Handling an IBM audit across multiple subsidiaries.

Large organizations rarely run IBM software inside a single legal entity. Acquisitions, regional subsidiaries, and shared service centers spread deployments across companies that each have their own purchasing history. IBM agreements, by contrast, are signed by named entities with defined enterprise definitions. When an audit spans that structure, the central question becomes whether an entitlement held by one entity legitimately covers a deployment in another.

Entitlement and deployment rarely share a boundary

The most common multi entity finding is a mismatch: a subsidiary running a product the parent licensed, or a shared platform serving entities that were never inside the original enterprise definition. Whether that is compliant depends on the specific Passport Advantage enterprise definition and any transfer or affiliate rights in the agreements. It is a contractual question first and a technical one second, and it cannot be answered by counting cores alone.

Map the structure before IBM frames it

The buyer side move is to build the entity map yourself: which legal entity signed which agreement, which enterprise definition applies, which subsidiaries are inside it, and where each deployment actually runs. Done early, this map lets you place every install under the correct entitlement and identify genuine gaps before IBM presents its own version, which will naturally resolve ambiguity in IBM's favor.

• Which entity signed each Passport Advantage agreement and its enterprise definition
• Which subsidiaries fall inside each definition, including post acquisition additions
• Where each deployment physically and legally sits
• Whether affiliate, transfer, or assignment rights cover cross entity use

Acquisitions are the highest risk zone

Recently acquired entities are where exposure concentrates. The acquired company brought its own IBM estate, its own agreements, and often its own ILMT posture, none of which automatically merge with the parent's. License transferability under Passport Advantage is not assumed, so a deployment that looks covered on a consolidated spreadsheet may sit under an agreement that did not transfer cleanly. Confirm transfer rights before you assume coverage.

Run one coordinated response, not several

Even though the entities differ, the response should be coordinated through one controlled channel, with a single reconciliation method applied consistently across the group. Letting each subsidiary respond independently reproduces the scattered contact problem at scale, with different teams conceding different things to the same auditor. One method, one channel, one entity map keeps the group position coherent.