How To Survive a BSA Audit

I've had absolutely no one ask me about this particular subject, so I thought it would be a good topic to post. The BSA is the Business Software Alliance, you know those guys you hear on the radio that tell you to report your employer for software piracy. What they basically do is agressively pursue companies who knowingly and willingly engage in software piracy and fine them for violating the software license of one of their clients.

For example. Microsoft hires the BSA to go after companies who are pirating Microsoft software. Microsoft has every right, regardless of the fact that they have a ton of money, to charge for software that they own, or rather to which they own the intellectual property rights. They have made the investment in developing or acquiring the software, so they get to determine who and how it can be used.

So, when an disgruntled employee leaves your company he or she decides that want you to have a thorough cavity search by the BSA regarding your software licensing. So they submit an anonymous report to the BSA telling them that you grossly and knowingly violate the license agreements for all of your Microsoft software.

The next think you know, you receive a lovely letter stating that it has come to the BSA's attention that your company may be out of compliance and would you kindly submit full and complete documentation regarding your licenses in the next 30 days. Oh dear God, how are we going to respond to this request?!!!

Now, how do you survive this? First of all, don't panic. If you're not intentionally and willingly engaging in software piracy, you really have nothing to worry about. Though the horror stories abound about the BSA sending in it's super agents with their dark sunglasses and sub-machine guns, terrorizing your receptionist and saying "Mam, please step away from the computer", this is rarely the case.

Secondly, take this as an opportunity to get your license management documentation together. If you work for a small to medium sized business, you probably have licensing documentation all over the place. This is a good change to get it all together and put in a single location.

Thirdly, make 3 copies of everything. When I recently went through this experience, I took the opportunity to get all of my license documentation together and make three copies of everything. One copy went to the BSA and supporting documentation for my report. Once copy became the hard copy license book we now keep in our office. And the third copy is a soft copy of all of the license documentation in PDF format.

I also took this opportunity to implement some ITIL best practices with regards to managing software licenses. For example, now all software purchases come through my department, without exception. Why? This provides for a single point of license management enterprise wide. Since my department manages the purchases, we also manage the assets and licenses that go with those purchases. I've already established relationships and accounts with our key vendors, managing the assets that go with those purchases is just logical extension of that function.

So surviving a BSA audit is simple really. Develop a plan, get your house in order, reply to their inquiry, and then use ITIL best practices to keep from having the start from the bottom when it happens again.