Software asset management audit program.
How to audit whether software in use is recorded completely, properly licensed and used economically and whether the organisation is prepared for a vendor audit.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation keeps its use of software and cloud subscriptions in line with its acquired rights: through clear responsibilities, a complete inventory, evidenced entitlements and regular reconciliation. It also assesses whether procurement and installation are controlled and whether licences are reclaimed when no longer used.
Scope
- Software installed on clients and servers and software in virtualised environments
- Cloud subscriptions and user-based licences
- Contracts, proofs of entitlement and the software procurement process
- Out of scope: the contractual legal assessment of individual licence terms
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A policy governs responsibility, procurement, use and proof of software licences. | ISO/IEC 27001:2022 Annex A 5.32 | Read the policy and ask the named owners about processes and tools. | Licence management policy, role description |
| 2 | A complete inventory shows installed and used software, including cloud subscriptions. | ISO/IEC 27001:2022 Annex A 5.9; BSI APP.6 | Ask about the inventory data sources and compare coverage with the number of devices and accounts. | Software inventory, discovery tool coverage report |
| 3 | Entitlements, with contracts, invoices and licence keys, are evidenced centrally and completely. | ISO/IEC 27001:2022 Annex A 5.32 | For five vendors, reconcile entitlements with proofs of purchase. | Licence register, contracts, invoices |
| 4 | Entitlements and usage are compared regularly; under- and over-licensing are corrected. | ISO/IEC 27001:2022 Annex A 5.32 | Review the last licence position for the main vendors and trace the handling of shortfalls. | Licence positions, action list |
| 5 | Software is procured only through a defined process that includes licence needs and approval. | BSI APP.6 | Trace five purchases in the last twelve months from request to licence registration. | Purchase requests, approvals, licence register entries |
| 6 | Users cannot install software on their own; installations follow approved channels. | ISO/IEC 27001:2022 Annex A 8.19 | Check technical restrictions on clients and search the inventory for unapproved software. | Software distribution configuration, list of unapproved software |
| 7 | Licence metrics for virtualisation, servers and cloud are applied correctly. | ISO/IEC 27001:2022 Annex A 5.32 | For one vendor with core- or host-based metrics, trace the calculation. | Licence position calculation, infrastructure overview |
| 8 | Licence terms of free and open source software are checked before use. | ISO/IEC 27001:2022 Annex A 5.32 | Review the approval process for freely available software and trace the check for three components. | Approval process, licence checks, component list |
| 9 | The organisation is prepared for vendor audits: responsibility, procedure and data provision are defined. | ISO/IEC 27001:2022 Annex A 5.32 | Ask about the vendor audit procedure and review results of past audits including back payments. | Procedure description, reports of past audits |
| 10 | Licences are reclaimed on leaving, role change or lack of use. | ISO/IEC 27001:2022 Annex A 5.11 | Analyse assigned subscriptions unused for 90 days and check reclamation for five leavers. | Subscription usage report, leaver checklists |
| 11 | Software without vendor support is identified and replaced or treated as a risk. | BSI APP.6; ISO/IEC 27001:2022 Annex A 8.8 | Review the list of software whose support has ended and check replacement plans. | List of end-of-support software, replacement plans, risk acceptances |
| 12 | Management receives regular reports on licence risks, costs and savings. | Good practice | Check reports of the last twelve months for content and actions. | Licence management reports |
Documents to request
- Licence management policy
- Software inventory with coverage report
- Licence register with contracts and proofs of purchase
- Licence positions for the main vendors
- Purchase requests and approvals of the last twelve months
- Cloud subscription usage reports
- List of end-of-support software
- Reports of past vendor audits
Typical findings
- Proofs of purchase for older licences can no longer be found.
- The licence position is only prepared when a vendor audit is announced.
- Users install software themselves, the inventory has gaps.
- Licence metrics for virtualised servers are calculated incorrectly.
- Subscriptions of former employees continue to be paid.
- End-of-support software runs without replacement plan or risk assessment.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing