IBM Practice
Italian retailer IBM audit. Claim cut 92 percent.
Seasonal capacity priced as permanent, store systems outside ILMT, acquired brands unmapped. The rebuilt evidence settled it 92 percent lower.
Seasonal capacity priced as permanent, store systems outside ILMT, acquired brands unmapped. The rebuilt evidence settled it 92 percent lower.
An Italian retail group faced an IBM claim built on full capacity counting of a seasonal, distributed estate. ILMT reconstruction and entitlement consolidation settled it 92 percent below the opening demand.
A leading Italian retail group faced an IBM audit claim that closed 92 percent below the opening demand once the measured position was rebuilt. The claim was built on full capacity counting across a virtualized, seasonally scaled estate with incomplete ILMT coverage.
The estate ran WebSphere, Db2, and MQ across central data centers and distributed store infrastructure under Passport Advantage terms. The audit firm counted every core in every cluster at full capacity PVU rates, including capacity provisioned only for the December trading peak.
Retail capacity breathes: clusters scale up for peak trading and back down after. Full capacity methodology freezes the estate at its largest configuration and prices it as permanent, which in this case multiplied the genuine position several times over.
Central data centers reported correctly. Store level and edge systems, added through years of expansion and brand acquisitions, sat outside ILMT scope, per the requirements in the ILMT documentation, and defaulted to full capacity in the claim under IBM's sub capacity licensing rules.
The defense rebuilt the measured position across three tracks: ILMT extension and historical reconstruction, entitlement consolidation across acquired brands, and a deployment timeline that separated seasonal from permanent capacity. The settlement followed the evidence.
Defense tracks and what each removed from the claim
| Track | Evidence produced | Effect on claim |
|---|---|---|
| ILMT extension and reconstruction | Sub capacity eligibility across store and edge systems | Largest reduction |
| Entitlement consolidation | Acquired brand licenses mapped to deployments | Removed false unentitled findings |
| Seasonal capacity timeline | Hypervisor records of scale up and scale down | Peak priced as peak, not as permanent |
| Bundle verification | Components matched to bundle entitlements | Standalone rate claims corrected |
Licenses purchased by merged retail brands over a decade were consolidated into one entitlement registry and matched to running deployments. Findings that looked like unlicensed deployment were, in most instances, entitlement sitting in a different legal entity's name.
The standard advice is to settle IBM audits quickly to cap legal spend and preserve the relationship. We disagree. In roughly 18 of the 20 to 30 IBM defenses Morten Andersen worked between 2024 and 2025, the time spent rebuilding evidence returned between 10x and 50x its cost in claim reduction, and IBM's account relationship survived every one of them. The buyer side move is to fund the evidence phase properly and let the measured position set the settlement range. Speed serves the claimant; the clock pressure in the audit letter is a negotiation device, not a deadline.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
The audit clock is theirs. The evidence is yours. Settlements follow whichever one you feed.
Retail's audit risk profile is structural: seasonal capacity, distributed infrastructure, and acquisition history. Each needs a standing control, not a crisis response.
ILMT coverage extended to all store infrastructure, an entitlement registry across all brands, and seasonal scaling documented as standard change management. The next audit letter meets a two week evidence turnaround.
The IBM audit defense playbook sequences the full response, and the IBM audit defense service runs it. Compare the US media company case for the same pattern in a different vertical.
The settlement closed 92 percent below IBM's opening claim. ILMT extension and reconstruction, acquired brand entitlement consolidation, and seasonal capacity evidence each removed a layer of the demand.
Full capacity methodology freezes the estate at its largest configuration. Capacity added for peak trading gets counted as permanent deployment, which can multiply the genuine position several times over until scale down evidence corrects it.
Hosts outside ILMT scope lose sub capacity eligibility and default to full physical capacity counting. Distributed store and edge infrastructure is where coverage breaks first in retail, and extending plus reconstructing coverage is usually the largest single claim reduction.
Routinely. Entitlements held in acquired entity names do not match deployment records, so licensed software looks unentitled in audit findings. Consolidating entitlements into one registry after every acquisition prevents the false finding.
In our 2024 to 2025 defenses, evidence work returned 10x to 50x its cost in claim reduction, and the IBM relationship survived every case. The audit letter's clock pressure is a negotiation device; the measured position should set the settlement range.
ILMT extension method, seasonal capacity documentation, acquired entity entitlement mapping, and the negotiation sequencing that cut this claim 92 percent.
Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.
