Your Company Received a Software Audit Letter: Do You Have to Comply, and What Is the Exposure?

Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).

It depends on who is asking and under what right. If your license agreement contains an audit clause, you owe what that clause requires and no more. If the letter comes from a trade association or a law firm with no contract behind it, the letter alone does not compel a self-audit, though ignoring it invites a copyright suit where the same facts come out in discovery. The claim underneath is infringement. (17 U.S.C. § 501(a).) Kolmogorov Law, P.C. defends businesses in Orange County, Los Angeles, and across California.

Call (909) 235-6116 or contact us online to discuss a software audit letter before you run any inventory or send any numbers.

Two kinds of software audit letter

The first kind comes from the publisher or its auditor, cites your license agreement, and is a contract demand, since many enterprise licenses give the publisher a right to verify that you use only what you bought.

The second kind comes from a trade association or an outside law firm. It typically says the sender has "received information" about unlicensed software, sometimes from a former employee, and it asks you to audit every computer, report the results, and preserve evidence. It usually cites no contract. Its real basis is a threatened copyright claim.

Tell them apart before you do anything else, because the right response to one is wrong for the other.

What a contractual audit clause can and cannot require

Read the clause itself. I look for six things.

• How much notice the publisher must give.
• How often it may audit.
• Which products and which legal entities are covered.
• Who performs the audit and with what tools.
• What confidentiality protects your data.
• Who pays, and what happens if a shortfall is found.

You owe the audit the clause describes. Unless the clause says so, you do not owe a scan of every device for every product the publisher sells, and you need not run a script whose output you have not reviewed. Scope, method, and confidentiality are routinely negotiated, and an auditor should sign a nondisclosure agreement first.

Check the clause for a response deadline and calendar it. A trade group's deadline is only the sender's choice, though silence has consequences. Refusing a valid audit can be a breach of contract in its own right. Our page on IP license disputes covers how audit clauses are enforced.

When the letter rests on copyright alone

A trade group has no contract with you, so it can only sue, or have its member sue, for infringement. Two points follow.

First, ask whom the sender represents, because only the legal or beneficial owner of an exclusive right may bring an infringement action. (17 U.S.C. § 501(b).)

Second, not every licensing shortfall is infringement. In the Ninth Circuit, breach of a term that limits the scope of the license can be infringement, while breach of any other term is only a contract claim. (MDY Industries, LLC v. Blizzard Entertainment, Inc. (9th Cir. 2010) 629 F.3d 928, 939, as amended Feb. 17, 2011.) Installing a program on more machines than you paid for is usually on the infringement side of that line. A dispute over how a license metric is counted may not be. Our page on software copyright infringement explains the difference.

You are not required to hand a self-audit to a stranger. You are well advised to know the answer yourself.

Run the internal review through counsel

Set up the first inventory so that privilege can apply. In California a client may refuse to disclose a confidential communication with its lawyer. (Evid. Code, § 954.) When counsel directs the review in order to give legal advice, the analysis and advice are generally protected. The underlying facts, such as what is installed on a given machine, are not.

That distinction shapes the process: keep the working spreadsheet within a small group, and do not email guesses about how bad it is. Our page on attorney-client privilege for business owners explains how the protection is kept and lost.

Preserve before you fix. Take a dated snapshot of installations and license records, then remediate. Wiping machines after a preservation demand is the kind of step that turns a licensing gap into a spoliation problem. See our page on litigation holds.

Why buying licenses now does not erase past use

The instinct is to buy the missing licenses the day the letter arrives. Buy them, but understand what that does.

New licenses cover use going forward. They do not release claims for the months or years of use before the purchase, and a purchase order does not come with a settlement. The publisher can still sue for past infringement within three years after the claim accrued. (17 U.S.C. § 507(b).)

How these claims are valued

Opening demands are often built from the full list price of every unlicensed copy, sometimes with a multiplier, plus the sender's attorney fees. That is a negotiating formula, not the legal measure.

The Copyright Act offers two measures, and the first is actual damages plus the infringer's attributable profits. (17 U.S.C. § 504(b).) For business software, that usually points to the license fees that were not paid.

The second is statutory damages of $750 to $30,000, and up to $150,000 for willful infringement. That award is made for all infringements of any one work, so it is counted per program, not per installation. (17 U.S.C. § 504(c).) Fifty unlicensed copies of one program are one work. Statutory damages and fees also generally require registration before the infringement began. (17 U.S.C. § 412.)

Those rules often bring the real exposure well below the opening number, and they also show where it is serious: many different programs, long periods, and evidence that management knew.

Settlement and release terms

Many audit disputes settle, and the payment is only one term. I pay as much attention to these.

• A release covering all of the publisher's products through the settlement date, for the company and its affiliates.
• No admission of liability.
• Confidentiality, including no press release naming the company.
• Limits on future audits, such as a period of repose.
• A reasonable compliance certification, not an open-ended inspection right.

If the software in question includes open source components, different rules apply. See our page on open source license violations.

What to bring to the first meeting

• The audit letter and any follow-up correspondence.
• The license agreements, order forms, and renewal records for the products named.
• Any existing software inventory or asset management report.
• Anything that suggests who made the report, such as a recent contentious departure.

Frequently asked questions

We got a letter from a software publisher's lawyers demanding a self-audit of every computer. Do we have to comply?

Only to the extent your license agreement requires it. Read the audit clause for notice, scope, and method, and hold the publisher to those limits. If no contract gives an audit right, a California business has no duty to self-audit for the sender, but it should have counsel direct an internal review and send the response.

What is a software license audit?

It is a publisher's review of whether a customer's use of its software matches the licenses purchased. Some audits are contractual, based on a clause in the license agreement. Others are informal demands backed by the threat of a federal copyright claim. For a California company, the first step is identifying which kind it has received.

Can we just buy the missing licenses and ignore the letter?

Buying licenses fixes future use but not the past. Unlicensed use before the purchase can still support a copyright claim for three years after it accrued. (17 U.S.C. § 507(b).) A California business should document its position, buy what it needs, and obtain a written release for prior use as part of any resolution.

How much can a software publisher recover for unlicensed copies?

Either actual damages and attributable profits, or statutory damages of $750 to $30,000 per work, up to $150,000 if willful. (17 U.S.C. § 504(b), (c).) Statutory damages are counted per program infringed, not per copy installed, and generally require timely registration. In California federal courts, attorney fees may be added in the court's discretion.

A former IT employee reported us to a software trade group. Can they use what he took from our systems?

Possibly, but how he obtained it matters. A tip based on what an employee saw at work is one thing, while internal files copied on the way out may raise confidentiality and computer access issues under California law. Tell your lawyer what he had access to. Do not contact or threaten the former employee yourself.

Talk to a California software copyright defense attorney

If your company has received a software audit demand, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is located at 327 Magnet, Irvine, CA 92618, and represents businesses in Orange County, Los Angeles, and throughout California. See also our page on copyright infringement letters and our intellectual property litigation page.

This page provides general information about copyright and contract law and is not legal advice. Outcomes depend on the license agreement, the installation records, the facts, and the court.