Do not send back a number in the first week
A licensing true-up or compliance notice arrives with a response date printed on it, and that date is the most effective part of the document. It pushes people into agreeing to a figure nobody in the building has checked. Two weeks is enough time to work out what is being measured, measure it yourself, and decide which parts of the gap you accept. Spend them on that instead.
Give the work one owner and route every piece of vendor correspondence through that person. Acknowledge receipt in writing, confirm the deadline, and ask for an extension if the window is tight. Vendors grant extensions more often than people expect, especially once you tell them you are running your own measurement. What nobody on your side does is answer questions about counts on a phone call while the answer is still unknown.
Bring counsel in on day one rather than day twelve. The agreement and its amendments govern what you owe, not the definitions page attached to the notice. Someone qualified to read contract language should go through the whole file before your team argues about what a user means. Nothing here is legal advice, and your own wording beats every general rule I can give you.
Find the contract version that actually governs
Ask which contract version the vendor is measuring against, and which clause defines the thing being counted. A customer of ten years standing usually has an original agreement, a pile of amendments, several order forms, and a migration addendum that quietly replaced some definitions. Entitlements move between those papers, so the notice total means little until you know which one produced it.
The measuring definition matters more than the count. Two agreements over the same installed system can produce totals hundreds of names apart, because one counts people authorised to sign in and the other counts people whose work causes a record to be written. Ask the vendor to cite the clause in writing, with the document name and date.
While someone is pulling those documents together, build a single page listing each one, its date, and where the signed copy lives. You will use it again at renewal, where the same reading discipline applies, as our guide to renewal negotiation sets out. Running a licensing change checklist alongside it is time well spent, since vendors often change terms and audit usage in the same quarter.
Reproduce the number before you argue about it
Do not accept the vendor figure as the starting point for your own work. Ask how it was produced, which system it came from, on what date, by which measurement program, and what filters were applied. A notice that hands you a total with no method is not yet a claim you can answer. Most account teams will share the method if you ask plainly, and a refusal tells you something worth knowing too.
Then run the measurement yourself and write it down as a procedure someone else could repeat next month. Keep the extract, the query text, and the row count at each filtering step. Compare against the vendor result name by name rather than total by total, since two figures that agree at the top can be built from different populations. Numbers nobody can reproduce twice fall apart in the room where they matter, the problem behind the metric nobody can reproduce twice.
Where an apparent gap usually comes from
Four sources account for most of the gap I have seen, and all four are arguable. The first is indirect or digital access, where people who never sign in still get counted because a downstream application writes into the vendor system on their behalf. Warehouse scanners, storefronts, and partner portals all create this pattern, and whether those people count depends entirely on wording your counsel needs to read.
The second is non-production environments. Development, test, training, and recovery copies are usually refreshed from production, so every production identity reappears in each of them and gets counted again. Plenty of agreements handle those environments differently, and some exclude them outright. Check the wording before conceding a single name that exists only in a sandbox.
The third is service accounts. Integration users, batch jobs, and monitoring agents get swept into a named user count because an extract cannot tell them apart from people, and separating them needs a naming convention you may not have yet. Our piece on service account identity across platforms covers why that pays for itself. Build the inventory now, with a named human owner against every entry.
The fourth is leavers. Accounts for people who left eighteen months ago and were never deactivated are the easiest item on the list to remove and the hardest to defend out loud. They cost money every month before any notice arrives, which is the argument in the real cost of an unused license. Pull your joiner and leaver records and match them against the active list.
Sort what is left into three groups
Some of the gap is genuine, meaning people using the system in a way your contract plainly covers and you did not buy enough for. Say so internally, early and without drama. Genuine overuse is normal in a company that has grown, and knowing its size gives you room to argue about everything else.
Some of the gap is a definitional disagreement. You read the clause one way, the vendor reads it another, and neither side is being dishonest. Write down both readings, the clause reference, and what each reading costs. That material is worth more to your counsel and your commercial lead than any total, because it turns an argument about money into an argument about language, where evidence exists.
The rest is an artefact of how the data was collected. A run taken against a refreshed sandbox, a snapshot date three days after a bulk onboarding, a script that expanded every group membership into individual names. These come off the table quickly once you show your working, and in my experience they account for the largest share of a frightening first number.
The count that fell apart in nine days
Two years ago I spent a fortnight on this with a mid-sized industrial distributor. The notice put their shortfall at a little over nine hundred names. The finance director had started modelling the cost and the operations lead had decided it was an IT failure, both working from a number nobody in the building had reproduced.
We pulled our own extract on day three. Around three hundred of those names were warehouse operators who touch the system only through a handheld scanning application that posts goods receipts under one middleware account. A hundred and forty had left the company, several of them before the previous annual review. Sixty more existed only in a training environment refreshed from production every quarter.
What remained was roughly two hundred genuine additions from an acquisition the year before, which the company paid for, and the scanning question, which took another four months and a clause-by-clause reading to settle. The fortnight bought us one thing that mattered. We walked into the first call with a list the vendor could check line by line, and the tone of every call after that was different.
You are in a commercial conversation with a deadline
Be honest with yourself about what this is. A vendor measured your usage, produced a figure, and attached a date, and the purpose of the exercise on their side is revenue. That does not make them wrong. It does mean the conversation has a commercial shape, and your position depends on the quality of your evidence rather than how strongly you feel about the letter.
Start with the calendar today. Name the owner, acknowledge the notice, and ask in writing for the measurement method and the governing document reference. Tomorrow, pull your own extract. When the next call comes, the only sentence you need is that you are reconciling their figure against your own and will respond with evidence by the agreed date.
