The IBM Audit Defense Guide: Download

The audit notice and the first 5 days

The audit notice arrives as a polite letter from IBM Compliance, often via the account team rather than directly from IBM Compliance Services. The first five days set the entire engagement posture. Acknowledge the notice in writing. Identify the named contractual basis (the audit clause in your IBM agreement). Engage independent advisory. Do not provide initial deployment data; do not commit to a measurement tool deployment timeline; do not agree to scope until the contractual basis is documented in writing.

The contractual scope limits IBM auditors must respect

Standard IBM audit clauses limit scope to specific products and specific Affiliates, require advance notice of typically 30 days, restrict examination to deployment data and not source code or configuration files, and prevent simultaneous audits of the same products within a defined window. These limits are routinely tested by auditors. They are routinely conceded by unprepared customers. The framework documents the language and the enforcement mechanics.

ILMT and SCRT: what is required versus what is sufficient

Sub capacity licensing requires customers to deploy IBM License Metric Tool (ILMT) on every host running PVU-licensed software, generate quarterly SCRT reports, and retain reports for two years. The contractual penalty for ILMT failure is reversion to full processor counting. The actual practical answer is more nuanced: ILMT exceptions, manual measurement substitution, and 90-day cure periods all exist contractually and apply when documented.

Sub capacity and the VMware question

The VMware sub capacity question is the largest single source of IBM audit findings. The IBM rule is that sub capacity licensing applies only to documented, capped, and ILMT-monitored VM clusters. Uncapped VMware clusters running IBM software default to full host counting. The framework includes the VMware configuration patterns that maintain sub capacity defensibility and the documentation requirements that make them auditable.

The 30 day evidence pack

Within 30 days of audit notice acknowledgment, produce the evidence pack: current ILMT extract, prior four quarters of SCRT reports, server inventory by location and Affiliate, virtualization cluster definitions for VMware and PowerVM, deployment confirmation by product, and the contractual entitlement record. The pack is the foundation of every subsequent negotiation. Customers without the pack negotiate from compliance; customers with the pack negotiate from position.

The 90 day negotiation window

After the evidence pack is delivered and the auditor produces a finding, the negotiation window opens. Standard IBM practice presents the finding as a number with limited explanation. The negotiation begins with deconstructing the number: which products, which counts, which assumptions, which contractual interpretations. Most findings deconstruct meaningfully; rarely is the opening number defensible after careful examination.

Settlement structures: cash, ELA, hybrid

Three settlement structures dominate. Cash settlement closes the finding and provides no forward value; typically negotiated at 25 to 40 percent of opening finding. ELA settlement converts the finding into a multi year commitment with discounted entitlement; typically negotiated at 35 to 55 percent of opening finding with forward value. Hybrid combines partial cash with cloud commitment to IBM Cloud or Watson AI; emerging structure since 2023.

IBM's escalation moves and how to handle them

IBM audit teams have a small set of repeatable escalation moves: the timeline acceleration framing (treating standard pace as obstruction), the executive escalation (engaging the CIO directly), and the renewal coupling (linking settlement to upcoming renewal). The framework includes the standard responses we deploy.