IBM Audit Defence Checklist

📘 Part of our IBM Licensing Knowledge Hub — see more enterprise licensing case studies.

Your Progress

0/32 (0%)

🚨

Phase 1: Immediate Response

5 items

0/5

▾

Verify the IBM audit notification is legitimate

Confirm the letter references your Passport Advantage agreement audit clause. IBM uses third-party auditors (Deloitte, KPMG, EY).

Important

Do NOT respond to IBM or their auditor without strategy

Any data shared can be used against you. Pause and prepare before engaging.

Critical

Engage independent IBM licensing advisory

IBM-appointed auditors work for IBM. You need independent representation.

Critical

Assemble your internal audit response team

Include: IT infrastructure, middleware team, procurement, legal, and an executive sponsor.

Locate all Passport Advantage agreements and entitlement records

Gather PVU entitlements, Authorised User counts, and all IBM licence certificates. Missing records = assumed non-compliance.

Important

🔍

Phase 2: ILMT & Sub-Capacity Assessment

6 items

0/6

▾

Verify ILMT is deployed on ALL servers running IBM software

ILMT must cover 100% of servers. Any gap invalidates sub-capacity rights for your ENTIRE estate.

Critical

Confirm ILMT is generating reports at least every 90 days

IBM requires regular ILMT reporting. Missing reports invalidate sub-capacity rights.

Critical

Verify ILMT report retention covers the required 2-year period

IBM can request 2 years of ILMT data. Missing historical reports are a major audit finding.

Important

Validate ILMT agent coverage matches actual server inventory

Compare ILMT agent list against your CMDB. Every server with IBM software must have an active ILMT agent.

Check ILMT bundling and exclusion rules are correctly configured

Incorrect ILMT configuration is the #1 cause of inaccurate sub-capacity reporting. Validate all bundling rules.

Important

If ILMT is NOT deployed, calculate full-capacity exposure immediately

Without ILMT, IBM will licence at full physical server capacity. This can be 5-10x the sub-capacity requirement.

Critical

📊

Phase 3: Licence Position Analysis

6 items

0/6

▾

Build your IBM Effective Licence Position

Map every IBM product deployment against PVU or Authorised User entitlements.

Important

Calculate PVU requirements using the IBM PVU table

Different processor families have different PVU-per-core values. Apply the correct values from the IBM PVU table.

Map all virtualisation platforms (VMware, PowerVM, KVM, Hyper-V)

Virtualisation licensing rules differ by platform. VMware without ILMT = full physical server in scope.

Critical

Identify all IBM products including middleware and database

WebSphere, MQ, Db2, Cognos, and other middleware are commonly underlicensed. Inventory every product.

Check for IBM products installed by third-party applications

Some applications bundle IBM runtime components that may require separate licensing.

Quantify compliance gaps at your contractual discount level

Know your exposure before IBM does. Calculate using your Passport Advantage pricing.

🤝

Phase 4: Auditor Engagement

5 items

0/5

▾

Control the data you share with the IBM auditor

Provide only what your contract requires. Do not share raw infrastructure scans or CMDB exports.

Important

Challenge any attempt to licence at full capacity if you have ILMT

If ILMT is deployed and reporting, sub-capacity licensing must be recognised. Push back on full-capacity claims.

Critical

Dispute any findings based on incorrect PVU calculations

Verify the auditor is using the correct PVU-per-core values for your specific processor types.

Challenge container and Kubernetes licensing claims

Container licensing rules are complex. IBM may claim entire Kubernetes clusters are in scope when only specific pods run IBM software.

Important

Track all auditor communications and requests

Maintain a detailed log of every interaction, data request, and finding.

💰

Phase 5: Negotiation & Resolution

5 items

0/5

▾

Do not accept the initial IBM compliance claim

IBM audit claims are typically inflated. Challenge every finding with evidence.

Critical

Negotiate at your Passport Advantage discount level

Compliance purchases should be at your existing rates, not list price.

Important

Consider an ELA or PULA to resolve gaps cost-effectively

An unlimited licence arrangement may cost less than back-licensing individual product gaps.

Negotiate a compliance grace period for remediation

Request time to bring ILMT into compliance rather than paying for historical gaps.

Tip

Document all resolution terms precisely

Include exact product names, entitlement counts, PVU quantities, and compliance confirmation.

Important

🛡️

Phase 6: Post-Audit Governance

5 items

0/5

▾

Achieve and maintain 100% ILMT agent coverage

This is your single most important ongoing compliance task. Automate agent deployment.

Critical

Automate quarterly ILMT report generation

Set up automated reporting with email alerts to prevent gaps.

Implement change management for IBM deployments

Require approval for any new IBM product installations or infrastructure changes.

Run quarterly internal compliance reviews

Review ILMT data quarterly. Fix issues before they become audit findings.

Recommended

Negotiate improved audit terms at next Passport Advantage renewal

Limit audit frequency and require advance notice in your next agreement.

Tip

Need IBM Audit Defence Support?

Redress Compliance provides independent IBM audit defence. We help enterprises validate ILMT data, challenge audit findings, and negotiate fair resolutions.

Book a Free Consultation

Get Your Personalised Report

Need IBM Audit Defence Support?

Related Guides

Explore More Licensing Hubs

Ready to Take Control of Your Software Licensing?