StackMatch

Software License Compliance: The Same Sprawl Math, Triggered by a Vendor Audit Instead of a Bill Review

Most license compliance exposure isn't dishonesty — it's the same subscription sprawl a stack audit would flag anyway, just discovered by a vendor's audit letter instead of your own bill review.

By The StackMatch Research Team

A 20-person company running 35 active seats because 15 departed employees were never deprovisioned is paying for licenses nobody uses — the same waste a stack audit catches, just found by a vendor instead

15 unused seatsTypical gap when deprovisioning isn't part of offboarding
$20-40/seatTypical monthly cost per unused productivity-suite seat
$300-600/moCost of 15 undeprovisioned seats, at typical per-seat pricing

Illustrative math based on typical per-seat productivity and security tool pricing — scale to your own vendor's per-seat rate.

A vendor audit letter feels like a legal problem, but the finding underneath it is almost always the same one an internal spend review would have caught for free: seats that were never turned off. A company that hired fast, had a round of departures, and never built deprovisioning into its offboarding checklist ends up with active licenses attached to people who haven't worked there in a year — and when a vendor's audit team reconciles purchased licenses against active installs, that gap is exactly what shows up as "non-compliance," even though nobody did anything dishonest.

Why audits happen

Vendors reconcile licenses for structural reasons more often than adversarial ones: a company grew fast enough that seat count and purchased licenses drifted apart, an enterprise agreement includes a scheduled true-up the customer forgot was coming, or a acquisition/reorg surfaced two companies' license counts that were never merged. Large platform vendors run this as a routine part of account management for bigger customers — it isn't usually a targeted "gotcha," it's a reconciliation that happens to land on a company that hasn't done its own in a while.

Reconciling seats against actual users is the same exercise whether you run it yourself or a vendor runs it for you — the only variable is who finds the gap first.

The three patterns that actually cause exposure

Common compliance gaps, and how they're found

PatternHow it happensTypical fix cost
Departed-employee seatsOffboarding checklist doesn't include license deprovisioningCancel the seat — pure savings, no penalty
Wrong license typeA personal/home-tier license used commercially, often inherited from an early hire's own accountUpgrade to the correct commercial license, back-billed
Contractor/freelancer accessOutside contractors given a seat on the company's license instead of their ownRemove access; contractor uses their own license

The contractor pattern is worth naming specifically: a freelancer using your company's license for their own work is your liability if the vendor reconciles it, not theirs — require contractors to use their own licenses, full stop.

What the exposure actually costs

Monthly cost of undeprovisioned seats, by team size and per-seat rate

$300-600/mo
typical cost of 15-20 undeprovisioned seats at common per-seat pricing
That's money leaving the business every month whether or not a vendor ever sends an audit letter — the audit just makes it visible.

The reconciliation, run on your own schedule

A quarterly license reconciliation, before a vendor runs one for you

  • Pull the full list of active seats/licenses from every major vendor — not just what the last invoice showed
  • Cross-reference against current headcount: does every active seat map to a current employee?
  • Flag any license type used by someone whose role doesn't match it (personal-tier license, contractor on an employee seat)
  • Add license deprovisioning as a mandatory step in the offboarding checklist — not a follow-up task, a blocking one
  • Confirm who owns this reconciliation — an unowned task is the one that lapses after the first quarter

Deprovisioning is an access-control problem before it's a compliance problem — a departed employee's still-active seat is both at once.

If an audit letter does arrive

Respond, don't ignore — most agreements specify a response window, and missing it is its own separate problem. Run the same reconciliation above internally before responding, so the company's own numbers are known before the vendor's are compared against them. And treat any settlement as negotiable: vendors generally expect to land somewhere below their opening number, especially when the gap is clearly unintentional deprovisioning drift rather than deliberate underlicensing.

The best defense against a license audit is the same discipline that prevents any other kind of software sprawl — know what's actually running, cancel what nobody's using, and make deprovisioning a real step in offboarding rather than an assumption.

Run the free StackMatch audit to see your current license and seat count against actual headcount — the same reconciliation a vendor would run, done on your own schedule.

Run your own audit
More from the blog