Underlicensing occurs when an organization has more software installations or users than covered by valid licenses. Common causes include inadequate software asset management or uncontrolled shadow IT. In an ISMS, underlicensing is a compliance risk that can lead to significant back-payments during vendor audits. Regular license reconciliations and a maintained asset register help you avoid this risk. ISO 27001 Annex A.5.32 requires the protection of intellectual property, which includes honoring license agreements.