Finance budgeted one of seven cost layers, and the support tail outgrew the settlement

Price an audit as a project with seven cost layers, not as a single settlement number. Each layer has a different owner and a different accounting period, so no single person is ever asked to total them, and the all in figure is largely fixed in the first 30 days before any number is discussed.

Prepared by Redress Compliance · August 16, 2026 · Oracle advisory. 35 to 45 audit engagements led or benchmarked, 2024 to 2025.

Build this table on day one of an engagement, before anyone has a number. The estimate is what stops the settlement figure becoming the whole conversation.

A mid sized database audit consumes 200 to 600 hours, concentrated in a small group of senior people across four to nine months. The distribution is consistent enough to model.

• Multiply the midpoint of each band by your loaded cost per hour and put the total on the same page as the settlement. In most organizations the result surprises the finance lead more than the finding did.
• Cost the displacement, not just the hours. The pattern we see most is a migration or consolidation slipping a quarter because the same database team cannot do both, and nobody books that as an audit cost.
• Spend advisory money on two things only: an independent count before Oracle has one, and the structure of the closing paper. Without your own number you are negotiating against the only measurement in the room.
• Read what a contingent fee is measured against. A percentage of savings prices the adviser's incentive against a baseline Oracle wrote, so check the baseline before you sign the engagement.
• Insist on independence. An adviser who also resells Oracle, or partners on the implementation, is not positioned to tell you the finding is wrong.
• Fund remediation in the same business case as the settlement, and sequence it before the next collection so the evidence of the fix exists when it is needed.

The common account of an audit puts the money at the end: a claim arrives, a negotiation happens, a figure is agreed. In the engagements we review, the all in cost is largely determined at the beginning, in the first thirty days, by decisions about scope, evidence, and sequencing that nobody experiences as financial decisions at the time. What the audit was permitted to look at, who was allowed to answer, whether a measurement was run before the collection, and whether the response was coordinated through one voice or improvised across four teams: those choices set the boundaries inside which every later number is calculated.

The clearest illustration is the support tail. Support runs at roughly 22 percent of net license fees per year, so five years of it costs more than the licenses it attaches to. That single fact should decide the shape of the settlement, and it usually decides nothing, because it is discovered at the renewal that follows rather than at the table where the shape was chosen. The buyer who models it on day thirty negotiates a different deal from the buyer who learns about it on day four hundred, and the difference is not a matter of negotiating skill.

Remediation behaves the same way. Isolating Oracle onto dedicated hosts, proving option removal, redesigning standby, or moving suitable workloads down an edition are engineering projects measured in weeks and months, and they are the layer most often discovered after the settlement is signed. Funded late, from a different budget, after the next planning cycle has closed, they arrive as an unwelcome surprise. Funded in the same business case, they are the reason the exposure does not recur in three years with better data, which is the only version of this that ends.

So the practical conclusion is unglamorous. Build the seven layer model before you have a claim, cost the hours at loaded rates so the invisible layer becomes a budget line, and treat the first month as the month that prices the audit. The negotiation mechanics sit in the audit negotiation guide, the line by line challenge in fighting an audit claim, the recurring support arithmetic in Oracle support costs, and the wider library in the Oracle practice.

Across roughly 35 to 45 Oracle audit engagements led or benchmarked, the finance story was consistent enough to be predictable:

Three findings recurred in almost every post mortem. Finance had budgeted the settlement and nothing else, so the support consequence surfaced at the following renewal. Nobody had costed the internal hours, so the most expensive layer after support was missing from every business case. And the engineering work needed to stop the exposure recurring was funded late, from a different budget, usually after the next planning cycle had closed.

The exposures that most often require remediation are the virtualization boundary, uncatalogued option usage, and standby counting. The boundary specifically is worked through in the virtualization licensing guide.

What does an Oracle audit actually cost, end to end?

The settlement plus six layers charged to different budgets at different times: backdated support, the forward support tail, internal effort, external advice, remediation engineering, and any forward commitment attached to the close. That is why an audit almost always costs more than the figure the board was told about.

Why does the support tail cost more than the settlement?

Because it never stops. Oracle sets annual technical support at approximately 22 percent of net license fees, so any license added in a settlement raises a bill you pay every year afterwards. Five years of that tail costs more than the licenses themselves, and it is only movable at the moment of purchase.

How many internal hours does an audit consume?

Between 200 and 600 in a typical database audit, concentrated in a small group of senior people across four to nine months. Database administration carries the heaviest single load at 120 to 200 hours, with infrastructure, asset management, procurement, legal, application owners, and finance making up the rest.

Why is the internal effort missing from most business cases?

Because it is never invoiced. Each layer of an audit has a different owner and a different accounting period, and the hours sit in no budget at all, so no single person is asked to total them. Costing them at loaded rates is what turns the largest hidden layer into a visible line.

What should we spend on external advice, and on what?

Two things decide the outcome: an independent measurement before Oracle has one, and the structure of the closing paper. Without your own number you are negotiating against the only measurement in the room. Most other work can be done in house if someone owns it.

Is a contingent fee a good idea?

It is attractive to finance but it prices the adviser's incentive against a baseline Oracle wrote. Read what the baseline is before you sign. Whatever the fee model, insist on independence: an adviser who also resells Oracle is not positioned to tell you the finding is wrong.

What does remediation cost after the settlement closes?

It is engineering work and it needs a budget line of its own. Isolating Oracle onto dedicated hosts runs weeks to months, proving option removal runs days per database, redesigning standby runs weeks plus test cycles, and moving workloads down an edition runs months. It is the layer most often discovered after signature.

When is the all in cost actually decided?

Largely in the first 30 days, before any figure is discussed, through decisions about scope, evidence, and sequencing. What the audit was permitted to look at and whether you ran your own measurement first set the boundaries inside which every later number is calculated.