In a project, you normally get one shot at it. It is the nature of a project to perform a process once or maybe a few times, hardly enough to audit and correct in an ongoing project, unless of course it is one of the supporting processes, like drawing approval, which are repeated again and again as the project moves along.
The people involved in your projects will have all levels of experience, ranging from beginner to experienced; this is just the nature of things.
This means that the more you can enforce the working processes, the less inexperienced personnel can cause problems for you with wrong working processes.
To manage the processes and make sure that everyone follows your procedures you need a tool that can make this happen.
With Project InVision you have a tool at your disposal where you can define all working processes and you can make sure that all work must be performed in accordance with the project quality procedures.
But Project InVision delivers more than a project process tool. It is also possible to use it for all the small and large working processes, which are not project related but still needs correct execution.
In short, this means, that when it comes to monitoring processes, there is only one tool on the market that can handle both worlds. you should consider, when you deal with both projects and everyday “work of the mill”. With Project InVision you can combine the PMBOK of best practices and any ISO 9000 working process.
When you start to define working processes to establish a company standard or maybe you already have it available, you will be able to set this up in Project InVision. By automating the working processes, you will be able to enforce a company standard and at the same you will reduce the necessary training for your staff in order to understand and follow the quality procedures. Teach them how to operate the system, the rest will then follow.

The copyright laws have no recommendations as how to manage your applications and ensure compliance. Some guidelines can be found in the licensing documents from software publishers, but do not expect much help from them. In fact, a lot the time the Software Asset Management problems helps the vendors to create a very good selling point. Based on statistics it is reasonable to assume that you are not on top of the situation.

And if you are not, now is the time to start doing something about this.

Software is expensive and since big money is involved you risk at any given time an audit from a publisher. The publisher knows a lot about your company, and they analyze their sales to you and compare it with statistics on your industry, number of employees, probable number of computers and servers and so on. They identify any statistical deficits very quickly and before you know it, you are up for an audit.

They don’t want to spend time and money on an audit where their statistical analyzes tells them that compliance is likely. They go for the deficits, because that is where the money is.

The only way to protect yourself is to make sure that there is order in your house.

Small or large companies, you need to go about the Software Asset Management task in a structured way.

For each application in use you have to establish

• Licensing requirements
• Number of users
• Installation of application (Where?)
• Integration of application if any(How?)
• Type of application
• Proof of ownership

In addition you should document control of media so you should not bypass the opportunity to create a good and structured media archive.

When the first impression of an IT department is CD’s and documentation lying around on desks and shelves it is very easy to assume that here there is no control and there is no compliance.

Media control is good housekeeping, media, licensing information and proof of ownership represents the values for your company.

Work smart

Traceability is a keyword for good Software Asset Management. I am sure you more than once you have spent time trying to locate a CD or a licensing key. With a good media archive you can achieve traceability; you will have control of all the various aspects of media administration.

With a good structure in place and some procedures in place to maintain it the days of wasting time on looking for media or licensing information is definitely over.

Secure the original media

It is your company’s property, so you have to secure the media and ensure access to it. When not in use lock it up. Make sure you have backup copies of software downloaded or installed from a memory stick. Especially small vendors have a nasty tendency of installing their special application from a memory stick, so you have to follow up on this issue.

When new equipment is delivered discs and the licensing information should be forwarded to you as soon as possible. Mark it, you may need it later if you dispose of the PC and need a valid OS license.

If it is an OEM installation, make sure in your procedures that a backup of the installation is done before any software is installed. This does in fact make a lot of sense; we are not only talking about the OS, but about drivers for the hardware.

Mark the media properly

Another aspect of the traceability is marking the media. Assign an asset key, so that when required you can easily document to steps from procurement to installation including proof of ownership.

An asset key also helps you to keep your archive in shape.

Documentation

How many copies of Windows OS documentation do you need? The most important part of the Windows OS Documentation is the license key. Keep the documentation incl. the license key in your archive, any media enclosed should also be filed.

If the documentation is available in electronic form, install it on a server and make it available for technical staff. Do not let original printed documentation lay around everywhere.

What to expect?

Every time you have to spend time locating a disc, a license string, documentation, a specific download you add unnecessary items to your workload. Structure helps you to perform your tasks quickly, in a professional manner. If an item has to be replaced because it cannot be located and you have to buy it again, it is money wasted. If you have to spend a day or two to find it, it is time wasted. With a good structure in place you will save a lot of time and reduce cost for replacement to zero.  A good structure will help you to complete your compliance efforts easily and your working day will change for the better.

Anyone working with software asset management issues continually faces the problem of  who the software publisher of a specific computer program/registry entry or file. Without this piece of information all other software asset management tasks are stalled. Perhaps you need information about licensing of the product or to find out if an update available? Do you need replacement of the original media? Are you looking for support on the product or just another user manual? What about technical information on the application or to find out if it is compliant with Windows 2007? You could spend hours doing endless Google searches only to find that much of the information you retrieve is out of date, essentially worthless.

From our experience over many years of working with Software Asset Management (SAM) issues we again and again came up against this problem and we had to solve it to complete our work. We spent endless hours online to search for information, and as this issue came up again and again we decided to start building our own database to collect information about software publishers when we came across information we could use.

Over time we found an increase in the number of new software publishers and a rising number of mergers/acquisitions and buy outs. Software companies grow and expand their portfolios partly by buying smaller companies with a portfolio or technology which is of value. We have seen situations where copyright is moved from one company to another several times over during a short period of time. This makes it very difficult to find the correct copyright holder.

This added an extra dimension to the problem of software publisher copyright issues and three years ago we therefore started to continually update our Software Publisher Directory. We follow the software markets closely all over the world and make updates as we learn of the changes. Our Software Publisher Directory will tell you which publisher holds the copyright to the application you are looking for. The software publishing business is dynamic and changes take place every day. Applications can be renamed for marketing purposes so that they fit a new marketing profile once a merger or buyout has taken place. Gone is your application name, even though it still exists, but under a new name.

Our database holds information on more than 13,000 present copyright holders and our historical legacy records on software publishers run into thousands more. Information on publishers which has disappeared through mergers, acquisitions and buy-outs or they have are out of business.

With our Software Publisher Directory you can search for the software publisher based on the name, or even part of the name, of the publisher, historical or not. If the name is historical , our database will return the name of the present publisher holding the copyright of the publisher. We have also added to our database the ability to search by application name; we have an enormous number of applications linked to publisher. Search by application name and the Software Publisher Directory  will return the publisher with copyright to the application. In addition sometimes all you may have is the name of the executable file (EXE file). Again our database is your helper and you can search for the publisher using the name of the EXE file. Finally you can search using the ARP String, retrieved from the “Add/Remove Programs” section of a system’s registry, for identification of the present publisher holding the copyright to the application.

We offer access to our Software Publisher Directory on a subscription basis. We have saved a lot of time ourselves with the database when we work with projects and we are confident that you will too. The Software Publisher Directory is the only service on the market dedicated to software publisher information.

We also offer our subscribers a helping hand. If you cannot find the subscriber in our database, then our team of SAM experts will help you find the publisher you are looking for. Submit the information you have at hand from your subscription page and we will find the publisher for you.

For more information visit our website at http://www.samresource.com .

Now when things get to be real fun.

Over the years most companies have done a horrible job of controlling the acquisition of software. This is especially true in fast growing or start-up companies. Controlling software purchases simply does not occur to them until, often times, it is too late and they end up paying large fines to software publishers or software publisher associations such as the Business Software Alliance (BSA) or Software & Information Industry Association (SIIA.)

That’s the bad news: the good news is that as you complete this process you will finally be able to show some kind of ROI for your efforts. All the work we’ve done in Phases 1 and 2 consisted of spending funds and time with absolutely no return until now. As you move through this phase you should be able to show some savings in maintenance renewal fees as well as establish a “software pool” of available software that will save funds by using licenses from the pool instead of simply purchasing new.

It is my experience, after more than 15 years of working in SAM, that most companies overbuy software. In fact, although I cannot prove this statistically, I believe companies overbuy much more than is reflected by the software in their environment that they did not purchase or at least cannot fine the purchase documents.

The reason we do this process as Phase 3 is that the information learned in Phases 1 and 2 will direct our efforts. In addition one of the challenges is to match the purchase information to the installed inventory. Using information from Phase 2 will assist you here. You can start this phase at any time after you begin Phase 2. I suggest you start collecting the purchase information one publisher at a time. Obviously, as you proceed you’ll find purchase evidence for multiple publishers on the same document (invoice, PO, etc.). Set up a vanilla folder for each publisher and make sufficient copies of the documents to include one in each folder for each publisher.

From the information learned in Phase 2 select those publishers with either the most installs in your environment or those with very expensive applications, such as AutoCAD or other vertical market programs. We do this for two reasons. 1. Available savings will be greatest for these programs and; 2. finding the purchase information should be easier. As you collect the information either enter the information into your SAM program, CMDB or Repository. If you don’t have that application yet, enter the information into a spreadsheet or database.

Keep in mind that tracking software entitlements is often complicated. Some licenses allow for installation of previous and or future versions of applications. Some contracts allow for unlimited installations and others restrict use to a specific number of simultaneous users (concurrent license). If you can I strongly suggest you use a program specifically designed to track software entitlements. Be careful, there are many programs and services available that are less than ideal for this. Some require you to manually enter all the data, some do nothing to help you match your installed data to licenses and other pitfalls. THIS IS COMPLICATED work, if you feel overwhelmed get the help you need. You can refer to our SAMresources.com web site for additional resources to help you.

Purchase documents are documents that show your companies “Proof of Purchase” of software licenses. I’m assuming here that your company is not embroiled in an enforcement audit. Proof of Purchase documents for that kind of legal action are NOT the same as you should use for your internal purposes. For internal use the following should constitute sufficient evidence for ownership of software. I’ve listed these items in order of reliability In other words item number 1 is the most reliable document while item 3 is the least reliable.

1. Paid vendor invoices with sufficient descriptions, serial numbers, quantities that show that you actually wrote a check for the software license(s).
2. Third party records. If you purchase some or all of your software from the same distribution company they should be able to provide you with an accurate report of software license(s).
3. Original media, which consists of the original CD/DVD disks, licensing documents, original manuals (probably a very old program), certificates of authenticity, etc. Once you’ve collected these items you should create a secure “Software Library” to store the items. I suggest you create a file pocket for each publisher and folders within that pocket for each program. Depending on the publisher you may want to go further and designate a complete file drawer to a major publisher in your environment. Make sure that you have the ability to lock this file cabinet (room) and control access.

(The first two are far and away the most reliable sources for Proof of Purchase information.)

If you company is like most others the sources of this information will be spread all over your company. You’ll find purchase information in invoices from software distributors, software publishers (direct purchases), on employee expense reports, on company credit card records and the list goes on. Proceed with your work diligently but keep in mind the objective is to show significant ROI for your efforts. Given that how long should you take to find the purchase documents for a program costing $24.95? How long for a program costing $49,995? If you just had an “ah ha” moment, you’ll do well.
Keep in mind that it may be more cost effective to just purchase new licenses of some programs, instead of spending hours and hours poring over travel expense reports, accounting records, file drawers and storage areas trying to locate the proof of purchase for an inexpensive program.
You will also find purchases of license for more software than is currently installed. These license become your “license pool” available for deployment to new requirements.

The next process in this phase is comparing the installed software to your entitlements.

Now you can take control of payment of the maintenance for these applications. Reconciling maintenance invoices to installed data is perhaps one of the “lowest hanging fruits” that will show a return to your company for your efforts.

The last process in this phase is to determine what type of license is best for each program you have. Would a per server license be more cost effective than a per seat license. All the major publisher have programs suited for different environments. Microsoft has a myriad of programs available from “Select Agreements” to “Master Agreements” for entire companies. If you don’t have a lot of experience here I suggest you get help and get it early in your process. Every few years you will be renegotiating your licenses. Significant savings are available by choosing the right license for your needs. Again, you can refer to our SAMresources.com web site for additional resources to help you.
Some of you will wonder: What about all the software installed that is not represented in the ARP data analyzed in Phase 2? In Phases 4 and 5 we will discuss those problems and how to resolve them.

The self assessment process shows you if you are on the right track to achieve your goals, and it can also show you where you can find room for improvement in your working processes.

How to define the metrics.

What can you measure? Any working process in your department can be measured. Whether it is opening a new user account, setting up new a PC, ordering software, answering a call on the help desk – all these processes can be defined and measured.

The way to do this is to set up a flow diagram, and define the working steps one by one until you have the defined the complete process.

For each step in the process from beginning to end you should define the input needed to start the step, how the step is to be performed and finally, the result of the process. The process also involves defining 4 roles or levels of participation in the different steps of the process, execution defines the person who I doing the job, which normally means the person who is responsible. P for participation, who takes part in the process step, I for information, who, if any, needs to be informed about the result of the step.

I have created a simple tool for this task, maybe not the most advanced spreadsheet you have ever seen, but it works and I use it when I describe processes and write working procedures. You can download it free from my website.

As you work your way through the process you are defining, make sure that all important steps to complete a process are included. Have a special focus on the part of the process where you have little or no influence. Your interaction with other departments is important to measure, so define the steps where you need information from other departments or give information to other departments with great care.

As an example, if you are defining how to open a new user account as a process, then you can have the following steps 1) receive requisition for new user 2) crate new user on the network 3) Update user list 4) Update Hardware Inventory list 5) Update software licenses 6) Report back when everything is ready

If you in addition define the 4 levels of participation in the process, your procedure is ready.

How to do the self assessment / internal control

The self assessment is a process where you go through all the steps required to perform a task, step by step as defined in the procedure. If the step is performed satisfactory, you have a situation that is called compliance. Compliance means that all is working well without errors. If the step is not performed satisfactory, you have a situation we call non-compliance. Non-compliance means that there are some errors in performing the work, and these errors have to be corrected.

When you have compliance, you can complete your internal control. All is working well and according to procedure, just write a small report on your findings and send a copy to your immediate superior. Never forget the internal marketing you should do to improve your standings.

If you have a non-compliance situation, you will have to ask yourself the following questions:

Are there errors in the way I perform the internal control? If you have errors in the way you do the internal control, it is easy to correct and then just repeat the process to see if your result is correct.

Are there errors in the working procedures? A non-compliance situation may be a good indication. If the working procedure contains logical errors, people will bypass the steps you have defined simply because it prevents them from doing their job they feel it should be performed. After analyzing the situation and if you find errors in the procedure, correct the error, implement the procedure again and do a new self assessment.

Are there errors in the implementation process? If the procedure is defined the way you want it to work and people do not follow it, then you have to consider your implementation process. Perhaps you have to repeat it, or discuss the steps where you have non-compliance with your subordinates so that they understand the importance of performing the procedure as described and not bypassing any of the steps.

If there are errors in the procedure they have to be corrected, and a new training has to be done.

If people bypass and the procedure works the way you want, a new training is also required.

Self Assessment of your procedures is a very good tool to improve performance and verify that you keep the level you want. More so, when you have a Service Level Agreement (SLA) with your users and you have to verify performance from time to time. Then self assessment becomes a part of your regular working routine and you can document your service level with your self assessment reports.

I have seen user IDs using initials, first two letters of the first name, then three letters of the family name or first name and a number, well – the solutions are many, but they all have one thing in common.

They don’t help you to get a good grip on the user management.

Over the years I have audited many networks, and initiated deletion of 1000′s of user accounts no longer in use.

If the user accounts belong to people no longer in the company, why are they not deleted?  Very often, the communication between the IT Department and other departments in the company suffers from lack of a good or structured information flow.

• If a new user arrives, IT management is not informed
• If a users changes department or moves, IT management is not informed.
• If a user leaves the company, the IT Management is not informed.

In order to get on top of the situation with user administration, you should use base your user ID syntax on information from the best quality list there is. It is not your list of email accounts; it is not your list of network users, it is not the list of valid electronic entrance cards.  The only list of users you can rely on 100% is the list of employees receiving a salary, or the payroll list. This list is updated daily, and the maintenance of this list follows laws and regulations. Therefore the payroll list is the only logical choice when it comes to user ID.

The payroll has a unique identifier for each employee, this is the payroll number. If you use this as your user ID you will have the best and easiest maintained user administration system in place that you can possibly imagine.

The nice thing with the payroll ID is that it normally means nothing; it is just a unique identifier for a specific person. It is internal, which means that the user ID cannot be used for any other purpose than correct identification of a specific person.

• If you use a first name, last name syntax, how do you handle users with the same name?
• If John Smith has left the company, which John Smith are we talking about?
• If you need to do a check of the user accounts for whatever reason, are you prepared to suit down and map your users against a list of valid employees
• If you use the payroll ID as a user ID, this match and control is done in seconds, instead of hours or days or never.
• Can you imagine a verifying process of the user accounts to all your systems in minutes instead of weeks?

This is what will happen if you introduce payroll ID as the user ID.
If you put the requirement into your procedures, you will also get rid of the regular surprise, when a new user suddenly appears and wants a PC and access to the systems. Introduce the concept of no user account without a payroll ID, and you will force discipline into the system. By creating structured procedures , you can place the responsibility for the new user where it belongs, to his or her immediate superior.

These regular “surprise” request sucks, and your working day is interrupted every time it happens. It gets even worse when the new user has special requirements and you have to buy hardware or software to complete the process. Time is wasted, the new user is surprised, the manager is angry because of lack of professionalism and you are blamed because he has no one else to blame it on.

Use the new user ID and a structured process to turn this situation around and create a structured process for new user management. You and the company will benefit from this.