IBM Licensing · IASP Program

IBM Authorised SAM Provider
(IASP) Program Guide

IBM’s Authorised SAM Provider programme offers enterprises a structured alternative to formal licence audits. By engaging an IBM-accredited SAM partner for continuous compliance monitoring, organisations receive effective audit immunity in exchange for regular reporting. This guide provides the complete framework CIOs need to evaluate, enrol in, and maximise the value of the IASP programme.

IBM Licensing IASP Programme Audit Prevention 13 min read
0
Formal IBM Audits While Enrolled in IASP
Quarterly
Typical Compliance Reporting Cycle
Sub-Cap
ILMT Compliance Maintained Proactively
$50–150K
Typical Annual IASP Provider Fee

1. What Is IBM’s IASP Programme and How Does It Work?

The IBM Authorised SAM Provider (IASP) programme is IBM’s structured alternative to formal licence audits. Instead of IBM conducting periodic surprise compliance reviews — which can disrupt operations for months and generate multi-million-dollar findings — qualified enterprises can enrol in IASP and work with an IBM-accredited SAM partner who continuously monitors their licence compliance.

The core mechanism is straightforward: continuous oversight replaces periodic confrontation. An IBM-accredited SAM provider regularly assesses your IBM software deployments, produces Effective Licence Position (ELP) reports, identifies compliance gaps, and gives you the opportunity to remediate them proactively. In exchange, IBM agrees not to initiate formal audits for the duration of your IASP enrolment.

🔍

Regular Assessments

Your IASP provider collects deployment data quarterly or semi-annually, analyses entitlements vs usage, and produces an ELP report covering every IBM product in your estate.

📝

ELP Reporting to IBM

The provider shares a summary compliance report with IBM. This confirms your compliance position without IBM needing to conduct their own review. Findings are addressed collaboratively.

🛠

Collaborative Remediation

If gaps are found — say 50 PVUs short on WebSphere — you remediate by adjusting usage or purchasing licences. No formal non-compliance notice. No adversarial process. No back-dated penalties.

🔒

Audit Immunity

IBM formally agrees to waive routine audit rights while you are enrolled and compliant. The continuous IASP process replaces the traditional audit mechanism entirely.

“IASP is not about avoiding compliance — it is about managing compliance continuously rather than reactively. The organisations that benefit most are those that treat IASP as a governance framework, not an audit shield.”

Joining IASP involves signing agreements with both IBM and the SAM provider. IBM’s agreement outlines data-sharing requirements and the audit waiver terms. The provider’s contract covers scope, fees, and service levels. The combined cost is a fraction of what a formal audit finding typically generates.

2. Benefits of Enrolling in IASP

The IASP programme delivers value across multiple dimensions — from audit risk elimination to licence optimisation and improved IBM commercial relationships.

Primary Benefit

Formal Audit Elimination

No surprise IBM audits. No KPMG or Deloitte teams arriving at your offices. No 6–12 month disruption. No emergency budget requests. IBM formally waives its audit rights for the duration of your IASP enrolment. This is the single most valuable benefit for most enterprises.

Primary Benefit

Sub-Capacity Protection

IASP providers monitor ILMT compliance continuously. If a sub-capacity gap is discovered (e.g., ILMT not deployed on a new VMware host), you fix it before IBM ever sees it. Without IASP, IBM would convert the entire server to full-capacity pricing — potentially millions in penalties.

Strategic Benefit

Licence Optimisation

Regular reviews surface shelfware, over-provisioned deployments, and opportunities to consolidate. IASP providers routinely identify 10–20% savings through licence reallocation, support reduction, and entitlement clean-up.

🎯 Additional Benefits

  • Budget predictability: Compliance gaps are identified early and remediated incrementally. No surprise multi-million-dollar true-ups. IT finance teams can plan for licence adjustments on a quarterly basis rather than scrambling to fund audit findings.
  • Improved IBM relationship: IASP enrolment signals to IBM that you are a responsible, compliant customer. This creates goodwill that translates into more favourable commercial negotiations for ELAs, renewals, and new purchases.
  • Internal resource smoothing: Formal audits consume 500–2,000 hours of internal effort over 6–12 months. IASP spreads the compliance workload across the year in manageable quarterly cycles, typically requiring 50–100 hours per review.
  • Reduced legal risk: Audit findings create legal liability and can trigger breach-of-contract claims. IASP’s collaborative remediation model eliminates the adversarial dynamic and reduces the risk of escalation to legal proceedings.
  • Data-driven governance: The ELP reports produced by your IASP provider create a documented audit trail of your compliance position over time. This documentation is invaluable for internal governance, board reporting, and M&A due diligence.

3. IASP vs Formal Audit: A Direct Comparison

Understanding the practical differences between the IASP programme and IBM’s traditional audit process helps CIOs make an informed decision about which approach better suits their organisation.

DimensionIASP ProgrammeFormal IBM Audit
TriggerVoluntary enrolment by customerIBM-initiated, often without warning
FrequencyContinuous (quarterly/semi-annual)Periodic (every 2–4 years typically)
Conducted byIBM-accredited SAM provider of your choiceIBM’s audit team or Big 4 firm (IBM’s choice)
ToneCollaborative, advisoryAdversarial, compliance-enforcement
RemediationFix before IBM sees the findingIBM issues findings; negotiation follows
Sub-capacity riskGaps corrected proactively; no full-capacity penaltyILMT gaps = full-capacity pricing = massive liability
Internal disruption50–100 hours per quarterly cycle500–2,000 hours over 6–12 months
Cost$50K–$150K/year (provider fees)$0 upfront, but findings typically $500K–$5M+
Commercial leverageYou control the process and timelineIBM controls scope, timeline, and findings
OutcomeCompliance maintained; no penaltiesCompliance gap + back-dated fees + forced purchases
Expert Insight

In our advisory practice, the average IBM formal audit finding for a Fortune 500 enterprise is $1.5M–$4M. Even after negotiation, settlements typically land at $500K–$2M. The annual cost of IASP enrolment ($50K–$150K) represents 3–10% of the typical audit settlement. For any enterprise with a complex IBM estate, IASP is a mathematically straightforward risk mitigation decision.

4. Requirements and Considerations for Joining IASP

IASP is not open to every IBM customer. Understanding the eligibility requirements and practical considerations ensures your organisation is prepared for a successful enrolment.

📋

Minimum IBM Spend

IASP is typically available to customers with significant IBM software estates — generally $1M+ in annual support and subscription fees. Smaller customers may not qualify or may not justify the IASP provider fees.

💻

ILMT Deployment

IBM requires ILMT (IBM Licence Metric Tool) or BigFix to be deployed across your virtualised environments. If ILMT is not currently deployed, you will need to implement it before or during IASP onboarding. See IBM ILMT & Sub-Capacity Guide.

👤

Internal SAM Resources

Your organisation needs at least one dedicated resource (SAM analyst or IT asset manager) to coordinate with the IASP provider, provide deployment data, and manage remediation actions. Without this, the programme stalls.

📄

Data-Sharing Agreement

You must be willing to share detailed deployment data (server configurations, IBM product installations, ILMT reports) with both the IASP provider and, in summary form, with IBM. Organisations with strict data sovereignty requirements should review these obligations carefully.

Important caveat: IASP audit immunity is conditional. IBM reserves the right to conduct a formal audit if you (a) fail to comply with the programme’s reporting requirements, (b) refuse to remediate identified compliance gaps within a reasonable timeframe, or (c) egregiously violate IBM’s licence terms. The immunity is not unconditional — it depends on your continued, good-faith participation in the programme. Treat the reporting deadlines and remediation commitments as non-negotiable.

5. Choosing Your IASP Provider

IBM accredits a limited number of SAM firms to serve as IASP providers. Your choice of provider significantly affects the quality and commercial value of your IASP experience.

Selection Criteria

IBM Licensing Depth

The provider must have deep expertise in IBM’s licensing models — PVU, VPC, RVU, authorised user, sub-capacity rules, ILMT configuration, Cloud Paks, and Passport Advantage. Generic SAM tools expertise is not sufficient. Ask about their IBM-specific consultant bench strength.

Selection Criteria

Independence from IBM

The IASP provider reports to IBM, but their client is you. Choose a provider that has a track record of advocating for the customer’s interests rather than simply maximising IBM’s compliance revenue. Ask for references from customers who had compliance gaps identified and how they were handled.

Important

Global Coverage

If you have IBM deployments across multiple regions, ensure the provider can support your entire global footprint. IBM licence compliance must be measured globally — a gap in your Singapore office is just as material as one in your US headquarters.

Negotiation tactic: IASP provider fees are negotiable. Start by getting proposals from at least two accredited providers. Typical fees range from $50K–$150K per year depending on your IBM estate complexity and number of quarterly reviews. For larger estates ($5M+ annual IBM spend), negotiate a fixed annual fee rather than a per-review charge. Also negotiate the scope to include licence optimisation recommendations — not just compliance reporting — at no additional cost.

For detailed guidance on IBM licence models your provider must understand, see IBM Licence Models — Tips & Considerations and Decoding IBM PVU Licensing.

6. The Compliance Reporting Process

Understanding what IASP compliance reporting involves in practice helps CIOs set realistic expectations and allocate the right resources.

1

Data Collection (Week 1–2)

The IASP provider requests current ILMT/BigFix reports, server inventories, virtualisation platform configurations, IBM Passport Advantage entitlement records, and any recent deployment changes. Your SAM analyst prepares and delivers this data.

2

Analysis & ELP Production (Week 2–3)

The provider analyses deployments against entitlements, calculates PVU/VPC consumption per product, validates sub-capacity compliance, and produces a draft Effective Licence Position (ELP) report. This is the core deliverable.

3

Client Review & Challenge (Week 3–4)

You review the draft ELP, challenge any findings you disagree with (e.g., incorrect product identification, miscounted servers), and discuss remediation options for genuine gaps. This is your opportunity to refine findings before they go to IBM.

4

Remediation Planning (Week 4–6)

For confirmed gaps, develop a remediation plan: reassign licences, decommission unused installations, purchase additional entitlements, or adjust virtualisation configurations. Most gaps can be resolved within 30–60 days.

5

Reporting to IBM (Week 6–8)

The provider submits a summary compliance report to IBM confirming your position. If gaps existed and were remediated, the report confirms the remediation. IBM reviews and acknowledges. Cycle complete.

Cost Alert

Remediation of compliance gaps may require licence purchases. IASP does not eliminate the cost of being compliant — it eliminates the penalty of being found non-compliant in a formal audit. If you are genuinely under-licensed (e.g., 200 PVUs short on Db2), you will need to purchase those licences. The difference is that under IASP you buy them at your negotiated discount rather than at list price under audit duress. See IBM Negotiations Service for help securing optimal pricing.

7. IASP and Sub-Capacity Licensing: The ILMT Connection

Sub-capacity licensing — where you licence IBM software based on the PVUs of the virtual machines actually running it, rather than the full physical server capacity — is the most financially significant aspect of IBM licensing for virtualised environments. IASP plays a critical role in maintaining sub-capacity eligibility.

ScenarioWithout IASPWith IASP
ILMT not deployed on new VMware hostIBM audit discovers gap; entire host charged at full capacity (potentially $500K+ penalty)IASP review catches it; you deploy ILMT before IBM ever knows. $0 penalty.
ILMT reporting gap (3+ months)IBM audit claims full-capacity licence requirement for the gap periodIASP provider flags reporting gap at next review; you restore ILMT data and avoid full-capacity conversion.
VM mobility not trackedIBM claims peak PVU across all hosts where VM appeared; licence demand doublesIASP provider validates ILMT is capturing vMotion correctly; you adjust before reporting.
Cloud migration without BYOL validationIBM audit claims cloud instances need separate licences; $1M+ findingIASP provider verifies BYOL entitlements and cloud licence positioning proactively.

For organisations with significant virtualised IBM estates (VMware, PowerVM, Hyper-V), the sub-capacity protection provided by IASP alone justifies the programme cost. A single ILMT compliance gap in a formal audit can generate a finding larger than 10 years of IASP provider fees.

For comprehensive sub-capacity licensing guidance, see IBM Sub-Capacity Licensing & ILMT Compliance.

8. Cost-Benefit Analysis: Is IASP Worth It?

The financial case for IASP depends on the size and complexity of your IBM estate, your audit risk profile, and the opportunity cost of formal audit disruption.

FactorIASP CostFormal Audit Cost (When It Happens)
Provider / auditor fees$50K–$150K/year$0 (IBM pays the auditor)
Internal effort200–400 hours/year (spread quarterly)500–2,000 hours over 6–12 months (concentrated)
Compliance finding risk$0 (gaps remediated before reporting)$500K–$5M+ (typical Fortune 500 finding)
Sub-capacity penalty risk$0 (ILMT gaps caught early)$500K–$10M (full-capacity conversion)
Business disruptionMinimal (embedded in quarterly rhythm)Significant (C-suite attention, legal involvement)
5-year total (estimated)$250K–$750K$1M–$10M+ when audit occurs
Mini Case Study

US Manufacturing Company: IASP Prevented $3.2M Audit Exposure

Situation: A US-based manufacturer with $8M in IBM software (Db2, WebSphere, MQ, ILMT across 400+ servers) enrolled in IASP after a peer company in their industry received a $4.5M IBM audit finding.

IASP Discovery: The first quarterly review identified: (a) ILMT not deployed on 12 VMware hosts added during a data centre migration, (b) 340 PVUs of Db2 deployed in a test environment without proper non-production licence entitlements, and (c) an expired Passport Advantage agreement covering 200 MQ licences.

Result: All three gaps were remediated within 60 days: ILMT deployed, test environment licenced at non-production rates ($45K), and Passport Advantage renewed. Total remediation cost: $78K. Estimated cost if found in a formal audit (full-capacity Db2 + back-support + list-price true-up): $3.2M. IASP programme fee: $85K/year. ROI: 37× in year one alone.
Takeaway: The gaps discovered were not intentional non-compliance — they were the inevitable result of infrastructure changes, migrations, and contract administration gaps. IASP catches these before IBM does.

9. When IASP May Not Be the Right Choice

IASP is not universally appropriate. In some situations, the programme may not deliver sufficient value to justify the investment.

Consider Alternatives

Small IBM Estate (<$500K Annual Support)

If your IBM spend is small and your product footprint is limited to 2–3 products on a handful of servers, the IASP provider fee may exceed your realistic audit risk. A periodic internal self-assessment may be more cost-effective.

Consider Alternatives

Active IBM Exit / Migration

If you are actively migrating off IBM software (e.g., moving from Db2 to PostgreSQL, from WebSphere to open-source) and expect to complete within 12–18 months, IASP enrolment may not justify the cost. Focus resources on a clean exit instead.

Evaluate Carefully

Existing Strong SAM Programme

If you already have a mature internal SAM team with ILMT deployed, regular self-assessments, and documented ELP reports, the incremental value of IASP may be limited. The primary additional benefit is the formal audit waiver — assess whether that alone justifies the fee.

For organisations considering their IBM strategy more broadly, see IBM Cost Optimisation & Shelfware Reduction and Third-Party Support for IBM Software.

10. The 10-Step IASP Implementation Playbook

Below is the complete framework for evaluating, enrolling in, and maximising the value of the IBM IASP programme.

1

Assess Your IBM Estate and Audit Risk

Inventory all IBM software products, deployment locations, licence types (PVU, VPC, authorised user), and support contracts. Quantify your total IBM spend and identify areas of known or suspected non-compliance. This determines whether IASP is cost-justified.

2

Verify ILMT Deployment Coverage

ILMT must be deployed on all virtualised environments running IBM sub-capacity products. Audit your ILMT coverage before approaching IASP providers. Any gaps need to be closed during onboarding at the latest.

3

Evaluate IASP Providers

Request proposals from at least two IBM-accredited providers. Evaluate their IBM licensing expertise, global coverage, reference clients, and fee structure. Negotiate for licence optimisation services to be included in the annual fee.

4

Conduct a Pre-IASP Internal Assessment

Before enrolling, conduct an internal self-assessment to identify and remediate the most obvious compliance gaps. It is far cheaper to fix known issues before IASP starts than to discover them in the first quarterly review and face remediation under time pressure.

5

Negotiate the IASP Agreement with IBM

IBM’s IASP terms are negotiable. Key negotiation points: scope of audit waiver (ensure it covers all IBM products, not just a subset), reporting frequency, remediation timelines, and the conditions under which IBM can revoke the waiver.

6

Sign Provider and IBM Agreements

Execute both contracts. Ensure the provider agreement includes clear SLAs (report delivery timelines, responsiveness, escalation procedures), termination-for-convenience rights, and confidentiality protections for your deployment data.

7

Onboard the IASP Provider

Provide access to ILMT data, Passport Advantage records, server inventories, and virtualisation platform configurations. Allow 30–45 days for the provider to baseline your environment and produce the first ELP report.

8

Establish an Internal Governance Rhythm

Designate a SAM analyst as the IASP coordinator. Schedule quarterly review meetings with the provider. Establish a remediation workflow for addressing findings within 30–60 days. Report compliance status to IT leadership quarterly.

9

Leverage IASP Data for Optimisation

Use the ELP reports to identify shelfware, over-provisioned licences, and support cost reduction opportunities. IASP data should drive your annual IBM ELA renewal and negotiation strategy. See IBM ELA Guide.

10

Review IASP Value Annually

At each annual renewal, assess whether IASP continues to deliver value. If your IBM estate is shrinking significantly, consider whether an internal SAM programme is sufficient. If your estate is growing, consider expanding the IASP scope to cover new products and deployments.

Frequently Asked Questions

Does IASP completely prevent IBM from auditing us?+
While enrolled and compliant, yes — IBM agrees to waive its standard audit rights. However, the waiver is conditional. If you fail to meet reporting requirements, refuse to remediate identified gaps, or egregiously violate IBM’s licence terms, IBM reserves the right to conduct a formal audit. The waiver covers routine compliance reviews only; it does not protect against fraud or wilful non-compliance.
How much does IASP cost?+
IASP provider fees typically range from $50,000 to $150,000 per year, depending on the size and complexity of your IBM estate. Larger estates with 500+ servers and multiple IBM products will be at the higher end. Fees are negotiable — request proposals from multiple accredited providers and negotiate for licence optimisation services to be included. The cost is a fraction of the typical formal audit finding ($500K–$5M+).
What data do we need to share with the IASP provider and IBM?+
The IASP provider needs: ILMT/BigFix scan data, server hardware inventories, virtualisation platform configurations, IBM Passport Advantage entitlement records, and details of any recent infrastructure changes. IBM receives a summary ELP report — not your raw data. The summary confirms your compliance position and any remediated gaps. Ensure your provider agreement includes confidentiality protections and limits on how data can be shared.
Can we leave IASP and return to normal IBM support?+
Yes. IASP enrolment is voluntary, and you can exit the programme at any time. However, once you leave, IBM’s standard audit rights resume immediately. Ensure your compliance position is clean before exiting — IBM may initiate an audit shortly after your departure if they have any concerns. Some organisations exit IASP once their IBM estate has been sufficiently simplified or reduced.
Is ILMT deployment mandatory for IASP?+
Effectively, yes. ILMT (or IBM BigFix Inventory) is required to support sub-capacity licence claims, and sub-capacity compliance is a core component of the IASP reporting process. If ILMT is not deployed, your IASP provider cannot validate your sub-capacity position, and IBM will not grant sub-capacity pricing. Deploy ILMT across all virtualised environments before or during IASP onboarding.
What happens if the IASP review finds compliance gaps?+
You remediate them. The process is collaborative, not punitive. Typical remediation options include: purchasing additional licences (at your negotiated discount, not list price), reallocating existing entitlements from under-utilised systems, decommissioning non-essential installations, or adjusting virtualisation configurations to reduce PVU/VPC consumption. You typically have 30–60 days to remediate before the finding appears in the IBM summary report.
Can independent advisors participate alongside the IASP provider?+
Yes, and we recommend it. An independent IBM licensing advisor can review the IASP provider’s findings, challenge any over-counted licence requirements, negotiate remediation pricing with IBM, and ensure the IASP provider is acting in your best interest (not IBM’s). Think of the independent advisor as your “audit defence” layer within the IASP process. The cost is minimal compared to the value of catching over-counted findings.
FF

Fredrik Filipsson

Co-Founder, Redress Compliance

Former Oracle, SAP, and IBM — now helping enterprises worldwide negotiate better software deals. 20+ years in enterprise licensing, 500+ clients served.