# How to Prepare for an ERP Licensing Audit

> Source: https://netray.co/erp-help/itm-erp-licensing-audit-vendor-true-up-prepare
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: ERP Help

## Short answer

Start before the vendor letter arrives: build your own count of named users, concurrent sessions, modules and integrations, map each to the license metric in your contract, and fix the gaps. Most true-up findings come from dormant accounts, users holding roles above what they need, integrations and APIs counted as indirect use, and modules enabled but never bought.

## Kind

how-to

## System

it-leadership

## Erp

ERP licensing (vendor-neutral)

## Module

License compliance / Vendor audit

## Query

how to prepare for an ERP licensing audit

## Alternate Queries

- ERP vendor license audit true-up what to do
- SAP Oracle Infor license audit preparation checklist
- ERP named user vs concurrent user audit
- ERP license compliance review before vendor audit

## Applies To

Any on-prem or hosted ERP under a perpetual or term license (SAP, Oracle, Infor, Microsoft, Epicor, and similar). Contract metrics differ by vendor and agreement.

## Steps

### Audit preparation sequence

**Items:**

- Pull the signed order forms, schedules and metric definitions. The audit is against your contract, not the vendor's current price list, so find the exact wording for user types, metrics and affiliates.
- Export every ERP account with last login date, status, role or security group, and linked HR record. Disable or delete accounts for leavers and shared logins before any count is taken.
- Map each role to the license type it consumes. Mark users who only view, approve or enter time versus full users who run planning, costing or configuration.
- List every interface and integration (EDI, ecommerce, MES, BI, RPA, custom APIs) and the identity each one uses. Note which human users or customers sit behind them.
- Compare enabled modules, company codes, sites or entities to what you bought. Disable what is not licensed and document why.
- Compute your own position per metric: entitled versus consumed. Keep the workings in one spreadsheet with source exports attached.
- Decide who speaks to the vendor. Route all contact through one owner with legal or procurement, and agree what data you will and will not hand over.
- Prepare commercial options before the findings: reduce users, convert license types, or buy the gap as part of a renewal rather than at list price.

## Sections

### What auditors actually count

**Body:**

Vendors audit against the metric in your contract. Typical metrics are named users by type, concurrent users, processors or cores, revenue bands, or entities. A named-user model counts people with an account who could use the system, so dormant but active accounts still count. A concurrent model counts simultaneous sessions, so peaks matter, and the vendor will ask for session logs.

Read the definitions first. Terms like 'user', 'affiliate', 'production environment' and 'indirect use' decide the result more than any count. Non-production copies such as test and training environments are often licensed differently, and a forgotten sandbox can show up as a finding.

### Clean up accounts and roles before counting

**Body:**

Start with identity hygiene because it is cheap and fully in your control. Cross-check ERP accounts against the HR system and disable anyone who has left. Look for generic accounts like 'shipping1' or 'admin2' shared by several people, which can be read as multiple users or as a control weakness.

Then review roles. In many ERPs a power-user role can sit on a person who only approves purchase requisitions. Move them to a lower tier or to a self-service or approver license type if your contract has one. Do this through your normal change process and keep evidence of when the change happened.

**Code:**

-- Generic example: inactive accounts in a user table (adapt to your ERP schema)
SELECT user_id, last_login_date, role_group
FROM erp_users
WHERE status = 'ACTIVE'
  AND last_login_date < DATEADD(day, -90, GETDATE())
ORDER BY last_login_date;

### Indirect and third-party access

**Body:**

The most contested findings involve people or systems that touch ERP data without logging in. Examples are a web shop that creates sales orders through an API, a BI tool reading the database, or an RPA bot using a human's credentials. Depending on the vendor and contract, these may be counted as users, as a separate integration metric, or not at all.

Inventory every integration and record the service account, what it reads or writes, and who ultimately benefits. Check your contract for language on indirect, multiplexing or 'third-party application' access. If the wording is ambiguous, get written clarification from the vendor account team before the audit starts, not during it.

### Run the audit and negotiate the outcome

**Body:**

When the notice arrives, confirm scope, period, tools and timeline in writing. Vendors may offer a self-assessment script. Have someone technical review what the script collects before it runs, and run it in a controlled way. Keep copies of everything you submit.

Treat the result as a commercial negotiation. A shortfall is typically priced at list plus back-maintenance, but is often negotiable when combined with a renewal, a cloud move or new modules. Having your own accurate numbers lets you challenge overcounts and propose a right-sized settlement.

## Pitfalls

- Counting only active sessions while the contract counts named accounts, including dormant ones.
- Deleting accounts or changing roles after the audit notice. Make clean-up routine so timestamps predate the letter.
- Handing over raw exports or running vendor scripts without reviewing what they collect.
- Forgetting non-production environments, subsidiaries acquired after signing, and contractors with accounts.
- Assuming the vendor's sales rep and the audit team share the same interpretation of the contract.
- Leaving integrations on a single shared service account, which makes it impossible to show who is behind the traffic.

## Ai Angle

An AI assistant grounded in the ERP's user, role and security tables can answer questions like which active accounts have not logged in for 90 days, which users hold a role they never exercise, and which service accounts write transactions. ERPray is read-only by default and shows the query it ran, so the output is evidence you can check, and it respects ERP roles. It does not interpret your contract; legal and procurement still own the license metric.

## Faq

### Can the vendor audit us whenever they want?

**Answer:** Only as your agreement allows. Most contracts include an audit clause with notice periods, a limit on frequency such as once a year, and rules about who performs it and confidentiality. Read the clause now so you know the notice, scope and cost allocation terms before a letter arrives.

### What is a true-up?

**Answer:** A true-up is the payment required when your actual usage exceeds what you licensed. It usually covers the missing licenses plus back-dated support or maintenance for the period of overuse. Some contracts also allow annual self-declared true-ups, which are cheaper than an audit finding.

### Does an inactive user still count?

**Answer:** Under a named-user metric, usually yes, as long as the account exists and can log in. Disabling or removing accounts of people who left reduces the count going forward, but it will not erase usage in a period that has already been measured.

### Should we get outside help?

**Answer:** For large estates or contested interpretations, an independent license advisor or counsel with experience in your vendor's contracts is often worth the cost. For a small estate with clear named-user terms, a careful internal review and a single point of contact may be enough.

## Search terms

ERP license audit, ERP true-up, named user license audit, ERP indirect access, ERP license compliance, vendor software audit preparation, ERP concurrent user license, ERP contract audit clause, reduce ERP license cost

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json