IBM Practice
US media company IBM audit. Claim cut 84 percent.
The scan found installations. The business ran operations. Pricing the difference correctly cut the claim 84 percent.
The scan found installations. The business ran operations. Pricing the difference correctly cut the claim 84 percent.
A US media company faced an IBM claim that priced abandoned project environments as live deployment. Verification, ILMT reconstruction, and entitlement consolidation settled it 84 percent lower.
A leading US media company settled an IBM audit 84 percent below the opening claim after the measured position was rebuilt. The claim priced project based production infrastructure as permanent steady state deployment and counted abandoned project environments as live.
The estate ran WebSphere, MQ, and Db2 under Passport Advantage, with PVU sub capacity terms requiring ILMT coverage per the ILMT documentation. Coverage was solid in the broadcast core and absent in the project infrastructure layer.
Production projects provisioned environments fast and decommissioned them informally. The audit scan found IBM software on systems that had not served traffic in years, and full capacity PVU rates priced every one of them as current deployment.
Two acquired studios brought their own middleware estates with entitlements in legacy entity names. On paper, deployments without matching entitlements; in fact, licensed software with a paperwork gap.
Three defense tracks ran in parallel: deployment verification that separated live from abandoned, ILMT remediation with historical reconstruction, and entitlement consolidation across acquired entities. The settlement conversation started only after all three reported.
Defense tracks against the media company claim
| Track | What it established | Claim effect |
|---|---|---|
| Deployment verification | Abandoned project environments separated from live systems | Largest single reduction |
| ILMT remediation and reconstruction | Sub capacity eligibility restored for the project layer | Full capacity counting reversed |
| Entitlement consolidation | Acquired studio licenses matched to deployments | Unentitled findings cleared |
| Burst profile documentation | Project peaks evidenced as temporary | Steady state pricing corrected |
Where formal records did not exist, the team evidenced abandonment through traffic logs, access histories, and infrastructure tickets. IBM accepted the reconstructed timeline for the bulk of the disputed systems, which removed them from the claim entirely.
The standard advice is to accept the auditor's deployment scan as the factual baseline and argue only about entitlements and pricing. We disagree. In roughly 16 of the 20 to 30 IBM defenses Fredrik Filipsson ran in 2024 to 2025, the scan itself was the most inflated input, because discovery tools count installation, not operation. The buyer side move is to verify every scanned system's operational status before conceding it into the baseline. An installed binary on an abandoned project server is not a deployment; it is a cleanup task that arrived with an invoice.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
Discovery tools count installations. Invoices should count operations. The gap between those two numbers was 84 percent of this claim.
Media, gaming, and engineering organizations share the pattern: fast provisioning, informal decommissioning, acquisition sprawl. The controls are the same in every vertical that builds infrastructure per project.
Project closure now gates on software removal evidence, ILMT covers the project layer from provisioning, and the entitlement registry spans all acquired entities. The estate can answer an audit letter from records instead of archaeology.
The IBM audit defense playbook covers the full method, and the Italian retailer case shows the same defense in a seasonal estate. The IBM practice runs both sides: peacetime controls and live defense.
The settlement closed 84 percent below the opening claim. Deployment verification of abandoned project environments, ILMT reconstruction, and entitlement consolidation across acquired studios removed the inflated layers.
Audit discovery tools count installed software, not operating software. Production project environments had been informally decommissioned with IBM binaries still present, and full capacity rules priced each one as live deployment.
Usually. In this case traffic logs, access histories, and infrastructure tickets evidenced abandonment, and IBM accepted the reconstructed timeline for most disputed systems. Formal records are better; reconstruction works.
Fast project provisioning, informal decommissioning, and middleware inherited through acquisitions. Installed software accumulates on dead infrastructure, and audit scans price all of it until operational verification separates live from abandoned.
No. Verify every scanned system's operational status first. In most of our 2024 to 2025 IBM defenses the scan was the most inflated input in the claim, and conceding it early surrenders the largest reduction available.
Scan verification tactics, ILMT reconstruction steps, acquired entity entitlement mapping, and the negotiation control that cut this claim 84 percent.
Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.
