Many organisations embark on a journey to implement SAM or enhance their current practices without a clear view of what is required or the objectives they want it to achieve. This means they are missing the mark on reducing compliance and financial risk exposure, incurring unnecessary or unplanned costs, increasing vulnerability to cyber-attack, and more. To overcome this, a strong SAM operating model is essential.
Software Asset Management (SAM) helps organisations to maintain a ‘source of truth’ for its software assets and licences across end-user-computing, infrastructure and cloud environments. This data source should help the SAM function to better manage compliance risk, unnecessary costs, and to mitigate against cyber-attack. It should ideally support strategic decision making and aligning the organisation’s software needs against its current and future needs.
As organisations seek to achieve a mature SAM framework, they often implement asset data management software such as Flexera, Snow, ServiceNow, Aspera etc., in the hope this will be a quick fix and reduce all risks related to software management. However, while a SAM software tool is essential, organisations can fall into the trap of not having a robust and flexible operating model to support it.
This means a company may be unclear on the right processes, technology and people to ensure an effective SAM framework. For example, who is responsible for steps such as data upkeep, identifying compliance issues, reporting issues, working to prevent risks, and keeping costs in check?
Without a clear operating model for SAM, the business could remain exposed to risks and costs, and could be missing out on the range of other benefits that SAM will provide.
Building the SAM operating model
Essentail components include:
Organisational structure
SAM should be part of the Information Technology Asset Management (ITAM) function, which should be separate from Information Technology Services Management (ITSM), to ensure the responsibilities are clear. We explored this in detail in ITAM vs ITSM – why they should be separate.
Reporting line
The SAM team may be held accountable for significant risk factors, but it doesn’t always have the authority it needs to influence necessary change. Therefore SAM should report to a level that is able to influence cross-organisational behaviour – such as the Chief Information Officer (CIO). Our infographic SAM manager of the future shows how this could look in future.
Governance
Clear objectives for SAM must be set, and then governance must be in place to ensure they are met. Governance involves aligning each objective with key performance indicators (KPIs) that are measurable. KPIs for SAM could be the degree of risk appetite that the organisation has, and how much the exposure must be reduced to meet that level.
Roles and responsibilities
Accountability for every aspect of SAM must be defined. This can, interestingly, be the most emotionally negotiated part of the operating model. Therefore, it can be useful to have an objective, external party to assist with this framework. It is also important to ensure that the people with SAM responsibilities are provided with appropriate training. For example, when licensing rules change, is it clear who is responsible for maintaining this information? Do they know what to do to ensure the integrity of the SAM data? Often, when organisations outsource SAM functions or implementation of software and related tools, they will perceive it is the outsource provider’s responsibility to ensure compliance with vendor terms and conditions. While the outsource provider will help manage the process and reporting, the accountability for compliance always sits with the organisation who signs the terms and conditions with their vendors.
Performance evaluations and improvement
These are key to upholding governance and ensuring SAM activities are effective in meeting the company’s goals. For example, if a remediation plan is in place to reduce a $1 million exposure to within an acceptable level of $100,000, then performance tracking should show how the company is progressing towards that level.
Supporting factors to success
Once a strong operating model is in place, organisations need to ensure that there is a culture of continual improvement around SAM, to ensure everyone is contributing to, and getting the best out of it. Areas of focus should include:
An agile methodology
At KPMG, we not only help organisations to design and implement a robust SAM operating model, but through our Software Asset Management as-a-Service (SAMaaS) approach – which we explore in Taking charge of Software Asset Management – we can help with ongoing improvements.
Our journey starts with defining the SAM objectives, governance, roles and responsibilities, and KPIs, then flows to implementation such as establishing a data baseline, and offering reporting and insights.
