The licence agreement, which is also referred to as the End-User License Agreement (EULA), always accompanies the sale of genuine software. The EULA is either a paper licence, which is enclosed in the product packaging or is available online.

Impact on the auditor

In the above context, it becomes imperative for both — the internal auditor and the statutory auditor — to include software asset management within the purview of their audit. The following regulatory/legal requirements are particularly relevant where there is illegal use of software in an organisation:

CARO — Statement on the Companies (Auditor’s Report) Order, 2003: As per Companies Act, the statutory auditor’s report has to contain a statement on the following:

“Whether any fraud on or by the company has been noticed or reported during the year. If yes, the nature and amount involved are to be indicated.”

Illegal use of software would be a fraud by the company and would have to be reported in the auditor’s report.

“Is there an adequate internal control procedure commensurate with the size of the company and the nature of its business, for the purchase of inventory and fixed assets and for the sale of goods and services? Whether there is a continuing failure to correct major weaknesses in internal control?”

Software is a fixed asset. If it is being illegally used without payment and the internal control system is not highlighting this point, it would have to be reported in the auditor’s report wherever the item is material.

AS29 – Provisions, Contingent Liabilities and Contingent Assets: This standard mandates and obligates every company to disclose all its possible obligations, which it defines to be contingent liability.

It further states that such obligations also arise for meeting with statutory requirements. Accordingly, infringement of the Copyright Act would result in at least a contingent liability. The auditor should therefore consider whether it has been disclosed or not.

AAS 4 — Auditor’s Responsibility to Consider Fraud and Error in an Audit of Financial Statements: While the management is clearly and primarily responsible, but the responsibility of the auditor about misrepresentation or intentional omissions is an important obligation.

AAS 21— Consideration of Laws and Regulations in an Audit of Financial Statements: Again, while the management is responsible for compliance of the laws in India, but the auditor needs to plan for questioning whether the client is complying with laws and regulations, including those relating to copyright.

AS26 — Intangible Assets: Under this, standard computer software is a separately classifiable category of intangible assets. This needs to be recorded appropriately. If all intangible assets are not reported properly, the auditor should consider the impact on his audit report.

Under Clause 49, the CEO/CFO shall certify to the board that to the best of their knowledge and belief:

“The financial statements do not contain any materially untrue statement or omit any material fact or contain statements that might be misleading;

“There are no transactions entered into by the company during the year which are fraudulent, illegal or violative of the company’s code of conduct;

“They accept responsibility for establishing and maintaining internal controls and that they have evaluated the effectiveness of the internal control systems of the company and they have disclosed to the auditors and the Audit Committee, deficiencies in the design or operation of internal controls, if any, of which they are aware and the steps they have taken or propose to take to rectify these deficiencies.”

These issues are very similar to the ones highlighted under Sarbanes-Oxley (SOX). These assertions also have an impact on the auditor when he gives his certificate on corporate governance report.

Summing up

In summary, bad management of software licences could have the following effects:

An understatement of the number of licences used, due to non-compliance with the software copyright legislation; this should be considered when measuring contingent liabilities and the related accruals for provisions for contingencies to cover charges arising from possible penalties;

An incorrect presentation of intangible assets in the balance-sheet; and

A potential violation that could question the adequacy of internal controls and procedures. This could also be deemed as an irregularity and misrepresentation.

Auditors accordingly need to be more cautious in their approach and cover compliance with laws relating to software as a part of their audit procedures.