Systems Auditing: Know What You're Running Before Someone Else Tells You

Home Solutions

Every practice has three inventories: what it thinks it runs, what it’s paying for, and what’s actually installed on the machines. They are never the same list. The gap between them is where the licence waste lives, where the unpatched server sits, and where the Autodesk audit letter finds you. A systems audit closes that gap in writing, with a clear understanding of what’s running, before someone else does it for you.

We’re NexSys, and we audit architecture, engineering and construction environments and nothing else, which matters because a generalist IT audit doesn’t know what a Revit central file is, why a BIM manager needs admin, or what a plugin sprawl across thirty workstations costs. Ours does.

Book a Strategic Review

Call 1300 733 010

Software audit services Australia's design firms need before Autodesk runs its own

Autodesk is open about how its software license audit program works. Any customer with an Autodesk product may be selected, and being selected doesn’t mean Autodesk suspects you of anything. It starts with a letter or an email, moves to a scan of your environment with Autodesk’s inventory tool, and ends with a licence compliance representative resolving whatever the scan found: unlicensed installs, overuse of subscription seats, educational licences used for commercial work. A Perth engineering firm paid $65,000 in 2014 over unlicensed Autodesk products. The BSA’s Australian settlements ran to $347,000 across 28 cases in one year.

The audit cuts both ways, though, and this is the part most providers don’t tell you. The same scan that finds an unlicensed AutoCAD install also finds the six AEC Collection seats nobody has signed into for a quarter. Autodesk sells named-user subscriptions only, one person per seat, so an unassigned seat is pure waste. Ian Simpson, who runs our Design Technology arm, has a view on this that some resellers would argue with: most practices overspend on Autodesk by more than they underspend, and a licence audit that only looks for shortfalls is a sales call.

What the systems audit covers: the whole IT environment and its information systems, in one audit report

Five areas, one report. Infrastructure and performance covers servers, storage, network and workstations, and whether they’re sized for the models you actually open; cloud and hybrid covers Azure, Microsoft 365, virtual desktops, and what’s being paid for twice. BIM and design workflows covers Revit and AutoCAD versions across the fleet, template and plugin drift, where the central models live and whether that location is one Autodesk supports. Security and compliance is a security audit of your security controls against the ACSC’s Essential Eight maturity model, which is what a Tier 1 builder or government client will ask for, with penetration testing scoped separately if a tender demands it. Asset and lifecycle covers what’s under warranty, what’s still on Windows 10 now that Microsoft and Autodesk have both ended support for it, and what needs replacing before it fails during a submission.

The audit report is written for a director, not a systems administrator. It reads as risk management rather than a parts list, with the operational risks and weaknesses ranked and the root causes named rather than the symptoms. Every finding has a priority, a cost to fix and a cost of not fixing it. The quick wins are separated from the roadmap so the first month’s work is obvious.

The three compliance gaps almost every security audit turns up

Version drift is first. Half the office on one Revit release and half a year ahead, which makes every linked model a negotiation and every upgrade a project. Second is backups that exist but have never been tested by restoring a live central model, and that a compromised account could delete, which fails the Essential Eight at Maturity Level Two. Third is identity: shared logins for the model viewer, admin rights that were granted for one install in 2021 and never removed, and a departed drafter whose Autodesk seat is still assigned.

None of those is exotic, and none shows up in a generalist audit, because a generalist auditor doesn’t know to look, and internal controls that nobody reviews are the same as none. The Australian Signals Directorate’s 2024–25 report puts the average self-reported cost of a cybercrime for a medium business at $97,200, up 55 per cent in a year, and most of the incidents behind that number started with the third item on the list.

The audit process: discover, assess, report, optimise, and save time on future audits

Discovery is mostly tooling rather than manual effort and takes a few days: inventory agents on the workstations, read-only access to the tenant and the licence portals, and a conversation with whoever runs IT today, whether that’s an internal person or your current provider. Assessment is the fortnight after, where we test rather than assume: a restore from backup, a login from an unfamiliar country, a Revit model opened from the site office. The report lands at the end of that, and the optimise phase is optional. You can hand the priority list to your existing provider and we’ll never hear from you again, and some practices do exactly that.

A caveat. If you’re a studio of five with one server and no government work, a full systems audit is more than you need. A half-day health check will find the same three things, and we’ll quote that instead.

Audit capability from people who have run these environments

Michael Grocott, one of our senior systems engineers, spent two decades on NetApp storage, Veeam and virtualised Autodesk platforms at Norman Disney & Young and elsewhere before he joined us. Russell Swainston was National Service IT Manager at Cox Architecture for more than a decade. Rick Notari, our digital platform lead, has run enterprise deployments of Autodesk Construction Cloud after thirty years at Hassell, Silver Thomas Hanley and Mirvac. When one of them reads your environment, they’re comparing it to ones they’ve run, not to a checklist. That shows in the report.

Questions directors ask first

Can Autodesk audit us even if we've done nothing wrong?

Yes. Autodesk’s own audit page says any customer with an Autodesk product may be selected, and that selection doesn’t mean they suspect noncompliance. It starts with a letter or email, then a scan with their inventory tool, then resolution with their licence compliance team, so it’s better to know your position first.

How long does a systems audit take?

For a practice of forty to eighty seats, discovery and assessment usually take about two weeks, with the report and priority list at the end. Multi-office firms take longer. You get a written scope and a fixed fee before we start.

Does the audit include penetration testing and a security posture review?

A security posture review, yes: identity, access, patching, backups and the Essential Eight controls, assessed against industry standards and the compliance requirements in your tenders. Penetration testing is a separate engagement we scope when the audit shows it’s warranted, which for most practices is after the basics are fixed, not before.

What do we get at the end, and what does it cost?

A written audit report with every finding prioritised, a cost to fix and a cost of not fixing, an asset management register of what’s installed and what’s licensed, and a roadmap that separates quick wins from the year’s work. The fee is fixed and quoted from the scope, so the advisory doesn’t turn into a sales pitch for the fix.