How an IBM software license audit works. Your ILMT evidence sets the finding.

An IBM software license audit is decided by your ILMT evidence. With current sub capacity reports you pay for the virtual cores you use. Without them, IBM counts every physical core on the host.

How does an IBM software license audit actually run?

An IBM software license audit is a contractual check under the verification clause of your Passport Advantage agreement. IBM, usually through an appointed third party firm, sends a notice, requests deployment data, measures your usage against entitlement and presents a finding.

Under that clause IBM may verify compliance at all of your sites on reasonable notice. It may use an independent auditor, provided IBM has a written confidentiality agreement with that firm. By default the process is procedural, and how it ends depends almost entirely on the quality of your sub capacity evidence.

The notice and the kickoff

The audit opens with a formal letter that cites the agreement clause and names the products in scope. A kickoff call follows, where the auditor proposes the scope, the timeline and the data request. Treat that call as a scoping negotiation, because what you accept there sets how much of your infrastructure the auditor will see.

• Notice. Confirms the legal basis and the products in scope. Check both against your own agreement before you reply.
• Kickoff. Sets the data request and the timeline. Both are negotiable, so put your own version in writing.
• Data collection. You provide ILMT reports and deployment records for the servers in scope.

Measurement, the draft finding and the invoice

The auditor compares measured deployment with your entitlement and issues a draft finding. This is the point to challenge the method and correct measurement errors, before the number is final and passes to IBM for billing.

The agreement also sets what the bill can contain. You pay the charges IBM specifies in its invoice for the excess use, plus Software Subscription and Support on that excess for the lesser of the period of excess use or two years. Check the start dates the auditor assigns to each shortfall, because they drive the back support charge.

Why does the IBM License Metric Tool decide the outcome?

ILMT decides the outcome because its reports are the evidence IBM requires before it accepts sub capacity counting. Sub capacity licensing means you license only the virtual cores assigned to an IBM product, instead of every core in the host or cluster. The right depends on running the IBM License Metric Tool and keeping its reports.

The Passport Advantage sub capacity rules set four conditions, and an auditor tests each one.

• Installation. ILMT must be installed within 90 days of your first sub capacity deployment.
• Reporting. Reports must be produced at least once per quarter.
• Retention. Those reports must be kept for two years.
• No exceptions. IBM stopped accepting exceptions to the ILMT requirement on May 1, 2023, including the one for companies with fewer than 1,000 employees. Customers that already qualified could report manually only until January 1, 2024.

What happens without compliant ILMT?

• Full capacity default. IBM counts every physical core on the host, whatever the virtual machine was assigned.
• Multiplier effect. A small product on a large host can be charged at many times its real footprint.
• No retroactive fix. Installing ILMT after the audit notice does not restore sub capacity for the period before it.

A worked example on a VMware cluster

Say you run IBM MQ in one virtual machine with 8 vCPUs. The machine sits in a six host VMware cluster, and each host is a two socket Intel Xeon server with 16 cores per socket. IBM's PVU table rates those cores at 70 PVUs each, as our PVU licensing guide explains.

The software and the workload are identical in all three rows. What changes is whether ILMT evidence exists for the period. If the auditor argues the machine could have run on any host in the cluster, the last row becomes the opening position, and back support is charged on top of it.

Keeping ILMT audit ready

Coverage is half of audit readiness. The other half is knowing what each product entitles you to deploy. The License Information documents in the IBM Terms catalog define which bundled components a parent program covers, which matters when the auditor starts counting components.

How do you check your own ILMT position before IBM does?

Run the checks the auditor will run, once a year before your support anniversary and again on the day a notice arrives. Each one uses screens and files ILMT already produces.

• VM Managers panel. Confirm every vCenter or other hypervisor manager shows a working connection. Without it ILMT cannot see host capacity, and the affected virtual machines drift toward full capacity counting.
• Scan status. Sort computers by last scan date and look for machines that stopped reporting. Those are the servers an auditor will price at full capacity.
• Software Classification panel. Confirm each discovered component is assigned to the product you actually licensed. Unconfirmed bundling is a common source of phantom products in a finding.
• All Metrics report. Read the peak PVU or VPC value per product for the period. Sub capacity is billed at the peak, so the current value understates your position.
• Audit snapshot. Generate one and open the data condition file inside it. It records the reporting period and the health of the data, which an auditor checks before trusting the numbers.
• Entitlement records. Pull your Passport Advantage entitlement and compare it, product by product, with the All Metrics peaks.

The contract now assumes you can do this on demand. The version 11 Passport Advantage terms, which apply to existing customers' orders and renewals from May 1, 2023, let IBM ask for deployment reports in its own format and expect them within 30 days.

Which mistakes turn into audit findings?

• Leaving servers out of ILMT. A cluster gets excluded during a migration and never added back. Every IBM product on it is then counted at full capacity for the whole gap.
• Running an old ILMT version. The terms expect you to upgrade promptly when IBM releases a new version. An outdated software catalog also misidentifies products, and those errors land in the finding.
• Collecting data but never generating reports. ILMT gathers data automatically, but the quarterly reports must be produced and kept. A quarter without reports is a quarter without proof.
• Accepting the auditor's spreadsheet as the record. Reconcile every line against your own ILMT data before you comment on any total.

How do you control the audit data request?

You control it by agreeing its limits in writing at the kickoff. The data request defines how much of your infrastructure the audit touches. A broad request invites scope creep and surfaces unrelated exposure, while a scoped request keeps the audit to the products actually in question.

• Products in scope. Confirm the audit covers only the products named in the notice.
• Environment boundary. Limit data to the servers and clusters where those products run.
• Format and channel. Agree the report format and route every file through one named contact, so you control what is shared and keep a log of it.

Why fast, open ended cooperation works against you

The usual advice is to cooperate fully and quickly with the auditor, to show good faith and close the audit fast. We disagree. In more than half the IBM audits we defended in 2024 and 2025, fast and broad cooperation surfaced 20 to 30 percent more environment than the audit needed, and the finding grew with it.

The better course is to cooperate professionally but scope tightly. Submit only clean sub capacity proof for the products in question, answer on the agreed timeline, and challenge the method on the draft finding. A quick close helps the auditor meet a schedule. An accurate close is what lowers your invoice.

What have we seen in recent IBM audit defenses?

Most of the exposure we find comes from broken sub capacity proof, not from customers running more software than they bought. Between 2024 and 2025 I worked roughly 30 to 40 IBM audit defense engagements, and our engagement file puts the firm's count of IBM audits defended in that period at 36. Three patterns came up again and again.

• ILMT gaps. Hosts missing from ILMT accounted for 40 to 60 percent of the initial exposure, because each one forced a full capacity count. The median share was 52 percent.
• Stale reports. Customers that had ILMT installed but not reporting for 90 days lost sub capacity rights on those servers.
• Scope creep. Unmanaged data requests pulled in 20 to 30 percent more environment than the audit required.

Fixing the evidence, correcting measurement and scoping the request reduced the findings we worked on by 27 percent on average.

The number IBM opens an audit with is almost never the number you owe. Clean sub capacity proof closes that gap, and speed does not.

What will IBM and its auditor say, and how should you answer?

Expect a small set of standard positions. Each has a factual reply, and giving it in writing keeps the discussion on evidence.

• "We need a hardware inventory of all your servers." The notice names specific products. Offer ILMT data and host details for the servers where those products are installed, and ask for a written reason before providing anything wider.
• "Your ILMT data has gaps, so full capacity applies." Full capacity can apply only to the servers and dates without reports. Ask the auditor to list them, then offer hypervisor allocation history for those dates as supporting evidence. IBM does not always accept it, but it narrows the dispute.
• "These components are separate chargeable products." Check the License Information document for the parent product. Many IBM programs include supporting programs licensed only for use with the parent, and the Software Classification panel shows how ILMT bundled them.
• "This can all be resolved inside a new agreement." Get the reconciled finding in writing first. Then judge the commercial offer on its own merits, because a settlement folded into a new purchase hides what you actually owed.

How do you cut IBM audit exposure?

You cut it with evidence and scope control. Bring current ILMT reports, a host inventory and your entitlement records, because IBM settles against documented data and gives little weight to assertions. Our guide to negotiating IBM audit settlements covers the commercial stage.

• Confirm ILMT coverage. Check the VM manager connections and scan dates for the in scope servers before you submit anything.
• Hold the scope. Keep the audit to the named products and the agreed environment.
• Challenge the draft. Correct measurement errors, wrong dates and misclassified components.
• Reconcile entitlement. Credit unused and shelved entitlement against the exposure on the same product.
• Check the invoice lines. Confirm the back support period never exceeds the excess use period or two years, whichever is shorter.

Contract terms to ask for at your next renewal

IBM rarely changes its standard audit clause for small accounts, but side terms become negotiable when a sizable renewal or new purchase is on the table. Our note on IBM audit clause redlines has sample wording.

• A minimum notice period. A fixed number of days before kickoff gives your team time to assemble data without rushing.
• A frequency limit. No more than one audit in any 12 month period stops back to back reviews.
• A scope limit. The audit covers named products and the environments where they are deployed.
• A cure period for ILMT gaps. Time to repair reporting before full capacity is applied protects you from one broken connector.
• Shortfall pricing at your contracted discount. Without it, the invoice price for excess use is whatever IBM specifies.
• Limits on auditor data use. The auditor shares results only with IBM and deletes your data when the audit closes.

How to prepare before a notice arrives

The evidence you keep for audits also serves at renewal. If you renew only part of your Subscription and Support, IBM now expects system generated proof of current use 30 days before the renewal date. ILMT reports reconciled against entitlement each quarter give you that proof, and they make the next audit notice routine.

What to do next

1. This month. Confirm the IBM License Metric Tool is installed and reporting on every host running IBM software, with every VM manager connection live.
2. This quarter. Verify ILMT discovers all instances, confirm the software classification, and check that your reports cover the last two years.
3. When a notice arrives. Confirm the legal basis and the exact products in scope before you reply, and name one contact for all auditor requests.
4. At the kickoff. Negotiate the scope and timeline of the data request, and confirm what you agreed in writing.
5. During data collection. Submit only clean sub capacity proof for the products in scope.
6. On the draft finding. Challenge the method and correct measurement errors, dates and misclassified components.
7. Before you settle. Credit unused entitlement against the exposure and check the back support periods. Our IBM audit defense white paper walks through each stage, and our IBM audit defense service can run the response with you.

Frequently asked questions