Audit readiness for a hoster is not a binder you assemble when the notice arrives. It is a set of habits that make every month in the lookback already defensible. This checklist turns those habits into a list you can run.
When a SPLA audit notice arrives, a Big Four firm will verify compliance for every monthly cycle across a 36 month lookback under the MBSA audit clause. The hosters who come through cleanly are the ones whose readiness was built into operations long before the notice. This checklist sets out what audit ready actually means for a hoster, organized so you can score your own estate against it.
The auditor has broad authority to request deployment records, server configuration data, customer contracts, and usage logs, and tests each month rather than your current position alone. Back fees at the price file rate are not negotiable. The penalty uplift, which ranges from 25 to 125 percent depending on severity, duration, and the nature of any under reporting, is negotiable. Readiness is what keeps the back fee small and gives you the evidence to argue the uplift down.
Reporting discipline is the structural defense. These are the items that make a month defensible.
Reporting is only defensible when every number traces to a customer and a product. These items close that loop.
The table below is a simple way to read where you stand. The bands are indicative.
| State | What it looks like | Audit outcome |
|---|---|---|
| Audit ready | Every month reported, mapped, and sealed | Auditor works from your evidence |
| Partial | Reporting complete, mapping thin | Some months reconstructed, exposure rises |
| Exposed | Gaps in reporting and mapping | Auditor estimates, uplift leverage lost |
These bands are indicative. The further you sit from audit ready, the more of the lookback the auditor reconstructs on assumptions, and the weaker your position on the negotiable uplift.
A checklist tells you where the gaps are. A standing register keeps them closed. Building that register is covered in building a SPLA compliance register, and the customer side of the mapping is covered in customer mapping for every reported SAL. Together they convert a one time readiness check into an operating discipline that holds across the lookback.
Running the checklist honestly often surfaces months that would not survive an audit today. That is useful to know before a notice arrives, while there is still room to strengthen records and correct mistakes in time. Our SPLA audit defense guide sets out the full discipline, and a strategy call is the fastest way to pressure test your readiness against how a Big Four auditor would actually test you.
Book a Strategy Call and we will run your estate against the way a Big Four auditor tests a SPLA lookback, so you find the weak months before the notice does.
Book a Strategy CallBefore you send anything back to the auditor, we defend the full 36 month lookback through our SPLA audit defense work.
Weekly intelligence on Microsoft and SPLA audit moves and the buyer side defenses that work. Prefer to talk first? Ask us to Book a Strategy Call in your message above.