Hit with an Oracle audit? the 90 day response map

How does an Oracle audit actually unfold?

An Oracle audit runs from a formal notice through data collection to a findings letter and a commercial close. The data you submit, not the notice, shapes the finding.

Buyers who treat the first finding as fact overpay. The verified deployment, not Oracle's measurement scripts, decides the real position.

Who runs the audit and on what basis?

Oracle License Management Services or a partner runs it under the audit clause in your contract. The contract terms, not the auditor request, set what you must provide.

Which findings inflate exposure most often?

• Installed not used: options counted as deployed wherever installed.
• Virtualization: soft partitioned hosts counted as full clusters.
• Named users: minimums applied beyond actual access.

What turns an audit finding into an oversized bill?

An inflated install count, virtualization assumptions, and back support charges turn a finding into a bill. The real usage is rarely the driver.

What does a clean response position look like?

A clean position presents your own verified deployment data before Oracle measures. The internal inventory, not the audit script, sets the baseline.

How should you handle the findings letter?

Treat the letter as an opening claim to be tested line by line, not a settlement. Each inflated line is a negotiation point, not a fact.

Where is the common advice on Oracle audits wrong?

The standard advice is to cooperate fully and run Oracle's measurement scripts to close the audit quickly. We disagree.

In the audits Fredrik defended, running the scripts blind handed Oracle an inflated baseline that verified internal data would have cut by 30 to 60 percent. The buyer side move is to control the data you submit, prove real deployment, and contest every installed not used and back support line before agreeing a number.

The buyer side move is to make the verified deployment, not the audit script output, the basis of the talk.

An Oracle audit settled on the first finding costs more than the time it takes to prove your real deployment.

What primary sources should you check first?

Review the audit basis on the Oracle License Management Services page and your rights on the Oracle contracts page before you submit any data.

What should you do when an Oracle audit notice lands?

Start with your own deployment data, not Oracle's request. The inventory sets the baseline.

1. Read the audit clause and confirm the scope it allows.
2. Build your own verified deployment inventory first.
3. Separate installed software from software actually in use.
4. Document virtualization and partitioning thoroughly.
5. Control what data you submit and when.
6. Test every finding line against your inventory.
7. Contest back support and installed not used claims.

When should you bring in a buyer side advisor?

Bring help in the moment the notice arrives, before you submit any data. The first baseline you give Oracle anchors the whole audit.