Swiss Financial Services IBM audit defense. 92 percent exposure reduction.

A leading Swiss financial services firm received an IBM audit finding with a large number attached. The number was not a dispute about entitlement. It was a consequence of what IBM could and could not see.

IBM sub capacity licensing lets you license the virtual capacity a workload uses rather than the full physical capacity of the host. That saving is conditional on the IBM License Metric Tool reporting on the environment, and on those reports being retained.

Where reporting is incomplete, IBM's default position is full capacity on the unreported hosts. On modern high core count servers that difference is enormous, which is how a reporting gap becomes an eight figure conversation.

The exposure fell by 92 percent. Almost none of that came from arguing about the contract.

The audit

Financial services firms are audited more often than most, because the estates are large, long lived and heavily virtualised. All three make sub capacity reporting harder to keep complete.

The approach arrived through Passport Advantage, which is where IBM licensing terms and the audit rights live. The scope covered several years of deployment across a mixed estate.

The opening finding priced a substantial share of the estate at full capacity, on the basis that sub capacity evidence for those hosts had not been produced.

Deployment data

The decisive work was reconstructing what the estate had actually been running, and proving it with the reports IBM's own requirements call for.

ILMT had been deployed, which is the usual position. It had not been extended consistently as the estate changed, which is also the usual position. New hosts, migrated workloads and rebuilt clusters had drifted out of coverage over time.

We rebuilt the picture from the retained ILMT reports, the virtualisation management platform, the configuration management database and the change records, then established which hosts genuinely had continuous coverage and which did not.

That distinction is the entire case. Hosts with continuous evidence are licensed at sub capacity. Hosts without it are the negotiation.

Entitlement

IBM entitlement accumulates across Passport Advantage agreements, individual purchases and anything inherited through acquisition, and it is rarely held in one place.

Two metrics were in play. Processor Value Units, the long standing metric that assigns points per core by processor type. And Virtual Processor Cores, the newer metric used for containerised and Cloud Pak deployments.

Estates running both, which most large IBM customers now do, need the entitlement reconciled separately under each metric. Mixing them produces a number that is wrong in both directions at once.

Where the exposure came from

Split by cause, the finding resolved into four components rather than one total.

• Hosts outside ILMT coverage. Priced at full capacity by default. The largest component by a wide margin.
• Gaps in retained reports. Coverage existed but the reports for parts of the period had not been kept.
• Metric confusion. Deployments counted under the wrong metric where PVU and VPC estates overlapped.
• Unrecorded entitlement. Licences the firm held but had not consolidated into a central record.

Only the first two are genuinely contestable, and both are contested with evidence rather than argument.

The response

Acknowledge, scope, evidence, close. The sequence matters as much as the content.

1. Acknowledge. Confirm receipt and agree a timeline. Send no data with it.
2. Scope. Establish which entities, which systems and which periods are in scope, in writing, before producing anything.
3. Evidence. Answer host by host with the reporting record, rather than disputing the total.
4. Close. Settle the corrected position and fix the reporting gaps so the next audit starts from a complete base.

The last step is the one that gets skipped. An audit closed without repairing coverage is an audit you will have again.

The eleven moves

These are the moves that removed the exposure. The first three did nearly all of it.

1. Establish actual ILMT coverage. Host by host, across the whole audit period.
2. Recover every retained report. Retention requirements are strict and the reports are the case.
3. Reconcile PVU and VPC separately. Two metrics, two counts, no blending.
4. Rebuild deployment from your own systems. Virtualisation platform, CMDB and change records together.
5. Consolidate entitlement from every source. Including anything acquired.
6. Scope the audit in writing first. Entities, systems, periods.
7. Answer host by host. A total invites negotiation; a line invites correction.
8. Separate the audit from any renewal. They are different conversations.
9. Repair coverage before closing. Otherwise the finding regenerates.
10. Set report retention deliberately. Not as a default that nobody owns.
11. Re verify quarterly. Coverage decays every time the estate changes.

The outcome

• Exposure. Reduced by 92 percent against IBM's opening position.
• Sub capacity restored. Evidenced across the hosts where coverage had been continuous.
• Metrics separated. PVU and VPC entitlement reconciled independently.
• Entitlement consolidated. Including licences held but never centrally recorded.
• Coverage repaired. Reporting extended across the estate before the audit closed.

The transferable point is unglamorous. IBM audit outcomes are set by reporting hygiene maintained over years, not by how well the response is argued in the weeks after a letter arrives.

How we engage

• IBM audit scoping. Six week engagement. IBM advisory practice.
• IBM audit response. Audit response engagement. IBM audit defense guide.
• IBM renewal negotiation. Renewal negotiation alongside the audit cycle. IBM contract negotiation service.
• IBM ILMT sub capacity. Coverage verification and report retention, so the next audit starts from a complete base. IBM ILMT sub capacity.
• Vendor Shield. Vendor Shield.
• Run the calculator. The audit defense readiness checklist.