What's an acceptable "out of compliance" number?

I was privy to an interesting conversation a few weeks ago...the topic was "What level of non-compliance is acceptable?". Basically the basis for the discussion was that being illegal on some licenses was to be expected but at what level does it become an issue.

Before jumping into all sorts of morality issues, I'll stop myself and instead put this in the context of...assuming it will cost me money to prove every single license, is there a point at which I can say "under this amount is not worth the cost"?

Now, morally I don't feel there is a number greater than zero that can be acceptable. If you can't prove licensing for a single product, you owe it to yourself and the publisher who invested their time and resources into its creation to buy the product (and then keep better records).

Getting off my moral high horse I will point out that running even a single copy of software that you can't prove licensing for is a risk to you and your organization. As with any risk to your organization, your organizations risk assessment framework should address this topic for you. But remember - you can't manage what you don't know and you can't apply a risk assessment if you don't have the details!

What are your thoughts?

Is the business world ready for embedded controls in software?

I was at the SAM Summit last week (www.samsummit07.com - check it out for future years as I was very pleased with the dialog's started) and the topic of embedded controls came up (think Adobe's License Manager or Microsoft's Vista for example) in a small group session I was leading.

The question we were dealing with is "what did we think was the future or embedded controls and would the user community rebel". My group was a nice blend of 3 reps from end-user companies, 2 tool reps, 1 publisher rep and myself (a SAM services rep). Quite frankly, with this blend we didn't answer the question...but we had some great dialog.

From the industry side (tools & publisher) came the steadfast belief that these controls are here to stay and are necessary. From the end-user side came a lot of uncertainty and concern...but frankly none of them had even tested the controls yet to know if their concerns were founded.

Now, don't take me wrong...I am not envious of any company facing enterprise-wide rollout of software with embedded controls - I've lived in the IT world too long to think it's going to go smoothly. However; until we at least test it - it's pure speculation! I know some of my readers have to have tested (and some potentially deployed) software with embedded controls. What's your reaction? What has experience shown you?

Are embedded controls bad for the end-user community or can they do their job and simplify our SAM headaches? Who should have control over who the control reports to (publisher or internal SAM)? Give us your thoughts and experience.

Startups and Small Companies Exempt from Buying Software?

I was at a CFO conference last month and had an interesting discussion with another attendee over lunch one day.

This attendee (we'll call him Jeb) is the CFO of a small firm in California. This is not his first time at being a CFO and is an intelligent, articulate gentleman who endorses an entrepreneurial spirit within his company.

The conversation started out the usual way with him asking what my firm does (Software Asset Management-SAM) and then asking a variety of questions about how SAM benefits companies. The conversation then turned towards compliance and he shared that a former company had been audited by the Business Software Alliance (BSA) right before he had gone to work for them and had been fined due to inappropriate use of software licenses. He described some of the financial and operational pain the company had experienced as a result of not being properly licensed.

Finally, the conversation turned to the financial impact of outfitting an organization with software licenses. Being a business owner myself, I could definitely commiserate with Jeb over the costs to properly outfit an organization. However; I was amazed to hear him share his viewpoint that start ups and small businesses shouldn't be expected to license every computer.

Frankly, I was blown away. Here was an intelligent, financial professional stating that companies should be allowed to break the law, steal intellectual property, and essentially mis-state their financial earnings (when you realize that they wouldn't be including a major cost to doing business...buying software).

Desperately trying to stay off of my soap box, I raised these issues with Jeb. I tried every logical argument to try to have him understand how integrally unethical his viewpoint is...I hope I at least gave him something to think about. Unfortunately, he's not alone in his viewpoint...can someone please explain to me how you can morally or ethically justify software piracy?

Weeks later and it still amazes me...