Most Tech Companies Audit Finances Quarterly and IP Licenses Never

Your financial statements get reviewed four times a year. Your IP licenses? Probably whenever someone panics.

That asymmetry is not abstract. A software company in Orange County can carry millions of dollars in contracted license value, dozens of open source dependencies, and a stack of contractor agreements, and have no current picture of what it actually owns, what it owes, or where the gaps are. The finance team knows the burn rate to the dollar. Nobody on that team can say with confidence whether the firm's core product is built on open source code that requires public disclosure of modifications.

Mid-market technology firms, roughly $5 million to $100 million in revenue, occupy a particularly exposed position. They have enough complexity that IP issues can hide easily. They rarely have in-house legal counsel dedicated to license management. And they tend to grow fast, layering vendor relationships, contractor engagements, and customer license grants on top of each other without pausing to map what those agreements actually permit.

The reckoning usually arrives in one of three forms: a competitor accuses the company of infringement, a vendor terminates access under a clause nobody flagged, or a former employee surfaces at a rival with knowledge that was supposed to stay behind. By the time any of these triggers fires, the litigation clock is already running.

---

What an IP Licensing Audit Actually Covers

An IP licensing audit is not a one-day exercise. It is a systematic review of four categories of agreements and assets.

Inbound licenses are rights the company has received from others. This includes commercial software (SaaS tools, enterprise platforms, development libraries), open source components embedded in your product, third-party APIs and data feeds, and any technology licensed from universities or research institutions. Each one carries conditions the licensee must meet.

Outbound licenses are rights the company has granted to customers, partners, resellers, or joint venture counterparties. These define what the customer can do with your software or technology, and they are frequently the source of disputes when a customer's use expands beyond what the original agreement permitted.

IP assignment agreements cover the ownership question. Any code, design, or invention created by a contractor (rather than a full-time W-2 employee) does not automatically belong to the company under California law. Without a written assignment, the contractor may own what they built for you. The same gap can appear with co-founders who departed before formal documentation was completed.

Nondisclosure and noncompete agreements tied to proprietary technology round out the picture. These govern what former employees and contractors can carry out the door. When these agreements are missing, stale, or unenforceable, the IP protection they were supposed to provide evaporates.

---

The Seven Areas Where Liability Hides

Run through this list honestly. Each one has generated litigation for technology companies.

1. Open source license conditions. Not all open source is created equal. MIT and BSD licenses are permissive. GPL and AGPL licenses carry copyleft obligations that can require you to release your own source code if you distribute software that incorporates them. Many firms building on open source dependencies do not audit the license type of every component in the stack. One undisclosed GPL component in a commercial product can create a significant exposure.

2. Vendor scope and use-case restrictions. Most commercial software licenses restrict use by number of seats, by deployment environment (production vs. development), by geography, or by use case. Companies that have grown past the original license terms without renegotiating are out of compliance. Vendors increasingly audit their own customers, particularly when a customer is acquired, since due diligence almost always turns up these gaps.

3. Contractor IP assignment gaps. A freelance developer who built your payment processing module in 2021 may hold ownership rights to that code today if no assignment agreement was signed. That developer now works for a competitor. This is not a hypothetical, it is a pattern we see regularly, and it is exactly the kind of issue that surfaces during M&A or litigation discovery.

4. Silent termination and data return clauses. Vendor agreements often include unilateral termination rights the licensee never read carefully. When a vendor can cut access on 30 days' notice, and your product depends on that vendor's API, the operational risk is obvious. Less obvious: what happens to your data, your configurations, and your customer records when that happens? If the agreement is silent, the answer may not be in your favor. What breach of contract litigation over software licensing actually looks like can be a useful frame for understanding where these disputes go when negotiation fails.

5. Sublicensing rights you may not hold. Technology companies frequently promise customers functionality built on third-party licensed components. If the upstream license does not include sublicensing rights, that promise may be legally undeliverable. The gap may not appear until a vendor changes terms, terminates the license, or is itself acquired.

6. Geographic restrictions. A license negotiated for use in the United States may prohibit deployment to international customers. As tech firms expand, they frequently violate these restrictions without knowing it. The risk is compounded when the licensor is a competitor.

7. Stale agreements with former employees. An IP assignment agreement signed in 2018 may be missing entirely for a key engineer who joined in 2022. Exit interviews that were supposed to include IP confirmation paperwork often don't get done under deadline pressure. When that former engineer's work becomes central to your product, and they surface at a competitor, the missing paperwork is suddenly the most important document in the case. For more on how California courts assess these situations, see what courts look for when you file a trade secret misappropriation claim.

---

A Practical Audit Checklist for Mid-Market Tech Firms

This checklist will not replace a legal review, but it will tell you whether you need one urgently.

Build your IP inventory. List every software product, tool, library, data feed, and API your company uses or distributes. Separately list every license you have granted to customers, partners, or resellers. If you cannot build this list in a week, that itself is a finding.

Map authorized use against actual use. For each inbound license, confirm the permitted use case, the licensed territory, the number of authorized seats or instances, and the term. Flag anywhere your current use exceeds what the agreement says.

Identify every open source component and its license type. Tools like FOSSA or Black Duck can automate much of this scan. The output will show you which components carry copyleft obligations. Bring that list to counsel before you distribute a new product version.

Confirm IP assignments from contractors and former employees. Pull employment agreements, consulting agreements, and any exhibit that is supposed to cover IP assignment. If an agreement is missing, unsigned, or predates the work it was supposed to cover, flag it. These gaps require legal review, not a form letter.

Review vendor agreements for unilateral change rights. Some SaaS agreements give vendors the right to modify material terms on 30 days' notice. Others allow price changes annually without negotiation. Knowing which of your vendors hold these rights tells you where your operational exposure sits.

The output of this audit is a prioritized risk list. Some items require a contract amendment or renegotiation. Some require a conversation with a former contractor. And some require litigation counsel, because the gap has already been exploited.

---

When the Audit Surfaces a Real Problem

Gaps fall into two categories: ones you can close contractually, and ones where the damage may already be done.

A missing IP assignment from a current contractor is closeable. The contractor is still engaged, there is economic leverage on both sides, and a written assignment can be executed today. A missing assignment from a contractor who departed two years ago and now works at a direct competitor is a different problem. The question becomes whether the work they performed is central to your product, whether they have shared it, and whether a trade secret or IP infringement claim has already been seeded.

A silent clause in an IP license can generate the same cascade: what looks like a paperwork gap becomes a $10 million dispute once an adversary decides to enforce it.

When the audit surfaces a problem in that second category, the value of the audit document itself becomes significant. A written record showing the company took proactive steps to identify and address licensing risk is a materially better starting position than discovering the same gap during discovery in active litigation. Courts and opposing counsel both notice the difference.

---

How Thomas Whitelaw Helps Tech Companies Before and After the Problem Appears

Thomas Whitelaw & Kolegraff LLP, based in Irvine, California, has handled IP and technology disputes across software, telecommunications, pharmaceuticals, and oil and gas since 2000. The firm's partners carry 15 to 35 years of litigation experience and run every case directly, not through associates the client has never met.

The firm offers flexible fee arrangements, including fixed and success-based fees, because mid-market companies with strong claims should not be priced out of enforcing them. When a former employee walks out with a customer list, when a competitor launches a product that is suspiciously similar to yours, or when a vendor's termination clause is triggered at the worst possible moment, the firm is structured to move quickly. The team took over the defense of a $10 million patent infringement case (Whitewater West Industries, Ltd. v. Pacific Surf Designs, Inc., S.D. Cal. No. 3:17-cv-01118) approximately 30 days before trial. The jury found no infringement. Prior results do not guarantee a similar outcome; every case depends on its own facts.

If your company has never formally audited its IP licenses, the question is not whether exposure exists. It is how much, and whether a competitor or vendor already knows about it before you do. For companies wondering whether a pending infringement claim has merit, patent infringement defense strategies available to California businesses is worth reading alongside this checklist.

Reach the firm at Thomas Whitelaw & Kolegraff LLP, 18101 Von Karman Avenue, Suite 230, Irvine, CA 92612, (949) 679-6400, info@thomas-whitelaw.com. This post is for general information only and is not legal advice.