Full narration of the briefing. Click a section heading to jump the player to that moment.
An EBS estate rarely goes out of compliance by buying too little. It drifts in place. Products get activated during patching, responsibilities sprawl, headcount outgrows an Employee metric, a custom schema crosses a boundary nobody drew on a diagram. None of that appears on a purchase order, and that is precisely why finance believes the position is clean right up to the morning the audit letter arrives.
The entitlement record stood still while the estate moved underneath it. Across the thirty to forty five EBS compliance reviews behind this session, nearly every material gap was created internally, in place, by people doing their jobs properly.
Start with the most common one, because it is also the most human. In roughly half the estates we reviewed, helpdesk granted responsibilities reached modules the company never bought. Nobody did anything wrong by their own standards. A user needed to complete a task, an administrator copied an existing profile that happened to carry more than it needed, and the grant went live in minutes with no licence check anywhere in the process.
And remember what we established in session two: authorisation is the metric. The moment that responsibility exists, the exposure exists, whether or not the person ever opens the screen.
Second, the self service population slides upward. Self service licences are cheaper because they permit less, and in five of ten estates we reviewed those populations had drifted into professional grade access, usually through a single added responsibility. One user in that position is a finding you can explain. Several hundred is a settlement you negotiate.
The pattern is always the same: a genuine business need, an administrator solving it the fastest way available, and no control that connects an access change to a licence line. If you audit one thing this quarter, audit the responsibilities held by everyone on a self service licence.
Third, and this one surprises people who think they are safe because nobody transacted. Activation reads as usage. A product flipped to licensed status in License Manager is evidence to Oracle, whether or not a single person ever transacted in it. That flag gets set during patching, during an upgrade, during a proof of concept somebody ran in 2019 and never unwound.
It is not a technical control, it is a declaration, and it is the first thing an audit script reads. Which is also why the shelf and the exposure are two halves of the same problem: the flags say one thing, the ordering documents say another, and only one of those is a contract.
Fourth, and this is where the money concentrates. EBS ships with a restricted use grant for the database and tools underneath it, and that grant covers EBS programs only. The moment a non EBS workload joins the instance, the bundled right converts into a full licence requirement at technology prices, and we found breaches in roughly half the estates we reviewed. The causes are entirely mundane: a reporting schema, a warehouse feed, a small custom application that seemed sensible to host on a database that was already there.
And underneath that, database packs and options enabled by default created a further fifteen to thirty percent of hidden licence demand beneath the application. Recall from session one that the database is already the bigger number.
So what actually works. Estates holding a quarterly reconciliation closed their audits in a fraction of the time and money the firefighters spent, and that is the whole finding in one sentence. The baseline beats the response. Every quarter, take the same four extracts we covered in session four, licensed against used against enabled against interfaced, add a responsibility change log, add a boundary check on every schema and feed touching the EBS instance, date it, and file it.
It takes a morning once you have done it twice. And when a letter does arrive, you are answering from a dated internal record rather than reconstructing a position under a deadline set by someone whose interests are not yours.
Redress Compliance works on contingency: our fee is 25 percent of what we save you. Nothing saved, nothing paid. Independent, buyer side only, never vendor funded. Want Redress to contact you? Reach out and we respond the same day.
Talk to a Oracle negotiator