How to Prepare for an ERP Licensing Audit
how to prepare for an ERP licensing audit
Also searched as
- ERP vendor license audit true-up what to do
- SAP Oracle Infor license audit preparation checklist
- ERP named user vs concurrent user audit
- ERP license compliance review before vendor audit
Short answer
Start before the vendor letter arrives: build your own count of named users, concurrent sessions, modules and integrations, map each to the license metric in your contract, and fix the gaps. Most true-up findings come from dormant accounts, users holding roles above what they need, integrations and APIs counted as indirect use, and modules enabled but never bought.
Applies to: Any on-prem or hosted ERP under a perpetual or term license (SAP, Oracle, Infor, Microsoft, Epicor, and similar). Contract metrics differ by vendor and agreement.
Audit preparation sequence
- 1Pull the signed order forms, schedules and metric definitions. The audit is against your contract, not the vendor's current price list, so find the exact wording for user types, metrics and affiliates.
- 2Export every ERP account with last login date, status, role or security group, and linked HR record. Disable or delete accounts for leavers and shared logins before any count is taken.
- 3Map each role to the license type it consumes. Mark users who only view, approve or enter time versus full users who run planning, costing or configuration.
- 4List every interface and integration (EDI, ecommerce, MES, BI, RPA, custom APIs) and the identity each one uses. Note which human users or customers sit behind them.
- 5Compare enabled modules, company codes, sites or entities to what you bought. Disable what is not licensed and document why.
- 6Compute your own position per metric: entitled versus consumed. Keep the workings in one spreadsheet with source exports attached.
- 7Decide who speaks to the vendor. Route all contact through one owner with legal or procurement, and agree what data you will and will not hand over.
- 8Prepare commercial options before the findings: reduce users, convert license types, or buy the gap as part of a renewal rather than at list price.
What auditors actually count
Vendors audit against the metric in your contract. Typical metrics are named users by type, concurrent users, processors or cores, revenue bands, or entities. A named-user model counts people with an account who could use the system, so dormant but active accounts still count. A concurrent model counts simultaneous sessions, so peaks matter, and the vendor will ask for session logs.
Read the definitions first. Terms like 'user', 'affiliate', 'production environment' and 'indirect use' decide the result more than any count. Non-production copies such as test and training environments are often licensed differently, and a forgotten sandbox can show up as a finding.
Clean up accounts and roles before counting
Start with identity hygiene because it is cheap and fully in your control. Cross-check ERP accounts against the HR system and disable anyone who has left. Look for generic accounts like 'shipping1' or 'admin2' shared by several people, which can be read as multiple users or as a control weakness.
Then review roles. In many ERPs a power-user role can sit on a person who only approves purchase requisitions. Move them to a lower tier or to a self-service or approver license type if your contract has one. Do this through your normal change process and keep evidence of when the change happened.
-- Generic example: inactive accounts in a user table (adapt to your ERP schema) SELECT user_id, last_login_date, role_group FROM erp_users WHERE status = 'ACTIVE' AND last_login_date < DATEADD(day, -90, GETDATE()) ORDER BY last_login_date;
Indirect and third-party access
The most contested findings involve people or systems that touch ERP data without logging in. Examples are a web shop that creates sales orders through an API, a BI tool reading the database, or an RPA bot using a human's credentials. Depending on the vendor and contract, these may be counted as users, as a separate integration metric, or not at all.
Inventory every integration and record the service account, what it reads or writes, and who ultimately benefits. Check your contract for language on indirect, multiplexing or 'third-party application' access. If the wording is ambiguous, get written clarification from the vendor account team before the audit starts, not during it.
Run the audit and negotiate the outcome
When the notice arrives, confirm scope, period, tools and timeline in writing. Vendors may offer a self-assessment script. Have someone technical review what the script collects before it runs, and run it in a controlled way. Keep copies of everything you submit.
Treat the result as a commercial negotiation. A shortfall is typically priced at list plus back-maintenance, but is often negotiable when combined with a renewal, a cloud move or new modules. Having your own accurate numbers lets you challenge overcounts and propose a right-sized settlement.
Common pitfalls
- !Counting only active sessions while the contract counts named accounts, including dormant ones.
- !Deleting accounts or changing roles after the audit notice. Make clean-up routine so timestamps predate the letter.
- !Handing over raw exports or running vendor scripts without reviewing what they collect.
- !Forgetting non-production environments, subsidiaries acquired after signing, and contractors with accounts.
- !Assuming the vendor's sales rep and the audit team share the same interpretation of the contract.
- !Leaving integrations on a single shared service account, which makes it impossible to show who is behind the traffic.
How an ERP-grounded AI assistant handles this
An AI assistant grounded in the ERP's user, role and security tables can answer questions like which active accounts have not logged in for 90 days, which users hold a role they never exercise, and which service accounts write transactions. ERPray is read-only by default and shows the query it ran, so the output is evidence you can check, and it respects ERP roles. It does not interpret your contract; legal and procurement still own the license metric.
Frequently asked questions
Can the vendor audit us whenever they want?
Only as your agreement allows. Most contracts include an audit clause with notice periods, a limit on frequency such as once a year, and rules about who performs it and confidentiality. Read the clause now so you know the notice, scope and cost allocation terms before a letter arrives.
What is a true-up?
A true-up is the payment required when your actual usage exceeds what you licensed. It usually covers the missing licenses plus back-dated support or maintenance for the period of overuse. Some contracts also allow annual self-declared true-ups, which are cheaper than an audit finding.
Does an inactive user still count?
Under a named-user metric, usually yes, as long as the account exists and can log in. Disabling or removing accounts of people who left reduces the count going forward, but it will not erase usage in a period that has already been measured.
Should we get outside help?
For large estates or contested interpretations, an independent license advisor or counsel with experience in your vendor's contracts is often worth the cost. For a small estate with clear named-user terms, a careful internal review and a single point of contact may be enough.
Related
How to Run an ERP User Access Review (Quarterly Checklist)
An ERP user access review is a recurring control where system owners confirm that every active user, role and privileged permission is still justified. Extract users and roles from the ERP itself, join them to HR status, send each business owner a scoped list to certify or revoke, record the decisions, and execute the removals with ticket evidence.
Error fixSyteLine: License Limit Reached and Users Cannot Log In
When SyteLine refuses a login because the license or session limit is reached, the usual cause is not too many real users but stale sessions that were never released: killed browsers, dropped VPNs, service accounts and integrations holding connections open. Find the sessions in the application's session management form, release the dead ones, then fix whatever keeps leaking them.
CIO briefingERP Integration Architecture: API vs iPaaS vs ETL
Choose by what the data does, not by tool preference. Use the ERP's own API (or its native bus) for transactional writes that must be validated by ERP business logic, ETL or change data capture for bulk analytical reads, and an iPaaS when you have many endpoints, need monitoring and retries, and lack the staff to run your own middleware. Most real estates need two of the three.
CIO briefingHow to Securely Give an LLM Access to ERP Data
Treat the LLM as an untrusted component. Give it read-only access through a dedicated, least-privilege path that enforces the asking user's ERP permissions, validate and log every query it generates, require human approval for any write, and decide deliberately where the model runs. Security comes from the architecture around the model, not from the prompt.
How-toHow to Test ERP Backup and Disaster Recovery
A backup is only proven when you have restored it and a user has transacted in the restored system. Define RTO and RPO with the business, restore the full ERP stack (database, application, integrations, attachments, secrets) to an isolated environment, run a scripted smoke test, time every step, and record gaps as action items.
How-toERP Patching Cadence: How Often Should You Patch?
Patch the ERP stack in layers on different clocks: operating system and database monthly or quarterly, ERP vendor cumulative updates quarterly or semi-annually, and security fixes on an emergency path measured in days. Test every patch in a sandbox refreshed from production, with a scripted regression and a tested rollback.
AI for ERPAI for Infor SyteLine and CloudSuite Industrial
Add grounded AI to Infor SyteLine or CloudSuite Industrial: natural-language answers, agents over IDOs and ION, on-prem or CloudSuite deployment.
AI for ERPAI for NetSuite, Beyond the Built-In Text Tools
NetSuite's built-in AI covers text generation, not grounded answers on your own data. See how a private LLM over SuiteQL adds real Q&A and controls.
Stuck on ERP licensing (vendor-neutral)?
Talk to engineers who work inside ERP licensing (vendor-neutral) every week, and who build private AI that answers these questions from your own ERP data.