City faces challenge in managing software licenses

The city does not have complete information on what software licenses it has or how much those licenses are costing, according to a report from the city auditor’s office. Auditors reported Wednesday that the city spent $7.4 million in Fiscal Year 2020 on three main types of office licenses, but as they told the City Council Audit & Finance Committee, it appears that the city spent about $500,000 on licenses for users who never used the software.

Kelsey Thompson, who was in charge of the audit, described difficulties the city has in analyzing license usage and expenditures. Much of the problem seems to relate back to the fact that there is no centralized inventory of software licenses or costs, she said.

Although Communications and Technology Management is the primary technology department, other departments manage their own software licenses and CTM is sometimes left in the dark about those software purchases.

The city is clearly not following leading practices for managing software licenses prescribed by the Government Accountability Office, the report noted.

“There does not appear to be a standard way to capture software license costs across the city,” the report states. “The city has budget line items related to software. However, these budget line items may pick up transactions or vendors that are not related to software licenses. CTM staff reported that it would be very difficult to estimate how much they spent on software licenses because there are several parts of the software license costs.”

In addition to paying for initial rights to use software, the city must also pay to maintain the software.

“Without information on what software licenses the city has and how much they cost, the city cannot effectively identify ways to save money and maintain software license compliance,” the audit notes. In addition, they found that the city does not have a way to evaluate which employees may be using non-licensed software. Such software may put the city’s data at risk.

CTM is working on an IT management project that includes software licenses, and the report notes that the project will be completed in 2024 or 2025. However, Chris Stewart, the interim chief information officer, told the committee that the management project is much bigger than an inventory of software. He said he expects that inventory to be completed this year. The department has already started to inventory its hardware and the software inventory will dovetail with that, he said.

The three main types of office software the city uses are within the Office 365 category. CTM manages those licenses, but the audit found that there is no formal process for assessing which of the three types and how many of each a particular department needs.

G3 licenses allow users to send and receive email and have access to certain Microsoft features. They cost $29.66 per month and the city pays for 9,476 users. G5 licenses allow everything the G3 license allows, plus additional features. These licenses cost $54.54 per month and 5,916 city employees are using them. A third type of software is called Plan 2 and simply allows users to send and receive email. It costs just $6.18 per month and has 2,372 city users.

“Of the nearly 15,400 G licenses, approximately 38 percent are G5 licenses and 62 percent are G3 licenses. It appears that CTM arrived at this percentage split based on how many G5 licenses the city could afford as opposed to how many G5 licenses departments actually needed,” auditors found.

According to the report, it appeared that 70 percent of departments received the 38 percent/62 percent split without factoring in individual needs. As a result, they found that the city was not using its resources effectively and some departments at least were receiving the more expensive licenses even if they did not need them. They pointed out that the Plan 2 license, while having fewer features, was considerably less expensive.

When asked why, CTM staff reported that they were “operating under direction from a previous city manager to give all full-time city employees a G3 or G5 license even if using Office 365 is not part of their job.” They said the previous city manager “was concerned about digital equity for city employees and wanted all city staff to have full access to Office 365,” even employees who worked primarily in the field.

Auditors noted that CTM staff told them that departments “make the decision about how many Office 365 licenses they need, and that decision is often outside of CTM’s control.” While some city departments expressed the belief that it is the role of CTM to manage software licenses, auditors reported that “CTM sees its role more as helping departments get access to the software instead of being a centralized manager. Without any citywide policies, guidance or training, departments are unclear about who has what responsibility for managing software licenses,” they concluded.

Stewart, who has only held his job since September when the previous CIO retired, has more than 20 years’ experience with the city. He told the committee, “The audit did spell out some of the challenges we have. It’s the chief information officer’s responsibility to do this for the city of Austin, but that person doesn’t have the access or authority to do that right now in the way that we are decentralized. So it does call out that decentralized manner. We’re going to have to work with departments on finding a solution to that so we all make sure that everybody’s inventory is in the same place and centrally managed, but we think we can get there.”

Committee Chair Alison Alter and Council Member Jimmy Flannigan both wanted to know whether the CIO had sufficient authority to manage the challenge laid out in the audit. Stewart said he thought it could be done through the citywide IT steering committee, but this question seems likely to come back in the future. Alter noted that the software license audit is one of several audits related to information technology that the auditor’s office will be performing at the request of the committee.

The Austin Monitor’s work is made possible by donations from the community. Though our reporting covers donors from time to time, we are careful to keep business and editorial efforts separate while maintaining transparency. A complete list of donors is available here, and our code of ethics is explained here.