Here is a 20-minute exercise for any IT team. No tools needed.
Pick five machines in your office. Any five.
On each one, open the installed programs list. Then ask three questions.
One: who uses this machine, and do they actually use everything on it?
Two: that design tool, that PDF editor, that video converter — do we have a purchase record for it? Not "we must have bought it." An actual invoice.
Three: is there anything here nobody remembers installing?
Most teams who try this find at least one surprise in the first five machines. An old trial. A tool an ex-employee installed. Something a vendor set up years ago and everyone forgot.
Now imagine the same exercise across fifty machines. Or two hundred.
That gap between "what we think is installed" and "what is actually installed" is where audit exposure lives. Not in dishonesty. In drift.
Twenty minutes. Five machines. See what you find.
Follow Code & Clause Systems on LinkedIn for more notes like this.