact Vietify → if you've received an audit notice and need help assessing your position, or get a free IT assessment to review your current software compliance.

Vietify IT Services — Software compliance and IT management for businesses in Vietnam.