How to acknowledge an IBM audit without conceding anything.

When the audit letter arrives, the instinct is to reply fast and reply cooperatively. Cooperation is sensible. The problem is that a friendly first email often does far more than acknowledge receipt: it accepts the products IBM listed as the scope, agrees to the data collection method IBM proposed, and commits to a date the sender chose. Each of those is a negotiating position you have just surrendered for free.

Acknowledging an audit is a contractual obligation under the audit clause in your Passport Advantage agreement, so you cannot simply ignore the notice. But the obligation is to cooperate with a properly scoped audit, not to ratify the version IBM drafted. The skill is in separating the two.

Acknowledge receipt, nothing more

Your first reply should do exactly one thing: confirm that the notice has been received and that the company will respond through a named single point of contact. It should not confirm the product list, the audited entities, the time period, or the data collection approach. Those are all open questions, and the acknowledgement is not the place to close them.

Keep the wording narrow and factual. Confirm receipt, name your contact, and state that the company will revert with its response to the substance. Resist any sentence that begins to characterize your deployment, because anything you assert now becomes a baseline IBM can hold you to later.

What the first reply must not contain

• Acceptance of the proposed scope, the product list, or the audited legal entities
• Agreement to a specific data collection tool, script run, or self declaration template
• Any admission about what is or is not deployed, even an apparently helpful one
• A commitment to a deadline that you did not set and cannot control
• An invitation for IBM to run discovery tooling inside your environment

Each of these looks cooperative and each quietly narrows your options. Agreeing to a tool run, for example, hands IBM raw output before you have validated it against your own PVU and sub-capacity calculation. Naming a deployment in passing can convert an open question into a conceded fact.

Name a single point of contact immediately

The most damaging concessions usually do not come from the formal reply at all. They come from a well meaning engineer or account manager who answers an IBM question directly over email or on a call. The moment the audit is acknowledged, every IBM communication should route through one named person, and the wider organization should be told not to engage. This is the single point of contact rule, and it is the difference between a controlled response and a leaking one.

Buy the time the acknowledgement gives you

A prompt, narrow acknowledgement is not a stall. It is the move that creates room. While IBM treats the notice as the start of its data request, you use the same window to rebuild the entitlement baseline, snapshot the ILMT health, and run your own reconciliation before any data is exchanged. That is the Contain step of Contain, Reconcile, Challenge, Settle, and it begins the instant you reply, not weeks later when the data request is due.