By The Software License Recommendation GAO Has Open at Nine Agencies
In 2024, GAO asked nine agencies to compare the software licenses they use with the licenses they buy. Two years later, none of the 18 recommendations is closed. Here is where agencies stall, what GAO accepts as evidence, and how the finding shows up in an IT services bid.
In January 2024, GAO asked nine agencies a plain question about their most widely used software: are you paying for more licenses than you use, or fewer? None of the nine had fully determined the answer (opens in a new tab) for their five most widely used licenses. GAO made two recommendations to each agency, 18 in all. As of GAO's January and February 2026 updates, not one was closed.
That makes it a live finding for any prime pursuing IT work at Agriculture, Energy, HUD, Justice, State, VA, OPM, SSA, or USAID. It sits right next to every task order that touches enterprise software, cloud hosting, or operations and maintenance.
Eighteen Recommendations, Two Years Open
Each agency got the same pair. The first asks it to track the software licenses currently in use for its widely used licenses. The second asks it to compare that in-use inventory with what it purchased, on a regular basis, to find ways to cut costs and better inform investment decisions.
| Agency | Status as of GAO's last update (Jan or Feb 2026) |
|---|---|
| Agriculture | Both open |
| Energy | Both open |
| Housing and Urban Development | Both open |
| Justice | Both partially addressed |
| State | Both partially addressed |
| Veterans Affairs | Both open |
| Office of Personnel Management | Both open |
| Social Security Administration | Both open |
| USAID | Both partially addressed |
Six agencies have not moved either recommendation past "open." Three have partial credit. GAO also tags the comparison recommendation as a priority at several of the nine, VA, Energy, and Justice among them.
A Written Procedure Is Not a Comparison
The partial-credit cases show where agencies stall. Justice wrote standards and procedures in August 2024 for tracking license usage and reconciling licenses in use against financial records. In March 2025, it showed GAO how it tracked its Oracle licenses. The rest never followed: as of January 2026, Justice had not shown GAO the comparison for its remaining widely used licenses.
USAID took a similar path. It wrote a standard operating procedure in November 2024 that covers both tracking and comparison. GAO's note says the agency then did not provide evidence that it had compared licenses in use with licenses purchased for its five widely used licenses.
VA is the largest example. VA told GAO in February 2025 that it had new procedures for 12 of its top 15 widely used titles, and GAO still kept the recommendation open because the comparison itself had not been demonstrated. The stakes there are concrete: GAO testified in March 2026 that VA planned to spend about $985 million on software in fiscal year 2025 (opens in a new tab). Our Technical Brief on VA's open recommendation walks through that case step by step.
The lesson across all three is consistent. GAO closes these recommendations on evidence of a completed comparison, title by title, done more than once. A written process earns partial credit at best.
Why the Count Is Hard to Produce
The data problem starts above any single agency. GAO found that 24 agencies together named 36 vendors as those with the highest quantity of installed licenses as of July 2022, and that 10 vendors accounted for the majority of the most widely used licenses. Because agencies' license data was inconsistent and incomplete, GAO could not say which products under those licenses were most widely used.
Inside an agency, the two halves of the comparison sit with different owners. Purchase records, enterprise agreements, and true-up terms live with contracting and finance; install and usage data lives with IT operations. Energy's plan shows what joining them takes. It told GAO it would capture software products in its Enterprise Architecture repository, then use the Continuous Diagnostics and Mitigation monitoring tool and software manufacturers' sales reports as second and third validation points.
Cloud adds another source to reconcile. In GAO-25-107114 (opens in a new tab), GAO found that restrictive software licensing practices had affected cloud efforts at five of six agencies it reviewed. License costs that arrive on a cloud bill need the same purchased-versus-used check as the ones on a software contract.
How the Finding Shows Up in a Bid
Nothing here is new. The MEGABYTE Act of 2016 (opens in a new tab) already directs agency CIOs to track license usage and report savings. Pressure is building. In December 2025 the House passed the SAMOSA Act (H.R. 5457) (opens in a new tab), which would require agencies to assess their software licensing practices and report the results to OMB, GSA, and Congress.
Evaluators on an IT services buy at these nine agencies are likely to know the agency's open GAO list. The finding tends to surface in three places:
- Understanding of the requirement. A technical volume that names the open recommendation, and explains how the work will produce license usage data along the way, reads as understanding the agency's problem. One that ignores it reads as a generic O&M bid.
- Transition. A contractor taking over operations inherits the license estate along with the systems. A transition plan that baselines entitlements and in-use counts early starts the inventory GAO asked for.
- Renewals. An enterprise agreement renewed without an in-use count is negotiated on the vendor's numbers. That is the moment a prime with a defined comparison method has something concrete to offer.
What GAO Will Accept as Evidence
Read across the status notes, closure takes three things for each widely used title:
- An in-use count from a system the agency controls.
- An entitlement count from contracts and purchase records.
- A dated comparison of the two, repeated on a set cycle, with any savings or cost avoidance recorded.
Avalon's FinOps white paper covers the cloud half of that work: native billing data normalized to the FOCUS specification and a licensing model fit check. The VA brief lays out the full read-only method, from the entitlement inventory built out of contract records to the recurring comparison.
If work at one of these nine agencies is in your capture plan and it touches enterprise software or cloud costs, Avalon teams as the sub that produces the purchased-versus-in-use comparison GAO has been asking for since 2024.
