IP audit checklist for mid-size companies: include your records

What a mid-size IP audit should cover#

A mid-size IP audit should cover every asset the company relies on to compete and every contract that grants or limits rights in it. For most mid-size companies that means a short register per category, kept by the general counsel or outside counsel, rather than a valuation exercise.

This checklist is general information, not legal advice. How ownership, trade secret and contract rules apply to your company is a question to work through with counsel.

• 1Patents and patent applications, with owners of record and maintenance status.
• 2Trademarks, trade names and domain names, with registrations and renewal dates.
• 3Copyrights in software, documentation, training content and marketing material.
• 4Trade secrets such as pricing logic, processes and know-how, with the controls that protect them.
• 5Software: proprietary code, open-source components and the licenses attached to each.
• 6Inbound licenses: software, content and data used under someone else's terms.
• 7Outbound licenses: anything already granted, including any exclusivity.
• 8Records: the operational histories in support, CRM, project, job, order and quality systems.

Why operational records belong on the list#

Operational records belong on the list because they raise the same questions as other IP, namely ownership, confidentiality and permitted use, yet they are usually invisible in the books. ASC 350-30-25-3 has companies expense, as incurred, what they spend creating intangibles in-house when those intangibles cannot be specifically identified or are inherent in the ongoing business. Years of support tickets, CRM histories and job records therefore rarely show up as assets.

Acquisitions are the exception. Under ASC 805, an acquired intangible is recognized separately from goodwill if it arises from contractual or legal rights or is separable, and the Codification's examples list databases among technology-based intangibles. Records tend to become visible on a balance sheet only when someone buys the company that holds them.

Records also sit behind decisions the audit should inform: a system migration that may drop history, a financing or sale with IP representations, and any proposal to license records to AI developers.

The records section of the checklist#

The records section lists each system of record with enough metadata to show who owns the contents, how they are protected and what limits their use. It needs no exports or samples; system owners can answer most items from admin consoles and signed contracts.

Ownership checks: employees, contractors and clients#

Ownership checks confirm that what people wrote in your systems actually belongs to the company. Under the Copyright Act, when a work is made for hire the employer is considered the author and, unless a signed written instrument says otherwise, owns all of the rights in the copyright; work by an employee within the scope of employment qualifies.

Contractors are where gaps appear. The Copyright Office explains that a commissioned work is made for hire only if it falls within specific statutory categories and the parties sign a written agreement, so freelance developers, drafters and consultants usually need an express assignment. Client contracts can cut the other way by assigning deliverables or restricting reuse of anything built for the client.

• 1Confirm employee agreements include invention and work-product assignment language.
• 2Pull contractor agreements for anyone who wrote code, documentation or project records, and check for a written assignment.
• 3Flag client contracts that assign deliverables or restrict reuse of client materials.
• 4Note acquired companies whose records came with their own legacy agreements.

Trade secret hygiene checks#

Trade secret checks test whether the company has done enough to keep valuable records confidential. The Defend Trade Secrets Act sets two conditions: the owner must take reasonable measures to keep the information secret, and the information must have independent economic value because others do not know it and cannot readily find it out by proper means.

Department of Justice guidance describes protective measures as reasonable under the circumstances rather than absolute, citing examples such as telling employees a trade secret exists, limiting access on a need-to-know basis, requiring confidentiality agreements and keeping documents locked. A shared drive open to every employee and former contractor weakens that position.

One detail is often missed. The act requires employers to give notice of whistleblower immunity in employee contracts that govern trade secrets or confidential information, and an employer that skips the notice may not recover exemplary damages or attorney fees against an employee who did not receive it. Check that current templates, including contractor and consultant agreements, include the notice.

Licenses in and out: what already limits use#

Existing licenses show what the company can still do with its records. Inbound software terms may restrict exports, automated extraction or use of data for AI training, and client and partner agreements may limit reuse of anything they supplied. Outbound, any exclusive grant already made narrows future options.

Read the vendor terms for each system of record, not only the largest ones, because helpdesk, CRM and project tools often carry different rules. Record each restriction against its system in the register so the restriction travels with the records into any later migration, sale or license.

Illustrative: an engineering firm adds records to its audit#

Illustrative: a fictional civil engineering firm runs an IP audit before a planned recapitalization. The first pass covers its trademarks, a few in-house software tools and its standard contract forms. The general counsel then adds a records section covering Deltek Vantagepoint project histories, Bluebeam markup sessions, internal QA review comments and staffing plans.

The records section surfaces three findings. Internal QA reviews and project scoping records were written by employees and are company-owned. Several freelance drafters signed agreements with a work-for-hire clause but no assignment. A group of public-sector client contracts transfers ownership of deliverables to the client.

The firm fixes its contractor template, logs deliverables by contract form and restricts access to QA records. The result is a records register the board and any future buyer can read alongside the trademark and software lists, with each record family marked company-owned, client-controlled or needing review.

How SourceX uses the records section#

SourceX's rights review asks the same questions as the records section of an IP audit. In the SourceX five-step transaction, Supply, Rights, Preparation, Approval and Delivery, the Rights step checks authorship, client terms, vendor restrictions and confidentiality before any record family is scoped for a license.

A company that already keeps a records register shortens that review, and its answers feed the SourceX Evidence Packet: provenance, licensing rights, permitted use, the privacy record and release authorization. Nothing is shared during the initial fit check, which uses metadata only.