Estates with a standing evidence baseline settled at 15 to 35 percent of opening claims, against 50 to 80 percent for estates that built the evidence after the letter arrived
Audit letters arrive one vendor at a time, which is why most organisations answer them one vendor at a time. The evidence they demand is largely the same evidence.
Prepared by Redress Compliance · August 17, 2026 · Audit defence advisory. 25 to 35 audit defence engagements across Oracle, IBM, SAP, Microsoft, and Broadcom, 2024 to 2025.
Executive summary
Estates with a standing evidence baseline settled at 15 to 35 percent of opening claims. Against 50 to 80 percent for estates that began assembling evidence only once the letter had arrived.
Centralising intake and counsel cut audit response effort by 30 to 50 percent. Compared with per vendor improvisation, and it kept disclosures consistent across letters that ask overlapping questions.
One response process outperformed improvised responses consistently. Across Oracle, IBM, SAP, Microsoft, and Broadcom letters, which is a wider spread of vendors than most single vendor playbooks assume.
Settlements usually resolved by converting findings into forward spend at a renewal. Which is why the audit calendar and the renewal calendar should be looked at together rather than by different people.
What a standing baseline contains
The point of a baseline is that it exists before it is needed. Most of its content is the same regardless of which vendor writes first.
| Component | Why it is shared across vendors |
|---|---|
| Deployment inventory | Every letter asks what is installed and where |
| Entitlement record | Every letter compares deployment to entitlement |
| Measurement tool configuration | Unconfigured tooling loses claims in every vendor estate |
| Single intake and counsel route | Inconsistent disclosure is a cross vendor risk |
The economics of the baseline come from the overlap, not from any single audit. A deployment inventory built for an Oracle letter answers most of an IBM letter. An entitlement record assembled for Microsoft answers a large part of an SAP request. Organisations that build this once, and keep it current, are paying for the work a single time and drawing on it repeatedly. Organisations that improvise are paying for substantially the same work at every letter, at the worst possible moment, under a clock somebody else set.
The evidence is largely the same evidence
Across roughly 25 to 35 audit defence engagements supported between 2024 and 2025, spanning Oracle, IBM, SAP, Microsoft, and Broadcom letters, the estates running a single response process consistently outperformed improvised responses. The size of the gap is the striking part. Estates with a standing evidence baseline settled at 15 to 35 percent of opening claims, against 50 to 80 percent for unprepared estates.
The reason the gap is that wide has less to do with negotiating skill than with what is available at the moment the letter lands. An estate that already holds a current deployment inventory, a reconciled entitlement record, and correctly configured measurement tooling can answer a claim with its own evidence immediately. An estate that has to build all three is negotiating on the vendor's evidence for the several months it takes to produce an alternative, and the terms of any settlement are shaped during exactly that period.
What makes the baseline economically sensible is overlap rather than any individual audit. Every vendor letter asks what is deployed, where, and against what entitlement. The specifics differ and the underlying artefacts largely do not, which means one investment answers several letters. That is also why centralising intake and counsel cut audit response effort by 30 to 50 percent compared with per vendor improvisation, and why it kept disclosures consistent. Inconsistent disclosure across vendors is its own risk: statements made to one auditor to close one question do not stay confined to that conversation.
One further pattern shapes how the settlements actually resolved. Estates with a standing baseline settled at 15 to 35 percent of opening claims usually by converting findings into forward spend at a renewal, which means the audit calendar and the renewal calendar belong on the same page and in front of the same person. An audit that lands six months before a renewal is a very different instrument from one that lands six months after it, and organisations that manage the two separately discover the connection only when the vendor points it out. The IBM specifics sit in the IBM audit playbook, the Oracle position in the Oracle response playbook, and the wider practice at vendor negotiation services.
- Your agreements decoded into plain English before the auditor interprets them for you
- Entitlements, caps, and protections verified across your whole contract portfolio
- A defensible position paper generated in minutes, not weeks
The renewal negotiation timing playbook
When to open, what to hold, and the sequence that puts your evidence to work before the vendor sets the terms.
Get the brief →Building the standing baseline
- Maintain a current deployment inventory, because every vendor letter opens with what is installed and where.
- Keep the entitlement record reconciled continuously, since every letter compares deployment against entitlement and that comparison is the whole claim.
- Configure measurement tooling before you need it, as unconfigured tooling loses claimable positions in every vendor estate.
- Centralise intake and counsel, which cut response effort 30 to 50 percent and kept disclosures consistent across overlapping questions.
- Treat the baseline as a shared asset, since one investment answers Oracle, IBM, SAP, Microsoft, and Broadcom letters alike.
- Put the audit calendar next to the renewal calendar, because settlements usually resolved by converting findings into forward spend at a renewal.
What the audit engagements showed, 2024 to 2025
Across roughly 25 to 35 audit defence engagements spanning Oracle, IBM, SAP, Microsoft, and Broadcom letters:
Of opening claims, settled by estates that already held a current inventory, a reconciled entitlement record, and configured tooling.
Of opening claims, settled by estates that began assembling evidence only once the audit had opened.
Centralising intake and counsel cut audit response effort by 30 to 50 percent compared with per vendor improvisation, and kept disclosures consistent across letters asking overlapping questions.
Settlements usually resolved by converting findings into forward spend at a renewal, which is why the audit calendar and the renewal calendar belong in front of the same person.
Your first five moves
- Build the deployment inventory now, while no letter is open and the work is not on someone else clock.
- Reconcile entitlements against it and keep the reconciliation current rather than periodic.
- Configure every measurement tool so claimable positions are evidenced rather than merely true.
- Name one intake route and one counsel route for every vendor letter, without exception.
- Map audit exposure against the renewal calendar. The negotiation practice builds the baseline with you.
Frequently asked questions
How much does preparation change the settlement?
Estates with a standing evidence baseline settled at 15 to 35 percent of opening claims, against 50 to 80 percent for estates that began assembling evidence once the letter had arrived.
Why is the gap so large?
Because of what is available when the letter lands. A prepared estate answers with its own evidence immediately; an unprepared one negotiates on the vendor evidence for the months it takes to build an alternative.
What is in a standing baseline?
A current deployment inventory, a reconciled entitlement record, correctly configured measurement tooling, and a single intake and counsel route for every vendor letter.
Does one baseline really serve several vendors?
Largely, yes. Every vendor letter asks what is deployed, where, and against what entitlement. The specifics differ and the underlying artefacts do not, which is what makes the investment economic.
What does centralising intake achieve?
It cut audit response effort by 30 to 50 percent compared with per vendor improvisation, and it kept disclosures consistent across letters that ask overlapping questions.
Why does disclosure consistency matter?
Because statements made to one auditor to close one question do not stay confined to that conversation. Inconsistent disclosure across vendors is a risk in its own right.
How do these settlements usually resolve?
By converting findings into forward spend at a renewal. That is why the audit calendar and the renewal calendar should sit in front of the same person rather than in two separate processes.
Does audit timing relative to renewal matter?
Considerably. An audit landing six months before a renewal is a different instrument from one landing six months after, and organisations that manage the two separately learn that from the vendor.
Which vendors does this cover?
The engagements spanned Oracle, IBM, SAP, Microsoft, and Broadcom letters. The response process that worked was the same one in each case, which is the argument for a single playbook.
When should the baseline be built?
While no letter is open. Once one is, the same work has to be done under a clock somebody else set, and that timing is most of what separates the two settlement bands.
