Receiving a BSA audit letter demanding that a company perform an internal audit or face potential litigation usually results in disruption of normal business activities. The time it can take to resolve a BSA audit matter can depend on a few factors:
1. Number of software installations
The BSA requests an audit of all software installations on the company network, not solely the software installations identified in the audit letter. A smaller company that uses a small number of software products can likely perform a complete audit process easier than a company that has a multitude of products across multiple organizations.
2. Complexity of the network
Network scanning is one of the processes used to identify software installations. Companies with one office are usually easier to scan than companies with multiple offices. Further, companies that use field employees who work remotely and are not always connected to the network can add time and trouble to the scanning process.
3. Record keeping practices
The ability for a company to locate software licenses for the applicable products is often a major factor in the time it takes to complete an audit. Accordingly, providing proof of entitlements to use the software in accordance with the licenses can also be time consuming if record keeping practices are not ideal for retrieving such information efficiently.
4. Control over IT resources
Companies that are adequately staffed with internal IT personnel should be able to assist with technical tasks necessary to scan devices. However, companies should use great discretion as to who it involves in the audit because the source of the alleged problem may not be known. Also, if a company uses contract IT support, an updated non-disclosure agreement should be executed before engaging such support in an audit.
5. Experience of internal and external legal counsel
Coordinating a team to conduct the audit can be the key to an efficient process. Engaging external counsel with experience handling BSA audits can be an integral part of any audit team and should be consulted first before any information about the audit is shared or changes made to systems or licenses.
An audit can be completed in as little as a couple of months to over a year depending on the factors above. Engaging experienced legal counsel as a first step can be helpful to a company to invoke the attorney client privilege, work-product privilege, understand its options and risks, and create a roadmap to an efficient and cost-effective resolution.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
