IBM Practice
The IBM Software License Audit. How It Works.
An IBM audit reads your sub capacity proof first. Without current ILMT reports, IBM measures full capacity. Read the process before the notice arrives.
An IBM audit reads your sub capacity proof first. Without current ILMT reports, IBM measures full capacity. Read the process before the notice arrives.
An IBM software audit is won or lost on the IBM License Metric Tool, because without current sub capacity reports IBM defaults you to full capacity licensing.
An IBM audit is exercised under the verification clause of the Passport Advantage agreement. IBM, or an appointed firm, sends a notice, requests deployment data, measures entitlement against usage, and presents a finding.
The process is procedural, not adversarial by default. How it ends depends almost entirely on the quality of your sub capacity evidence.
The audit opens with a formal notice citing the agreement clause. A kickoff call sets scope, timeline, and the data request. Treat the kickoff as a scoping negotiation, not a formality.
IBM compares measured deployment against your entitlement and issues a draft finding. This is the point to challenge methodology and correct measurement errors before the number is finalized.
IBM audit stages and your leverage
| Stage | What happens | Your leverage | Risk if passive |
|---|---|---|---|
| Notice | Legal basis cited | Confirm scope of products | Low |
| Kickoff | Data request set | Negotiate scope and timeline | Scope creep |
| Data collection | You submit ILMT reports | Submit clean sub capacity proof | Full capacity default |
| Draft finding | IBM presents exposure | Challenge methodology | Inflated settlement |
IBM sub capacity licensing lets you license only the virtual cores assigned to an IBM product, not every core in the host or cluster. The right to do that is conditional on running the IBM License Metric Tool and keeping reports.
The requirement is strict. The sub capacity terms in the Passport Advantage sub capacity rules require ILMT installed within ninety days and reports retained for two years.
Install ILMT on every host running IBM software, confirm it discovers all instances, and keep the reports current. The license terms for each product sit in the IBM license agreements catalog at IBM Terms.
The data request defines how much of your estate the audit touches. A broad request invites scope creep and surfaces unrelated exposure. A scoped request keeps the audit to the products actually in question.
The standard advice is to cooperate fully and quickly with the auditor to show good faith and close the audit fast. We disagree. In more than half the IBM audits we defended in 2024 and 2025, fast and broad cooperation surfaced 20 to 30 percent more environment than the audit needed, inflating the finding. The buyer side move is to cooperate professionally but scope tightly, submit only clean sub capacity proof for the products in question, and challenge methodology on the draft finding. Speed is the auditor's interest, accuracy is yours, and the two are not the same.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
On an IBM audit the number IBM opens with is almost never the number you owe. Clean sub capacity proof, not speed, closes the gap.
The defense is evidence and scope control. Bring current ILMT reports, a host inventory, and the entitlement records. IBM settles against defensible data, not assertions.
Audit readiness is a standing task. Keep ILMT current, retain two years of reports, and reconcile entitlement quarterly. An estate that is always ready treats the notice as routine.
White Paper · IBM
Defend an IBM Audit: The Full Buyer Side Playbook
Defend an IBM audit end to end: triage the claim, fix ILMT gaps, sample sub capacity, and turn a bad finding into a renewal you control. Read it free.
An IBM audit is run under the verification clause of the Passport Advantage agreement, usually through an appointed firm. IBM sends a notice, requests deployment data, measures usage against entitlement, and presents a draft finding. The outcome depends largely on the quality of your sub capacity evidence.
ILMT is the condition for sub capacity licensing, which lets you license only the virtual cores assigned to an IBM product rather than every physical core on the host. Without current ILMT reports, IBM defaults to full capacity, which can multiply the licensed core count and the finding.
IBM measures full physical capacity, counting every core on the host running the product rather than the virtual cores assigned. A small product on a large host can then be charged at many times its real footprint, and installing ILMT after the notice does not restore sub capacity for the past period.
Yes. The data request set at the kickoff call defines how much of your estate the audit touches, and it is negotiable. Confirm the audit covers only the named products, limit data to the in scope environment, and agree the report format so you control what is shared.
Cooperate professionally, but scope tightly. Fast and broad cooperation often surfaces more environment than the audit needs and inflates the finding. Submit only clean sub capacity proof for the products in question, and treat the kickoff as a scoping negotiation rather than a formality.
In our 2024 to 2025 defenses, 40 to 60 percent of initial exposure traced to ILMT gaps and stale reports rather than genuine over deployment. Fixing the sub capacity proof, not buying more licenses, removed most of the apparent exposure.
The Passport Advantage sub capacity terms require ILMT installed within ninety days of first deployment and reports retained for two years. An estate that keeps current reports across that window can defend sub capacity on every host the auditor questions.
Treat readiness as a standing task. Keep ILMT installed and reporting on every host running IBM software, confirm it discovers all instances, retain two years of reports, and reconcile entitlement quarterly. An estate that is always ready treats an audit notice as routine rather than a crisis.
The audit notice, sub capacity proof, scope control, and the levers that turn an IBM audit into a routine reconciliation rather than a true up.
Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.
