Keywords

1 Introduction

In every software company, survival depends on aggressive development and protection of its intellectual property [1, 2]. Other than protection from illegal installation of products, compliance is another important area of software licensing. This is especially so in relation to consumption and proper licensing of the software products and ensuring their customers software assets are managed effectively [3].

In an audit engagement, the perceptions of the audit quality are directly related to the perceived reputation, credibility and objectivity of the auditor; in essence, the quality and experience of an auditor [4].

Considering the plethora of software development activities in today’s digital world, license auditing process entail a number of challenges. Some of these challenges are:

  • Inappropriate licensing model for customer

  • Ineffective software asset management process

  • Ineffective users’ access management

  • Ineffective authorization management

  • Engaging software customers in the audit process

  • Third party audit firms that do not understand or abide by the licensing model and measurement methodology of software vendors

  • Inaccurate information or advice provided by third party audit firms

Considering these challenges, this paper attempts to provide a concise overview of the software license auditing process. It also attempts to provide a brief discussion on security implications in the context, and offer a number of recommendations.

The rest of the paper is structured as follows. Section 2 provides a literature review on software licensing, contributing factors on audit quality, and relevant concepts within the field. Section 3 provides a brief discussion on auditing challenges and security implications. A brief discussion, the future of software license auditing, and a number of recommendations are provided in Sect. 4. The paper is concluded in Sect. 5.

2 Literature Review

Audit is defined as “an official examination of business and financial records to see that they are true and correct” or “an official examination of the quality or standard of something” [5] and License Auditing is the official examination of the licensees’ deployment and utilization of the software to ensure proper Software Asset Management (SAM). Most of the existing studies are conducted in the area of financial auditing and are focused on the financial examinations.

Other than the qualification of the auditor, audit quality is an important aspect of a successful audit. Audit quality, as defined by DeAngelo [6] “..to be the market-assessed joint probability that a given auditor will both (a) discover a breach in the client’s accounting system, and (b) report the breach.”. It is also determined between low-to-high quality involving various factors [7].

In the area of financial auditing, failure in an audit often occur when the auditor does not enforce the proper audit principles. This is known as the Generally Accepted Accounting Principle (GAAP) failure. Another circumstance when an audit failure can occur is when the auditor fails to produce a qualified report for the engagement known as audit report failure [8].

To date, several research works have studied audit quality and the factors that are affecting the audit quality. Some of the notable factors include: Audit firm’s reputation [9, 10], Audit firm’s size [6, 7, 11,12,13,14], Non-Audit services [15], Task complexity [16], Auditor’s rotation [16, 17] and Auditor’s independence [16, 18].

To effectively study the audit quality, Francis [7] developed a framework that assesses some of the factors that are impacting an audit quality. The framework consists of 6 levels namely Audit inputs, Audit process, Accounting firm, Audit industry, Institutions and Economic consequences of audit outcome (Fig. 1).

Fig. 1
figure 1

Framework adopted from Francis’s Audit Quality Assessment Framework [7]

Full size image

Audit testing procedures and team personnel are the inputs to the framework. The inputs are then transited to the next level of the framework for the decisions to be made by the engagement team through the audit process. The assumption of Francis was that auditing occurs in the context of the audit firm [7]. The audit firm is also the institution that hires, trains and develops the auditors. The audit report is also cleared and issued under the name of the firm. It is this collection of audit forms that has formed the Audit Industry and the audit market which is in turn governed by various certification bodies and institution. Therefore, these activities affect clients’ companies in terms of report outcome. It was also noted by Francis that if an audit is carried out by competent auditors, the audit result will be of a higher quality. However, there are no evidence to support this claim. On the contrary, performance can be affected by many factors [11,12,13]. It was also perceived that larger firms have more in-house expertise and therefore have a greater opportunity to produce higher quality audits. While there were insufficient data to link audit quality and size of audit form [7], it is somewhat true in terms of expertise. In the context of principle software vendors, the auditors, who are the employees of the principal software vendors, usually have the expertise and expert knowledge in their own software products. Additionally, they are supported by a large number of in-house resources that are experts in different dimensions of the software product. Thus, the quality of audits conducted by principle software vendors are perceived to be of a higher quality compared to external audit firms. Other factors should be considered. There are instances that accounting audits in their audit tenure conduct non-audit services, and this may influence the level of specialty required for nonfinancial audits.

There are no firm evidence pointing to the loss of audit quality for firms registered with the Securities and Exchange Commission (SEC) when performing non-audit services. Instead, such registration is observed to be positively associated with the audit quality, and therefore it is of the opinion that it is actually the result of auditors providing higher quality audit [19]. In a separate study conducted by Boskou, Kirkos and Spathis [20], information from publicly available annual reports were used to develop a classification of audit quality. Using machine learning techniques to perform text mining from a company’s annual report also yielded the conclusion that there is a positive relationship between financial, operational and strategic risks [21]. Boskou, Kirkos and Spathis used models and natural language processing to review different models and developed a classification that can be used to predict internal audit quality, by enabling the auditor to effectively assess the risks and better plan audit procedures [20].

In order to provide inputs relating to the attributes that are important to audit quality, around 4,600 audit professionals in IT and Finance were surveyed by Stoel et al. Accounting skill and Audit skills, Business process knowledge and experience were rated higher by the Financial auditors while Auditor Experience with Auditee, IT and Controls Knowledge, and Planning and Methodology were rated higher by IT [22]. This information provides greater insights to audit leads when planning for an audit that can contribute positively towards improving the quality of audit.

In a separate study conducted by Kilogre and Bennie [23] on Australian auditors, the audit quality attribute that was perceived to be the most important was reported to be ‘Audit firm size’ (Table 1).

Table 1 Categorization of attributes and their relative ranking, adopted from [23]
Full size table

“Whether or not they are IT auditor or Financial auditors, it was observed that there was a positive correlation between auditors in big-N firms and audit quality that is referred to as the “Big N effect” [14]; therefore, it seems that the higher the quality of the audit, the greater the assurance of report quality [24]. However, it is challenging to compare the audit quality between firms that assign the audits in Big-N and non-Big-N as the audit firms choose their auditors based on firm or the characteristics of the auditor. Nevertheless, larger firms have more resources and technology support over non-Big-N firms. Moreover, Big-N auditors are known to be “generalist” [25, 26]. That being said, firms with poor performance are more likely to change auditors [27].

Apart from the studies involving attributes contributing to audit quality, some research works have attempted to adopt text mining to examine audit report and evaluate the quality of audits. A company’s annual report is a useful tool where the information is available publicly. This information can be analyzed textually using classification methods. Machine learning and natural language processing tools can also be used to effectively assess risks and provide recommendation to auditor to improve audit procedures [20].

Generally, in an audit practice, auditors collect artefacts and supporting documents through the use of an audit procedure to detect materials that may demonstrate misrepresentation in financial statements. When such misinterpretation is detected by auditors, such misconceptions are usually communicated to auditees’ management to adjust the misstatements. This is similar with license auditing where the license auditor communicates with customers (or management) to understand the cause of such misinterpretation. These misinterpretations, however, can also be due to the internal processes that result in certain findings. For instance, suppose a customer has User Licenses created in the System that exceeds his/her entitlement. Discussions are carried out with the customer to understand the issue, and where necessary, User number is adjusted downwards based on the assessment and feedback; Also, another underlying reason may be due to the customer’s failure to clean up or deactivate an unused User account, that was later verified using system data. In summary, the phases of determining audit quality are (i) Detecting (ii) Adjusting (iii) Reporting of misstatement/misrepresentation to achieve audit quality.

The observable audit objectives include audit adjustments, audit opinion and the quality of audited financial statements. Adjustment occurs when there is a misstatement in the pre-audit financial statements and is required by the auditor to correct the misstatement or issuing a modified audit opinion in response to the misstatement [28]. According to Xiao et al. [28], an audit adjustment appears to occur more frequently when the audit effort is greater. The increase audit effort means the auditor can perform more comprehensive audit verifications with the attainment of more artefacts to demonstrate certain system behavior or financial postings, thus improves the ability to detect misstatements. With enough artefacts and evidences, the auditor is in a better position to determine anomalies, and less likely to waive any audit adjustments proposed by the client’s management. If an adjustment is required with the support of the evidence, auditors are in a better position to ensure detected misstatements can be corrected through adjustments. Therefore, higher audit effort does not naturally means that there are more issuances of modified audit opinions [28].

2.1 Licensing

In the software market, infringement of copyright includes the reverse engineering of software codes and unauthorized duplication and use of software. The Business Software Alliance estimated that, in 2011, that the illegal software market caused about US$63 billion in damages all over the world [29].

When we look at software licensing, the general categories are opensource, non-opensource and subscription based. There are well over 60 different types of opensource software [30] such as mSQL, Linux, opensource Office etc. In terms of non-Opensource, there are several major software vendors with products that are non-Opensource, for instance MicrosoftTM, SAPTM, OracleTM, AdobeTM etc. Subscription software examples are SalesforceTM, Workday, SAP Cloud Solutions etc.

In terms of license auditing, in particular to SAP licensing, there are different licensing models namely perpetual, subscription and consumption based. SAP software are based on two components (i) Software and (ii) SAP Named Users. There are two perpetual license models—the Classic SAP software and SAP S/4HANA–branded software. Software provides the opportunity to support business functionality and is licensed in accordance with specific metrics. SAP Named Users provide the rights for individuals to use the software. The named users are further divided into a few types, each providing specific use rights. SAP uses the analogy of a house and the key where the Software is the “house” and the Named Users are the “keys” [3].

In a subscription model, the customer does not have perpetual use rights over the software, instead pays an annual subscription fee as part of a term contract. The fee includes all the Software as a Service (SaaS) components, including product support. Under the consumption-based model, and the customers pay the dues based on actual usage. There are also various types of database licensing options that need to be considered.

Compliance is an important aspect of SAP software licensing. When it comes to the consumption and proper licensing of SAP products, SAP’s global audit and license compliance process protects SAP’s core business assets and ensures that SAP’s customers can manage their SAP assets effectively and manage any overuse of the software [3].

If an audit is initiated by a software vendor, organizations should cooperate with the software vendors. There are instances where customers are evasive and purposefully delay requests, provide inaccurate or wrong information, and are non-responsive to the request of information or organization’s attempt to circumvent the software’s built in monitoring mechanisms [31]. In such cases, there will be difficult conversations with the customer with possible escalations from both sides. At times, it may involve legal interventions to enforce the contractual rights. Therefore, it is important to properly plan an audit engagement. Planning the information systems audit must include all the stages necessary for the achievement of the objectives of the audit mission, namely documentation of the audited activity, the program or system under scrutiny, the establishment of the audit strategy, the establishment of the audit procedures and techniques, and the methods of synthesis, analysis and interpretation of the audit evidence [32].

3 Security Implications

Many software organizations are facing the situation where it is believed that their intellectual property (IP) rights are not used in a lawful manner causing revenue leakage and potential loss of control over the protection of IP rights and discouragement of infringements [33]. All usage of Intellectual Properties should be appropriately licensed depending on the usage and scenarios. In the factsheet published by the European Intellectual Property Rights (IPR) Helpdesk, license agreement is defined as “a contract under which the holder of intellectual property (licensor) grants permission for the use of its intellectual property to another person (licensee), within the limits set by the provisions of the contract” [34]. Without such an agreement, the use of the intellectual property would most likely result in an infringement.

Based on a survey conducted by Deloitte on consumer privacy, it was found that 91% of the 2,000 participants aged between 18–75 are willing to accept legal terms and conditions without reading them [35]. Not just in the consumer space, companies sometimes agree and sign the Software agreement without fully understanding the implications of the contract or the “fine prints”. While some may say that contracts of larger and younger companies tend to be “pro-seller”, there are no evidences to support that larger firms offer software terms that are worse than those that are offered to general public as compared to business and corporate users [36].

Proper software licensing and audit not just ensure company remains compliant to the agreement that they have signed with the Software vendor, but also ensure their internal control and governance are functioning properly. Internal control that we are discussing in this paper are the segregation of duties and unauthorized access. Segregation of duties is one of the fundamental elements of internal control [30]. Other than ensuring no single individual has control over the whole process, exposing the organization to risk. but also to ensure legal compliance [37]. Not just in Information Technology, this notion is also an important topic in accounting, given that the segregation of duties seeks the prevention of possible fraud through collusion, where there are conflict of interest [38]. In licensing terms, one scenario relating to the segregation of duties include sharing of User IDs within the organization. Some companies attempt to cut down the number of licensed Users by allowing Users to share a single User ID for various functions within the department. This results in the inability to identify the exact person who entered a request entry. This issue leads to the inability to identify the individual who approved the request. This also creates collusion between employees and potentially results in fraud cases within the organization.

With the sharing of User ID, an employee who is no longer with the department or organization may gain unauthorized access to the application software by using the shared User ID. This can be done by a disgruntled employee or an attacker with the aim of stealing information, resulting in unauthorized access to the protected or sensitive information. Eventually, this compromises the data integrity and availability within the firm [39]. Software license audit can potentially expose sharing of licenses by reviewing the Usage information and User management procedures. While protecting the intellectual property of the software vendors, it can also uncover malpractices and make known to the management for corrective measures.

4 Discussion and Recommendation

In every license audit scenario, the outcome is not just ensuring the intellectual property is protected, but it also provides a significant revenue stream to the company. Several existing research studies have been conducted on audit quality. However, more remains to be done in the area software auditing, in particular, software license auditing and how it will inform information security and compliance procedures.

Some security implications relating to license management are:

  1. (a)

    The issue of unauthorized access; In addressing the issue on the sharing of User IDs, proper management of User licenses reduce sharing of User ID thus cutting down unauthorized access incidents to the system. Preventive measures include:

    • Ensuring that every individual is assigned to their own User ID; that way, any access and transactions can be traced back to the individual;

    • Ensuring User Management policy is in place. For instance, if an individual has not logged in for 30 days, the User ID should be locked and if the individual has not logged in for next 30 days, the ID will be invalidated;

    • Authorization assigned to individual IDs should have an expiry date and set access levels that should be approved periodically;

  2. (b)

    Sharing of User IDs potentially leads to the risk of segregation of duties; User ID sharing between a few individuals performing different roles leads to the User ID being authorized in excess of the requirement. For example, an individual may submit a purchase requisition and uses the same ID; the requisition can be approved by the same individual thus making unauthorised purchases through the system that are challenging to uncover by examining the existing system data.

Addressing such licensing concerns, provides the opportunity to organizations to minimize risks related to internal controls.

5 Conclusion and Future Work

License auditing entails a number of processes and a good quality audit is typically defined by several characteristics. There are security implications in the software license auditing sector. This paper highlighted the importance of audit quality, and discussed some of the security implications within the context.

Moreover, the paper explored other research opportunities. One of the future areas of research is to assess and identify further factors that affect the quality of an audit. This could be achieved, for instance, by the application of information seeking behavior and foraging theories and practices, which may also inform other security implications specific to license auditing. In this context, various categories of information, i.e. information as process, information as knowledge and information as thing will need to be analyzed considered, and ‘information as thing’ as a notion will need to be used to assess data in the license auditing process [40]. Data in the context of future research refers to the facts and statistical representation residing in the information system that can be downloaded for analysis.