Before you plan a response, read the document. The letter tells you which Oracle entity is asking, under which agreement, about which programs, and by when. Most early mistakes come from reacting to its tone instead of its contents.
Before you plan a response, read the document properly. An Oracle audit letter tells you which entity is asking, under which agreement, about which programs, and by when. Most of the early mistakes we see are made by people who reacted to the tone of the letter rather than to its contents.
The letter has already done its most useful work before you reply to it. It has told you what Oracle believes it can ask for, and under which document.
Read it as a contractual instrument rather than an accusation. That single change of posture removes most of the pressure people feel in the first week.
Start by establishing whether this is a formal notice under an audit or verification clause at all. Several things that look like audits are not, and Oracle's own contract documents are the reference for which is which.
Our page on what an Oracle audit is sets out the clause and the five different things that arrive by email. Assume for the rest of this page that you have confirmed you are holding a genuine formal notice.
Reading the letter field by field
| Field | What to check | What it tells you |
|---|---|---|
| Sending entity | Which Oracle legal entity signed it | Whether the sender is party to your agreement |
| Agreement cited | Name, number, and date of the agreement | Which terms actually govern the review |
| Clause cited | Whether a clause number appears at all | A missing clause is a request, not a notice |
| Programs named | Specific products, or a general reference | The real scope, and the play behind it |
| Entities named | Your legal entities, or a vague group reference | Whether scope has been defined or left open |
| Dates | Notice date, commencement, production date | Which date is contractual and which is chosen |
| Delivery method | Email, post, addressee, and copy list | Whether the notices clause was satisfied |
Oracle contracts sit with specific legal entities, and large estates often hold several agreements across several countries. A letter from one Oracle entity does not automatically reach programs licensed by your subsidiary under a different agreement.
This is not a technicality to be exploited. It is the basic question of which document governs, and getting it wrong at the start means arguing later under terms that never applied.
The letter names one agreement. Your estate may be licensed under three or four, accumulated over two decades and across several acquisitions, and they do not all say the same thing.
Build the map before the first call. Knowing which paper covers which program is the difference between arguing the terms you negotiated and arguing the terms Oracle quoted.
A partner, reseller, or distributor has no audit right over you unless your contract with them creates one. Letters implying otherwise are commercial pressure, not contractual notice.
Verify the sender before treating anything as formal. Check the domain, the signature block, and whether the named individual appears in Oracle's own directory, and route any doubt to counsel rather than replying to confirm details.
Most Oracle agreements contain a notices provision specifying how formal communications must be delivered and to whom. An email to a database administrator frequently does not satisfy it.
The program list is the tell. Oracle's letters are consistent enough that the products named usually reveal the commercial motive behind the review.
What the named programs usually mean
| What the letter names | What it usually is | Your first move |
|---|---|---|
| Database Enterprise Edition plus named packs | An options and packs review | Establish your own feature usage position |
| Database with a virtualization question | A counting dispute about boundaries | Document the cluster boundary and its date |
| Java SE alone | A subscription sales motion | Separate it from any database track |
| WebLogic or middleware only | An edition and option boundary review | Confirm editions before discussing counts |
| Applications with named modules | A user counting and definition review | Pull the user definitions from the agreement |
| Everything, with no product list | A scope probe or a renewal lever | Ask for the programs in writing before anything else |
A sentence extending the review to affiliates or group companies without naming any is doing scoping work at your expense. It costs nothing to write and can double the estate under review.
Answer it with a question. Ask which legal entities Oracle considers in scope and under which agreement each one is licensed, and ask in writing.
Java approaches typically originate from a different motion with a different commercial goal. The Java SE universal subscription is priced on an employee style count, so the conversation is about a definition rather than about discovery.
Keep it on a separate track from anything else in the letter. Merging a Java discussion into a database review hands over a metric argument you have not had yet.
White Paper · Oracle
Oracle Audit Response Playbook
Meet an Oracle audit from a prepared position. Read it free.
Usually only one of them. Audit and verification clauses commonly require Oracle to give advance written notice, frequently 45 days, before a review may commence. That is a notice period, and it is a protection for you.
The second date, the one asking for data or a kickoff call by a particular day, is generally Oracle's own scheduling preference. It is a request, and requests can be discussed.
Our guide to the audit clause itself covers what the notice period does and does not oblige. Read it alongside your executed agreement before you agree to any date.
Say so, politely, in writing, and propose an alternative. A short note recording that you will respond substantively once scope is agreed is a normal commercial reply, not a refusal.
What you should not do is let the date pass in silence. Silence is the one response that converts a schedule disagreement into a cooperation argument.
In practice, very little on its own. Missing a date Oracle has chosen is not a contractual default, and in our experience the process simply continues with a follow up.
The real cost is positional. Repeated silence gives the vendor a narrative about cooperation that becomes useful later, and it costs you nothing to avoid.
Yes, and within about five working days. An acknowledgement is a receipt that establishes your channel and your contact; it is not a substantive reply and it concedes nothing about compliance.
It confirms that a document arrived on a date. It does not accept the scope, the timetable, the entities, the products, or the premise that a shortfall exists.
Nor does it start a clock against you. The obligation in the clause is cooperation with a properly scoped review, and scope has not been settled at the point you acknowledge.
Keep the letter short for exactly this reason. Every additional sentence is an opportunity to characterize something you have not yet measured.
The content checklist for that letter, including what must never appear in it, belongs to the next stage. It is set out in full in the Oracle audit response playbook, which is where this page hands over.
The common advice is to reply immediately and cooperatively to set a constructive tone. We disagree with the immediacy, though not with the courtesy. In the letters we triaged, the fastest replies were the ones that gave away scope, because a same day answer is written before anyone has read the governing agreement or checked which entity holds it. A reply five working days later, from a named owner, that acknowledges receipt and asks three precise questions, reads as more professional and costs far less. Speed is not cooperation. It is just speed.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
The letter tells you what Oracle believes it is entitled to ask. Almost every early mistake comes from answering a question it did not actually ask.
It stops the moment you have classified the document, checked the entity and the notices position, decoded the scope, separated the dates, and acknowledged receipt. Everything after that is process rather than reading.
All of that sits in the audit response playbook, and the drafting detail for the reply itself is in the audit response letter guide. The measurement is run by Oracle license management services, whose output is an opening position rather than a verdict.
Know your own number before Oracle proposes one. The letter is the moment that becomes urgent, and it is the last comfortable point at which you can start.
If you have not run an internal license audit, begin it in parallel with the acknowledgement rather than after the scoping call.
Acknowledge within about five working days, and treat any data date in the letter as a proposal. Audit clauses commonly require Oracle to give advance written notice, often 45 days, before a review may commence. That notice period is not a deadline for producing data.
It invokes a contractual right rather than creating a new obligation. What you owe is whatever the audit clause in your executed agreement says, usually reasonable cooperation on an agreed scope. Read the clause before accepting any characterization of it.
Check the notices clause in the governing agreement, because a message to an engineer's inbox often does not constitute proper service. Note it in your acknowledgement and ask that correspondence go to the contractual address. Do not rely on it as a defense; Oracle will simply serve it again.
Ask which legal entities Oracle considers in scope and under which agreement each is licensed, in writing. An open affiliate reference is a scoping device, and defining it is a normal contractual question rather than resistance.
Usually, from the program list. Database Enterprise Edition with named packs points at an options review, Java SE alone is normally a subscription sales motion, and a letter with no product list at all is a scope probe.
On its own, very little, because a date Oracle has chosen is not a contractual default. The damage comes from silence rather than from the calendar. Reply, propose an alternative, and keep it in writing.
Yes, for a short and specific review. Counsel should read the audit clause, the notices clause, and your acknowledgement before it goes out. That is a small amount of time that shapes everything after it.
No. An acknowledgement confirms a document arrived on a date and names your point of contact. It accepts nothing about scope, entities, products, timetable, or compliance, provided you keep it to that.
What the LMS scripts collect, how to challenge the findings, and the 90-day response that limits exposure.
Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.
The audit letter is a question about your contract, asked at a time that suits Oracle. Answer it on your schedule, with your own numbers, inside a scope you agreed in writing.
