Customers who treat the notice as a compliance finding sign at 80 to 100 percent of the opening claim, and customers who treat it as a negotiation settle at 35 to 60
The arithmetic of an IBM settlement is decided long before the number is agreed. It is decided by which of two documents you think you received.
Prepared by Redress Compliance · August 17, 2026 · IBM advisory. 25 to 35 IBM ELA and audit defence engagements, 2024 to 2025.
Executive summary
Customers who treat the notice as a compliance finding sign at 80 to 100 percent of the opening claim. The document is read as an assessment to be verified, and verification is not a negotiating position.
Customers who treat it as the start of a six to twelve month negotiation resolve at 35 to 60 percent. They run ILMT remediation in parallel and structure the settlement as a multi year subscription, which is a different exercise entirely.
The difference is roughly half the claim, and it is decided in the first week. Not by the evidence, which is the same in both cases, but by what the receiving organisation decides the document is.
ILMT remediation runs alongside the negotiation, not before it. Waiting to be clean before engaging surrenders the calendar, and the calendar is most of the leverage in an audit.
The first 72 hours
The response posture is set almost immediately, and the sequence below is what separates the two outcomes rather than anything that happens months later.
| Window | What happens | Why it matters |
|---|---|---|
| Hour 0 to 4 | Acknowledge receipt, nothing more | Early substantive replies become the baseline |
| Hour 4 to 24 | Convene internally, freeze ad hoc data sharing | Uncoordinated disclosure is difficult to withdraw |
| Hour 24 to 48 | Establish the scope question and the evidence standard | Scope agreed by default is scope conceded |
| Hour 48 to 72 | External engagement | The posture decision is effectively locked after this |
Nothing in this table is about the licensing position, and that is the point. The evidence is the same for the customer who pays 90 percent of the claim and the customer who settles at 45. What differs is a decision made before anyone has counted anything: whether the organisation believes it has received an assessment to verify or an opening position to negotiate. Verification has one possible outcome, which is agreement. Negotiation has a range, and the range is worth roughly half the claim.
Verification has one outcome. Negotiation has a range
Across roughly 25 to 35 IBM ELA and audit defence engagements run between 2024 and 2025, the spread between good and bad outcomes was unusually wide and unusually predictable. Customers who treat the notice as a compliance finding sign settlements at 80 to 100 percent of the opening claim. Customers who treat it as the start of a six to twelve month negotiation, run ILMT remediation in parallel, and structure the settlement as a multi year subscription routinely resolve at 35 to 60 percent. That is roughly half the claim, separating two groups facing the same evidence.
The mechanism is a category error made in the first week. A compliance finding is something you verify: you check the numbers, you confirm or correct them, and you settle at whatever the corrected figure turns out to be. That process has exactly one possible destination, which is agreement with a number the other side produced. An opening claim is something you negotiate, and negotiation has a range. Both descriptions fit the same document. Only one of them describes what it actually is.
The parallel ILMT work is what makes the negotiating posture credible rather than merely defiant. Remediation runs alongside the response, not before it, and the distinction matters more than it sounds. An organisation that decides to get clean first and engage afterwards has handed over the calendar, and in an audit the calendar is most of the leverage. Running remediation in parallel means the compliance position is improving throughout the discussion, which changes what is true about the estate while the claim is still being argued rather than after it has been settled.
The settlement structure is the third element and it is where the number finally lands. Resolving as a multi year subscription rather than a lump sum back charge converts a penalty into a commercial arrangement, which is a form both sides can defend internally and which is why well represented customers land in the 35 to 60 percent band rather than arguing to a standstill at 80. None of this requires an unusual licensing argument. It requires deciding, in the first 72 hours, which document you received. The ILMT exposure detail sits in the ILMT exposure report, the sub capacity rules in sub capacity compliance, and the library in the IBM practice.
- Your agreements decoded into plain English before the auditor interprets them for you
- Entitlements, caps, and protections verified across your whole contract portfolio
- A defensible position paper generated in minutes, not weeks
How to run the response
- Decide in the first 72 hours that this is an opening position, not a finding, because that single classification is worth roughly half the claim.
- Acknowledge receipt without engaging on substance, since early substantive replies become the baseline everything afterwards is measured against.
- Freeze uncoordinated data sharing immediately, as disclosure made informally is very difficult to withdraw later.
- Run ILMT remediation in parallel with the negotiation, not before it, so the compliance position improves while the claim is still being argued.
- Plan for six to twelve months, which is the realistic duration and also the thing that makes the negotiating posture credible.
- Structure the settlement as a multi year subscription, which converts a back charge into a commercial arrangement both sides can defend internally.
What the audit engagements showed, 2024 to 2025
Across roughly 25 to 35 IBM ELA and audit defence engagements, three patterns recur:
Of the opening claim, signed by customers who read the notice as an assessment to be verified rather than a position to be negotiated.
Of the opening claim, settled by customers who ran a six to twelve month response with parallel ILMT remediation and a multi year subscription structure.
Settlements at well represented customers typically resolve at 35 to 60 percent of IBM's opening claim, with a multi year subscription structure rather than a lump sum back charge.
The evidence is the same in both groups. What differs is a classification decision made in the first week, before anything has been counted.
Your first five moves
- Classify the document correctly on day one. It is an opening position, and treating it as a finding costs roughly half the claim.
- Acknowledge receipt and stop there, routing every subsequent request through a single coordinated channel.
- Start ILMT remediation immediately and in parallel, rather than waiting to be clean before engaging.
- Set the scope and evidence standard explicitly before producing data, since scope accepted by default is scope conceded.
- Aim the settlement at a multi year subscription. The IBM practice runs the response with you.
Frequently asked questions
What do IBM audits typically settle at?
It depends almost entirely on posture. Customers who treat the notice as a compliance finding sign at 80 to 100 percent of the opening claim. Customers who treat it as a negotiation settle at 35 to 60 percent.
Why is the spread so wide?
Because verification and negotiation have different shapes. Verification has one destination, agreement with a number the other side produced. Negotiation has a range, and both descriptions fit the same document.
How long should the response take?
Six to twelve months for a well run one. That duration is not a delay tactic; it is what running remediation, challenging findings, and structuring a settlement actually takes.
Should we fix ILMT before responding?
No. Run remediation in parallel with the negotiation. Getting clean first hands over the calendar, and in an audit the calendar is most of the leverage.
What happens in the first 72 hours?
Acknowledge receipt without substance, convene internally and freeze ad hoc data sharing, establish the scope question and evidence standard, then engage externally. The posture is effectively locked after that.
Why does uncoordinated data sharing matter?
Because disclosure made informally is very hard to withdraw. An early substantive reply becomes the baseline that everything afterwards is measured against, whether or not it was accurate.
How should the settlement be structured?
As a multi year subscription rather than a lump sum back charge. That converts a penalty into a commercial arrangement both sides can defend internally, which is why represented customers land in the lower band.
Does the licensing argument matter?
Less than the classification decision. The evidence is the same for the customer paying 90 percent and the one settling at 45. What differs is what each decided the document was in the first week.
What is the most common mistake?
Reading the notice as an assessment to be verified. It is an understandable reading, it feels responsible, and it removes the only outcome range available to you.
Do we need external help?
The engagements that landed in the 35 to 60 percent band brought it in within the first 72 hours. What it buys is mostly the classification decision and the discipline to hold it, both of which are hardest for the organisation receiving the notice.
