Oracle audit negotiation in 2026. What an independent advisor changes, and when you can skip one.

An Oracle audit finding is an opening position priced at list, and what follows is a negotiation whether you treat it as one or not. The count, the evidence and the settlement wording decide the final bill far more than the discount.

Before anything else, understand that Oracle's audit function and Oracle's sales function want different things. The auditors want a signed finding. The account team wants a deal built on that finding, ideally one that lands in the current quarter.

Everything a good advisor does inside the negotiation uses that gap. The compliance question and the commercial question get argued separately, with different people, at different speeds, and the order in which they are settled decides most of the final number.

What have we seen in recent Oracle audit negotiations?

Most opening claims come down a long way once someone rebuilds the count. I ran 40 to 55 Oracle audit negotiations through 2024 and 2025, and 48 of them make up the file behind the figures on this page. Where the count was rebuilt and the terms contested, the signed settlement landed 30 to 60 percent below Oracle's opening claim.

Across the whole file, 11 in 12 settlements closed below the first figure Oracle put on the table. Three patterns held across the file:

• The count did most of the work. Challenging the count produced 50 to 70 percent of the total reduction. Pricing, settlement terms and timing supplied the rest.
• Backdated support rarely survived intact. Once contested, backdated support charges were cut or removed outright in more than half of the settlements.
• Early informal contact cost the most. The negotiations that went worst were the ones where data had already flowed to Oracle through casual emails and calls before anyone controlled the channel.

What does an advisor change in the first two weeks of an Oracle audit?

Sequence and information flow, before any number is discussed. Most of a settlement's final shape is set in these two weeks, which is why they matter more than the months of commercial back and forth that follow.

What the audit clause actually obliges you to do

Start with the contract rather than the letter. In the current Oracle Master Agreement, the audit wording is short, and each sentence is worth reading slowly:

• Notice. Oracle may audit your use of the programs upon 45 days written notice, and the audit must not unreasonably interfere with normal business operations.
• Cooperation. You agree to provide reasonable assistance and access to information reasonably requested. Recent versions spell out that this includes running Oracle's measurement tools on your servers. The word "reasonably" is your basis for limiting scope and pace.
• Costs. Oracle is not responsible for your costs of cooperating, so internal time and any outside help sit on your budget.
• Payment. Fees for use beyond your license rights are due within 30 days of written notification. If you do not pay, Oracle can end support, the licenses or the agreement itself.

Older OLSA and OMA versions differ in detail, and some negotiated agreements carry better terms. Pull the version you actually signed. Our guide to redlining the Oracle audit clause covers the terms worth fixing at your next renewal.

The sequence we set before any data goes to Oracle

1. Acknowledge the notice without admitting anything or volunteering scope.
2. Pull the actual contracts and confirm, in writing, which entities and agreements the audit clause covers.
3. Appoint one spokesperson. Every Oracle contact, formal or friendly, routes through that person.
4. Agree the data collection method and tooling before anything runs in your environment.
5. Set a response timeline your team can actually meet, and get Oracle to accept it.
6. Open an internal data room so every document sent and received is logged.
7. Brief staff that side channel questions from the vendor get referred to the spokesperson unanswered.

If the letter has only just arrived, our note on what to do when an Oracle audit letter lands walks through the first reply line by line.

Why evidence control decides the settlement

Auditors work from the data you provide, so the data you provide becomes the negotiation. An advisor reviews collection scripts before execution, validates raw outputs against entitlements and architecture before submission, and corrects the record before it exists on Oracle's side.

Oracle's audit and licensing function, now branded Global Licensing and Advisory Services and formerly known as LMS, is described on Oracle's licensing services page. That page still carries the LMS name and separates an Audit Service, which Oracle initiates, from a customer led Assurance Service. Either way, the output is a measurement claim that can be checked line by line.

How a findings report becomes Oracle's opening argument

Left unchallenged, a findings report reads like an invoice. Read properly, it is Oracle's opening argument, resting on assumptions about virtualization boundaries, option usage and entity scope, and each assumption carries a burden of proof.

Our first request is always the same: the underlying data behind every asserted shortfall. Lines that survive scrutiny get negotiated. Lines that do not get withdrawn, and in the file there were always some of the second kind. The walkthrough on challenging Oracle audit findings shows how to work through each line.

Why the fact track comes before the money track

What you actually owe and what Oracle wants to charge are different questions, argued with different people. Settling the true gap first removes the inflated opening figure from the conversation. Only then does pricing enter the room, and it enters on a number you have already verified.

Our Oracle audit response guide sets out this sequence as a working plan for the first 90 days.

How does a defended Oracle audit unfold, phase by phase?

A contested Oracle audit commonly runs 6 to 12 months from notice to signature. Each phase has one job, and what the advisor changes in each is specific.

Five of the seven phases are decided by evidence and contract language, and price only dominates the money track. That distribution is the main argument for controlling the early phases, because by the time talk turns to money, most of the ground has already been taken or given.

The two clocks in every audit

Every audit runs on two clocks at once. The contractual response clock pressures you, and Oracle's fiscal calendar pressures the account team. Whoever manages both on purpose sets the tempo of the whole negotiation.

Advisors earn part of the fee in the first week by resetting response deadlines to something achievable while aligning the settlement horizon with a quarter Oracle cares about. Most internal teams do not realize they control the tempo until it is too late to use it.

What Oracle's team will say, and what to say back

Concrete language matters more than strategy decks. These are the lines we hear most often, with the replies that keep your position intact:

And when a friendly call probes for admissions, the answer is a referral to the spokesperson, every time, without drama.

None of these sentences needs an advisor to say them. What the advisor adds is confidence that each one is safe, because we have said them in forty other rooms and the audit still closed. For Java specifically, see what to say on the first GLAS call.

What reduces an Oracle audit settlement, and who controls each factor?

Four factors change the number, and the count outweighs the other three combined. Pricing, trades and timing all operate on whatever count survives, which is why the order of work cannot change.

Rebuilding the count

Most of the reduction comes from dismantling the asserted shortfall. The usual candidates are:

• Options installed but never used. Installation alone is not usage, and feature usage history shows the difference.
• Non production systems counted at production weight. Oracle generally requires test and development servers to be licensed too, so the argument is about how many processors and users are counted for them.
• Virtualization boundaries drawn too wide. Clusters and hosts included beyond what the Oracle partitioning policy and your contract support.

That policy document says it is for educational purposes only and may not be incorporated into any contract. Oracle still applies it in audits, so read it as Oracle's opening position on virtualization, and check it against your own contract text. Our VMware evidence pack guide lists the cluster and host records that support a narrower count.

Each removed line does double work. It cuts the claim directly, and it shows Oracle's team that every remaining line will have to be proven.

A worked example: one VMware claim before and after a count rebuild

Say a company holds 16 processor licenses of Database Enterprise Edition and runs Oracle VMs on a vSphere cluster. Oracle's findings assert three things:

• Enterprise Edition on 48 processors. Three hosts, each with two 16 core Intel Xeon processors, give 96 cores at a 0.5 core factor.
• Diagnostics Pack and Tuning Pack on all 48. Neither pack was ever licensed.
• Two years of backdated support. Charged at 22 percent of the license value of every shortfall line.

Oracle included the third host because it was managed from the same vCenter. The rebuild shows it sat in a separate cluster on separate storage, with no Oracle software and no path for the Oracle VMs to reach it. That leaves 64 cores, or 32 processors.

Feature usage history confirms both packs were used, so those lines stay on the smaller count. All figures below use Oracle list prices: $47,500 per processor for Enterprise Edition and $12,500 for the two packs together ($7,500 plus $5,000).

Compare two paths. A 30 percent discount on Oracle's opening claim still leaves $2,136,960 to pay. The rebuilt count at full list price is $1,670,400, before any commercial discussion. Apply the same 30 percent to the rebuilt count and the bill falls to $1,169,280.

The cloud or license trade

Oracle frequently prefers a forward transaction to a cash penalty. That can mean a commitment toward Oracle Cloud Infrastructure or a license purchase that resolves the finding while feeding a sales target.

A trade can serve both sides, but only at terms shaped on your side of the table. An unexamined trade turns this year's audit into next cycle's lock in, with the meter already running. Price any cloud commitment against workloads you have actually planned to move, and make sure the audit release does not depend on consumption.

Timing against Oracle's fiscal year

Oracle's fiscal year ends May 31, as its investor relations calendar shows, and its quarters close at the end of August, November and February. Quarter and year end pressure on the sales side is real. In the file, settlements signed against that clock closed on better terms, for reasons unrelated to compliance.

Timing only helps if you can afford to wait. Advisors manage the timeline from the first day precisely so that the clock runs against Oracle.

Why chasing the biggest discount on Oracle's number is the wrong target

The usual advice is to maximize the discount on Oracle's number, because every audit ends in a negotiated percentage anyway. We disagree. Chasing the discount accepts Oracle's count as the baseline, and the count is where the inflation sits. In roughly 7 of 10 negotiations in the file, the opening figure contained material overcounting that no discount could have neutralized.

A generous percentage off an overstated claim still settles above what you owed, as the example above shows. Spend your effort on the count first, then hold an ordinary commercial discussion on what remains. The discount conversation is the one Oracle is comfortable having, which says a lot about its value to you.

The discount is the conversation Oracle offers you. The count is the conversation that sets the bill.

What goes in the settlement term sheet

Settlements most often fail buyers in the wording. Before signing, we work through the full sheet:

• Release language. It should close the audited period completely and name the programs, entities and period covered, so the same claim cannot return next year.
• Backdated support. Treat it as its own contested line, argued on its own evidence and its own dates.
• Forward terms. Check for lock in: support base resets, cloud minimums and expanded audit rights.
• No admissions. Strike any wording that recasts your past deployment as a breach.
• Mutual confidentiality. The settlement should not become a sales reference against you.
• Record corrections. Oracle's installed base and support records should match the agreed position once you sign.

Backdated support is the line buyers most often accept unread, even though it is the one that moved most readily once someone questioned it.

What settles besides money

Experienced buyers negotiate their way out of the audit itself. That means an agreed compliance position that resets the baseline, corrected records in Oracle's own systems and, in some cases, contract language that narrows future audit mechanics.

These items cost Oracle little and are granted more readily than cash concessions, which makes them efficient requests late in the money track. A settlement that only changed the number left value on the table.

How do you check your own Oracle position before the findings arrive?

Build your own count in parallel with Oracle's collection, from sources you control. When the findings report lands, you want to compare it line by line against a position you already trust.

• Contracts and ordering documents. The master agreement, every ordering document, the customer definition and the list of CSI numbers. These define what you own and which entities the audit can reach.
• Database feature usage. DBA_FEATURE_USAGE_STATISTICS on each database shows which options and packs have been used and when. Run the feature usage report before Oracle's script so nothing in the output surprises you.
• Virtualization topology. vCenter exports of clusters, hosts, storage and VM placement history. These decide whether the count covers three hosts or thirty.
• Collection script output. Review what Oracle's scripts gathered before it leaves the building. Our note on LMS audit script analysis explains what each script collects.
• Java installations. A current inventory of Oracle JDK installs and versions, since Java exposure is now a common audit add on.

Common mistakes that raise the final bill

• Running scripts before agreeing scope. Data from out of scope entities is hard to withdraw once Oracle has it.
• Answering the friendly call. Informal answers become findings, and they arrive without the context your written response would carry.
• Accepting backdated support as arithmetic. It is negotiable, and treating it as fixed hands Oracle one of its easiest lines.
• Buying cloud to end the audit. A commitment signed under pressure often costs more over its term than the finding it resolved.

When do you not need an Oracle audit advisor?

More often than a firm selling audit defense likes to admit. Four situations from the file where buyers did fine, or should have done fine, without outside help:

The audits you can run yourself

• Soft Java outreach. A friendly email asking about Java downloads is not a formal audit under your contract. It deserves a careful, minimal reply and internal fact finding. An engagement letter can wait until the correspondence turns formal.
• A small, simple Oracle footprint with a current reconciliation. If entitlements were verified against deployments in the last year and the architecture is simple, your position is already built.
• A small finding you know is true. When the gap is real, modest and cheap to close, buy the licenses and end it. Contesting a true small claim burns goodwill you may want later.
• A team with recent experience. If your people have closed several contested Oracle audits in the last few years, they hold current pattern knowledge, which is the main thing a fee buys.

The fee versus exposure test

Price the credible worst case, not the headline claim. If that number sits within a low multiple of the advisory fee, run the process internally with a written plan and spend the difference on fixing root causes.

Start from our free audit negotiation guide and the breakdown of what an Oracle audit costs. Escalate to paid help only if the claim grows past the multiple you set on the first day.

Our conflict, and the tests any advisor should pass

Audit defense is core paid work for Redress Compliance, so this page argues for a service we invoice. Discount it accordingly, and apply these disqualifiers to every firm you consider. A firm fails if:

• It cannot walk you through a count rebuild on a sample of your data before you sign.
• It wants a percentage of the reduction measured from Oracle's opening claim, a baseline that rewards inflation on both sides of the table.
• It will not name the individuals who will face Oracle, or their recent audit history.
• It earns anything, directly or through partners, from Oracle transactions.

Those tests have no exception for us. A clear fee structure and named people are the minimum evidence that a defense firm can defend anyone.

When in an Oracle audit should the advisor arrive?

Before your first reply if possible, and before your signature at the latest. Between those two points, value decays with every document that leaves the building unreviewed.

Before you reply

The opening days set entity scope, collection method and timeline, and each is nearly impossible to renegotiate later. An advisor present at the notice shapes all three while they are still open questions.

Before you sign

The settlement's wording outlives its number. A final week review of release scope, backdated support and forward terms against the agreements in Oracle's contract library is the cheapest insurance in the whole process.

Arriving late is repair, and sometimes still worth it

An advisor landing after findings works with whatever scope and data positions already exist. In the file, late engagements still changed outcomes when the claim was large, but the recoveries were smaller and slower than early ones on comparable footprints.

Early engagement prevents losses and late engagement repairs them, at a higher cost per dollar recovered.

What to do next

1. Reframe the finding. Treat it as an opening position and say so internally, before anyone pushes toward a payment.
2. Freeze the information flow. One spokesperson, one channel and a logged data room.
3. Ask for the data. Demand the data behind every asserted line before discussing any figure.
4. Rebuild the count. Build it independently and argue the fact track before the money track.
5. Run the fee test. Weigh the credible worst case against the fee, and skip the advisor if the test says skip.
6. Work the full term sheet. Release, backdated support, forward terms and admissions, line by line.
7. Bring in help at the right point. Engage independent Oracle advisory before the first reply or before the signature, whichever is still ahead of you.

Frequently asked questions