IBM Audit Defence · Case Study

IBM Audit Defence for a Leading Italian Retailer How We Reduced an €18 Million IBM Claim by 95% to €900,000

One of Italy's largest retail chains received an IBM audit claim of €18 million alleging non-compliance across sub-capacity licensing, entitlement mismatches, and virtualisation overages. Redress Compliance conducted a systematic deconstruction of IBM's audit findings, identified critical errors, and negotiated a final settlement of €900,000 — a 95% reduction that included forward-looking licences for growth.

€18M
Initial IBM Audit Claim
€900K
Final Settlement
95%
Claim Reduction
14 Weeks
Engagement Duration
Part of our IBM Licensing Case Studies series. For broader guidance, see the IBM Licensing Knowledge Hub and the IBM Audit Defence Service.

Get IBM Licensing Intelligence

Join enterprise IT leaders receiving our monthly advisory on IBM audit tactics, sub-capacity licensing changes, and compliance defence strategies.

Subscribe Free →

Italy (Europe)  ·  Retail  ·  January 2025  ·  14-week engagement  ·  By Fredrik Filipsson

01 The Challenge: An €18 Million IBM Audit Claim

The retailer operated one of Italy's most extensive physical store networks alongside a rapidly growing e-commerce operation. Its IBM estate was substantial: Db2 databases powering inventory management and point-of-sale analytics, WebSphere Application Server supporting the e-commerce platform, MQ messaging connecting store systems to the central data centre, and Tivoli monitoring across the entire infrastructure. The IBM relationship spanned over 15 years.

IBM initiated a formal audit under the company's International Passport Advantage Agreement. After six months of data collection, IBM presented an audit report claiming €18 million in non-compliance fees across three categories: sub-capacity licensing shortfalls (€10.2 million), entitlement mismatches (€5.1 million), and virtualisation overages (€2.7 million).

🛒

Major Retail Operation

Hundreds of stores across Italy with centralised IT infrastructure, plus a rapidly expanding e-commerce platform that had tripled transaction volumes in the preceding three years.

💾

Extensive IBM Estate

Db2 Enterprise Server Edition, WebSphere Application Server Network Deployment, MQ Advanced, Tivoli Monitoring, and several smaller IBM products accumulated over 15+ years of procurement across multiple agreement generations.

Virtualised Infrastructure

The retailer had migrated from physical servers to a VMware-based virtualised environment two years before the audit. This migration was the primary source of IBM's sub-capacity and overage claims.

📄

15+ Years of Agreements

Licensing entitlements spread across multiple Passport Advantage agreements, purchase orders, and technology refresh cycles, creating the documentation complexity that IBM audits exploit.

02 Understanding IBM's Audit Methodology and Its Weaknesses

IBM's audit methodology relies heavily on automated data collection through ILMT and manual review of deployment configurations. While technically rigorous in some areas, it contains systematic weaknesses that consistently result in inflated claims.

1

Sub-Capacity Counting Errors

ILMT frequently captures peak allocations rather than sustained usage, counts temporary capacity spikes during maintenance windows as permanent allocations, and misinterprets dynamic resource management (DRM) settings in VMware as intentional capacity increases. These errors systematically inflate sub-capacity counts, often by 40 to 70%.

2

Entitlement Reconciliation Gaps

IBM's own entitlement records frequently fail to capture all licence purchases, particularly those made through resellers, acquired through company acquisitions, or included as part of bundled agreements negotiated years earlier. When IBM's records show fewer entitlements than the customer actually holds, the resulting "shortfall" is entirely artificial.

3

Virtualisation Full-Capacity Fallback

If a customer cannot demonstrate continuous ILMT compliance for the entire audit period, IBM reserves the right to revert to full-capacity licensing, counting every physical core in the server. This "full-capacity fallback" can multiply the licence requirement by 5 to 10x and is IBM's most aggressive audit tactic.

03 Our Approach: Systematic Audit Deconstruction

We structured our engagement across four phases, each designed to challenge a specific dimension of IBM's audit claim with verifiable evidence.

1

Audit Report Analysis (Weeks 1-3)

Line-by-line review of IBM's audit report, cross-referencing every claimed shortfall against actual licensing agreements, purchase history, and deployment records. Catalogued every discrepancy between IBM's claimed and documented entitlements, every sub-capacity calculation relying on peak data, and every instance of unjustified full-capacity counting.

2

Data Validation and Independent Measurement (Weeks 3-7)

Worked with the retailer's infrastructure team to independently validate every deployment metric. Extracted VMware vCentre data to verify actual processor core allocations versus ILMT peak captures, reviewed ILMT configuration history, and audited every server, VM, and container environment for IBM installations.

3

Corrected Compliance Report (Weeks 7-12)

Compiled findings into a comprehensive 95-page corrected compliance report that challenged IBM's audit findings point by point, supported by independently verified data, contract analysis, and technical evidence. This report formed the basis of our negotiation with IBM's audit and licensing teams.

4

Governance Implementation (Weeks 12-14)

Following the settlement, implemented a compliance governance framework including automated licence monitoring, ILMT configuration hardening, and processes to ensure ongoing alignment between entitlements and deployments as the infrastructure continued to evolve.

04 Challenge One: Dismantling Sub-Capacity Licensing Claims (€10.2M)

The sub-capacity claim was the largest single component, representing 57% of the total. IBM alleged that virtualised Db2 and WebSphere deployments required significantly more PVU licences than the retailer held. Our analysis revealed three critical errors:

📈

Peak vs. Sustained Allocation

ILMT captured peak vCPU allocations during overnight batch processing and quarterly inventory reconciliation runs. These peaks lasted 2 to 4 hours. IBM used them as the licensing baseline, inflating the Db2 PVU requirement by approximately 45%. We presented VMware performance data showing sustained allocation was 55% of the peak figure.

🔄

DRM Miscounting

VMware's Dynamic Resource Management temporarily expanded vCPU allocations for the e-commerce WebSphere cluster during Black Friday and seasonal sale events. ILMT recorded these as permanent allocation changes, adding approximately 2,400 PVUs. We demonstrated through DRM logs that allocations were temporary and automatically reverted within hours.

Decommissioned Environment

IBM's audit included PVU counts for a legacy pre-production environment decommissioned eight months before the audit period. VMs had been powered off and storage deallocated, but ILMT retained historical records that IBM treated as active deployments. We provided decommissioning logs, change management tickets, and infrastructure team attestations.

Sub-Capacity Resolution: From €10.2M to €420,000 (96% reduction).

IBM's position: 18,400 additional PVUs required across Db2 and WebSphere, valued at €10.2M at list pricing.

Our corrected position: After removing peak-based inflation (reducing by 45%), DRM temporary allocations (removing 2,400 PVUs), and the decommissioned environment (removing 3,200 PVUs), the genuine PVU shortfall was approximately 760 PVUs.

Settlement: IBM accepted our corrected analysis. The €10.2M claim was reduced to €420,000, covering the 760-PVU genuine shortfall at negotiated pricing, plus additional PVUs for planned e-commerce expansion.

Vendor Shield: IBM Audit Defence

Independent IBM audit defence for enterprises worldwide. We challenge inflated claims with verified technical evidence, correct sub-capacity miscounts, recover missing entitlements, and negotiate settlements that reflect actual compliance positions.

IBM Audit Defence →

05 Challenge Two: Correcting Entitlement Mismatches (€5.1M)

IBM claimed €5.1M for products the retailer was allegedly running without proper entitlements. Our investigation revealed that the majority of these "entitlement gaps" were documentation failures on IBM's side.

DiscrepancyValueRoot CauseResolution
Reseller purchases not in IBM records€1.8MThree significant licence purchases through an authorised IBM reseller between 2017 and 2020 were absent from Passport Advantage recordsProvided original purchase orders, reseller confirmations, and proof of payment. IBM acknowledged the entitlements.
Bundled entitlements from 2016 ELA€1.4MA 2016 Enterprise Licence Agreement included bundled entitlements for MQ Advanced and Tivoli Monitoring that IBM's audit team had not accounted forPresented original ELA documentation showing explicit entitlements for these products.
Included components misidentified€900KIBM counted WebSphere Application Server Liberty Profile as a separate licensable product. Liberty Profile is an included component of WebSphere Application Server Network Deployment.Demonstrated that Liberty Profile is included with the retailer's existing WebSphere ND entitlement.
Test/dev environment exemptions€600KIBM products in non-production environments were counted as production deployments. Passport Advantage Authorised Use provisions permitted test/dev usage without additional licences.Identified contractual test/dev provisions and reclassified environments.
Genuine entitlement gap€280K120 MQ Advanced licences deployed for a new supply chain integration project without corresponding procurementAccepted and resolved at negotiated pricing.

06 Challenge Three: Resolving Virtualisation Overages (€2.7M)

IBM's virtualisation overage claim attempted to apply the full-capacity fallback, counting the full physical server capacity rather than sub-capacity VM allocations.

💻

ILMT Reporting Gap: 17 Days

IBM identified a 17-day period where ILMT reporting was interrupted due to a storage migration. IBM argued this gap invalidated the retailer's sub-capacity eligibility for the entire audit period, justifying full-capacity counting that increased the licence requirement by approximately 8x.

🛠

Our Defence: Proportionality

We demonstrated the gap was caused by a planned infrastructure maintenance event, that ILMT was correctly configured before and after, that VMware performance data provided continuous coverage, and that IBM's own documentation acknowledges brief interruptions do not automatically invalidate sub-capacity eligibility.

Resolution

IBM accepted our argument. The full-capacity fallback was withdrawn entirely. The €2.7M claim was reduced to €200,000, covering a minor genuine overage in a single cluster where vCPU allocations had been increased permanently during e-commerce expansion without a corresponding licence true-up.

07 Negotiation: From €18 Million to €900,000

With our 95-page corrected compliance report establishing the verified position, we entered structured negotiations with IBM's licensing and audit teams over three weeks.

1

Lead with the Corrected Report

We presented the corrected compliance report as a unified technical document, systematically addressing every line item. The report's credibility shifted the negotiation from IBM's inflated claim to our verified position as the starting point.

2

Frame the Commercial Relationship

The retailer was a long-standing IBM customer with €4+ million in annual support and subscription revenue. We positioned the genuine shortfall as a regularisation opportunity that preserved the commercial relationship.

3

Bundle Future Investment

The retailer planned Db2 and WebSphere capacity expansion for e-commerce growth. We incorporated this into the settlement, securing additional licences at 40% below list price. This gave IBM forward revenue commitment while giving the retailer licences at a substantial discount.

Claim CategoryIBM ClaimVerified PositionReduction
Sub-capacity licensing shortfalls€10.2M€420K96%
Entitlement mismatches€5.1M€280K95%
Virtualisation overages€2.7M€200K93%
Total€18.0M€900K95%
Client Testimonial. "Redress Compliance's expertise turned a daunting audit into a manageable challenge. Their guidance saved us millions and strengthened our compliance processes, leaving us better equipped for the future. Their support was invaluable to our business." — CIO, Italian Retailer

08 Governance Implementation: Preventing Future Exposure

💻

ILMT Configuration Hardening

Reconfigured ILMT with redundant data collection paths to prevent single-point-of-failure reporting gaps, automated alerting when reporting is interrupted, and regular validation that ILMT captures sustained (not peak) allocations consistently across all clusters.

📋

Centralised Entitlement Register

Created a single, authoritative register of all IBM entitlements, consolidating data from Passport Advantage records, reseller purchases, historical ELAs, and bundled component entitlements. This became the definitive reference for future audits.

🔄

Quarterly Internal Reviews

Established quarterly automated ILMT reports compared against the entitlement register with variance analysis. Semi-annual reviews by the internal IT governance team, with annual independent validation by Redress Compliance.

🎓

Training Programme

Delivered training for infrastructure, procurement, and change management teams covering IBM licensing fundamentals (PVU counting, sub-capacity rules, ILMT requirements), change management procedures, and procurement processes to ensure new deployments are properly entitled before go-live.

09 Key Lessons: What Every Enterprise Should Learn

🔍

Never Accept at Face Value

In our experience across dozens of IBM audits, the initial claim is overstated by 50 to 90%. IBM's methodology systematically favours overstatement. Every claim should be independently verified before any settlement discussion begins.

📈

Sub-Capacity Is the Highest-Value Battleground

Sub-capacity claims accounted for 57% of this audit and were reduced by 96%. The difference between ILMT peak captures and actual sustained allocations is the single largest source of audit inflation. Independent VMware data is essential.

📄

Entitlement Records Are Incomplete

IBM's Passport Advantage records frequently miss reseller purchases, bundled ELA components, and included sub-products. In this case, €4.1M in genuine entitlements were absent from IBM's records.

ILMT Gaps Are IBM's Weapon

IBM uses even brief ILMT reporting gaps to justify full-capacity fallback, potentially multiplying requirements by 5 to 10x. A 17-day gap nearly cost this retailer €2.7M. Ensuring continuous, redundant ILMT reporting is a critical defence investment.

🏭

Retail Creates Specific Risks

Retailers with seasonal demand (Black Friday, holiday sales) are particularly vulnerable because DRM and auto-scaling create temporary capacity spikes that ILMT records as permanent allocations. Any retailer with virtualised IBM should proactively verify ILMT behaviour.

🤝

Independent Advisory Transforms Outcomes

The advisory investment represented approximately 3% of the €17.1M in claim reduction achieved. Without independent analysis, the retailer would have been negotiating from IBM's €18M position rather than from a verified €900K position.

10 Why Independent Advisory Transforms IBM Audit Outcomes

IBM audits are high-stakes events where the difference between the initial claim and the verified position can represent tens of millions of euros. Independent advisory closes the information and expertise gap that gives IBM a structural advantage.

1

IBM Licensing Expertise

Our team includes former IBM licensing professionals who understand IBM's audit methodology, ILMT tool behaviour, sub-capacity rules, and negotiation playbook from the inside. This expertise identifies errors that IBM's own team may not acknowledge without specific, technically grounded challenges.

2

Independent Technical Verification

We independently verify every deployment metric using hypervisor data, infrastructure logs, and contract analysis, not relying on IBM's ILMT output alone. This verification consistently reveals inflated counts, missing entitlements, and misapplied licensing rules.

3

Complete Vendor Independence

Redress Compliance has no commercial relationship with IBM. No partner status, no resale revenue, no referral commissions. Our recommendations are exclusively aligned with our clients' interests. This independence is critical in audit defence.

Expert Perspective. "IBM audit claims are overstated by 50 to 90% in virtually every engagement we defend. The combination of peak-based sub-capacity counting, incomplete entitlement records, and aggressive full-capacity fallback tactics creates a structural inflation that only independent technical analysis and negotiation expertise can counter."

Frequently Asked Questions

How common is it for IBM audit claims to be overstated?+

Very common. In our experience across dozens of IBM audits, the initial claim is overstated by 50 to 90%. The overstatement results from systematic factors: ILMT captures peak rather than sustained allocations, IBM's entitlement records are frequently incomplete, and IBM applies full-capacity fallback aggressively when any ILMT reporting gap exists.

What is sub-capacity licensing and why does it matter?+

Sub-capacity licensing allows you to licence only the processor cores allocated to a virtual machine rather than the full physical server. For example, a physical server with 24 cores but a VM using 4 cores means you licence 4 cores rather than 24. Sub-capacity requires deploying ILMT and maintaining continuous reporting. IBM audits frequently inflate counts by using peak allocations, counting decommissioned environments, and applying full-capacity fallback for reporting gaps.

What happens if there is a gap in ILMT reporting?+

IBM may use an ILMT reporting gap to argue that sub-capacity eligibility is invalidated, reverting to full-capacity counting. Full-capacity can multiply the licence requirement by 5 to 10x. However, IBM's own documentation acknowledges that brief, planned interruptions do not automatically invalidate eligibility. The key is having evidence that no capacity changes occurred during the gap. In this case, a 17-day gap was challenged successfully by demonstrating it was planned, temporary, and covered by alternative VMware monitoring data.

Are retailers particularly vulnerable to IBM audit inflation?+

Yes. Retailers with seasonal demand patterns create temporary capacity spikes that IBM's ILMT records as sustained allocations. VMware's DRM automatically scales capacity during events like Black Friday, and ILMT frequently captures the expanded allocation without recording its temporary nature. Any retailer with virtualised IBM deployments should proactively verify ILMT behaviour.

How long does an IBM audit defence engagement typically take?+

Typically 12 to 16 weeks from initial engagement to settlement. The phases are: audit report analysis (2 to 3 weeks), data validation and independent measurement (3 to 4 weeks), corrected compliance report and negotiation (4 to 5 weeks), and governance implementation (2 to 3 weeks). We recommend engaging advisory as soon as the audit notification is received.

Can I use VMware data to challenge IBM's ILMT findings?+

Yes, and this is one of the most effective strategies. VMware vCentre provides detailed, time-stamped records of actual vCPU allocations, DRM events, and capacity changes. This data is independent of ILMT and frequently shows lower sustained allocations than ILMT's peak-based captures. IBM generally accepts VMware-sourced evidence when presented as part of a structured technical challenge.

Does Redress Compliance have any commercial relationship with IBM?+

No. Redress Compliance is a 100% independent advisory firm with no commercial relationship with IBM or any other software vendor. We do not resell IBM licences, hold IBM partner status, or earn referral commissions. This complete vendor independence ensures our recommendations are exclusively aligned with our clients' interests.

Facing an IBM Audit? Let's Talk.

Redress Compliance delivers independent IBM audit defence for enterprises worldwide. €18 million reduced to €900,000 for this retailer. Complete vendor independence. Challenging inflated claims with verified technical evidence.

Book a Confidential Call →
FF

Fredrik Filipsson

Co-Founder, Redress Compliance

Fredrik Filipsson is the co-founder of Redress Compliance. With over 20 years of experience in software licensing and contract negotiations, including tenures at IBM, SAP, and Oracle, Fredrik has helped hundreds of organisations optimise costs, avoid compliance risks, and secure favourable terms with major software vendors.

← Back to IBM Licensing Knowledge Hub