Audit tools viewpoint

Rob Harmer

Informations

• Publié par: Sazef
• Nombre de lectures: 17
• Langue: English

Extrait

PCProfile Software Compliance Toolkit Copyright 2005 Rob Harmer Consulting Services Pty Ltd © All Rights Reserved Worldwide

Audit tools viewpoint


Our View on Audit Tools
Our view, which has been gleaned from many of our customers around the world, since 1991, is that software
compliance auditing should;

• be fast,
• be accurate,
• be easy to do,
• be available on demand,
• not involve rocket science,
• be done as little as possible,
• not deliver false positive results,
• be done at the absolute minimum cost,
• provide un-encrypted results data files,
• not introduce risk through port scanning,
• not require database/definition file updates,
• not require annual maintenance of up to 25%,
• make the end-user fully accountable for their actions,
• not require extensive bandwidth and network resources,
• not require expensive specialist staff with technical skills,
• not slow the network down due to intensive data gathering,
• should only focus on the changes that have occurred between audits,
• MUST reduce risk of being caught with illegal software, music and movie titles,

and finally, allow the organisation to free up expensive technical and specialist resources so they can focus on
issues that are far more important to their business survival i.e. core business activities!

It's as simple as that!

Are you getting good value from your existing software audit tools where you are paying annual fees for
maintenance and upgrades of up to 25% p.a.?

We are certain that your core business is NOT auditing and that you have other, more important
reasons to be in business, and could benefit from spending your money more wisely.
Selection Of Audit Tools
Selection of the "right audit tool" really is dependant on what you are trying to establish and the method that is
to be used also determines tool selection. For “method” you need to consider whether the audit is to be done
"out in the open" or "done covertly". Both methods have their disadvantages and advantages.

For example, are you looking to identify;
§ All software installed on the system?
§ Only selected items of interest?
§ How may copies of a particular product are installed across a department?
§ How may copies of a particular product across the company?
§ Shareware and freeware installed?
PCProfile Software Compliance Toolkit Copyright 2005 Rob Harmer Consulting Services Pty Ltd © All Rights Reserved Worldwide
Page 1 of 2

PCProfile Software Compliance Toolkit Copyright 2005 Rob Harmer Consulting Services Pty Ltd © All Rights Reserved Worldwide
§ Games, sound files?
§ MP3's, Video clips etc?
§ Pornographic images?
§ Illegal and unauthorised software?
§ All of the above?
§ Consolidated lists of installed details with asset entries matched? ie; Matched data sets of installed
software with accounting records?
§ Location of media, disks and manuals, licences etc?
§ Location of proof of purchase details?
§ Evidence of accounting records validating ownership of licences?

You may find that there is no one tool on the market that will satisfy all the needs in a single pass, and that
additional tools, and effort, will be required.


HELPFUL HINT
You need to use an audit tool that is fit for your purposes!

It is no good paying an “arm and leg” in terms of license costs upfront plus 18% to 25%

annual maintenance for the worlds “biggest and best” tool that ends up filling up your hard
disk space (some do it daily on log on) and server space with audit data, if the data is never

analysed and used effectively. Have you checked how effectively your existing audit tools
are being used? Make sure that you are deriving value for money!


How can you detect what has been installed?
The tools on offer from PCProfile are the "electronic engine room" of the auditing cycle in so far as they provide
the electronic means to very rapidly identify and detect without a database what is installed. Then they provide the
means to upload that detail in CSV format to any database or spreadsheet or asset register you may wish to
utilize without being held in encrypted or locked down format. They provide the means for you to tailor reports to
suit your own needs using Crystal Reports etc or SQL Server.
After the electronic audit is completed you need to verify that what is installed is covered by licenses and proof of
purchase and there is NO software on the market that can do that for you. If the other audit tools you are
evaluating claim that using their tool "is all you need consider" then they are misinforming you.



MORE TIPS
TIP 1
Make the end -user fully accountable for their actions,
TIP 2
Make the end-user “share the pain” (fines, legal fees etc) if they are caught infringing
your copyright compliance code of ethics!




PCProfile Software Compliance Toolkit Copyright 2005 Rob Harmer Consulting Services Pty Ltd © All Rights Reserved Worldwide
Page 2 of 2