The buyer side IBM audit response protocol.

An IBM software audit is a structured process with a predictable shape. The notice and acknowledgement run about two weeks, the data request four to six weeks, reconciliation six to ten weeks, and settlement four to eight weeks. IBM runs this sequence many times a year and knows exactly where the leverage sits. Most buyers run it once and improvise. The protocol below closes that gap.

The principle behind every step is simple. The audit clause in your Passport Advantage agreement obliges you to cooperate with a properly scoped review. It does not oblige you to accept the scope IBM drafted, to run the discovery tool IBM prefers, or to release raw data before you have validated it. The protocol keeps you cooperative and keeps control on your side of the table.

Step one: contain before you collect

The moment the notice lands, freeze the response. Acknowledge receipt only, name a single point of contact, and instruct the wider organization not to engage with IBM directly. Nothing leaves the building until it is scoped, curated, and defensible. This is the Contain step, and it is where most of the avoidable damage is prevented, because the worst concessions usually come from a helpful engineer answering a question over email rather than from the formal reply.

Step two: rebuild the entitlement baseline

Before you measure deployment, fix what you are entitled to. Pull every Passport Advantage record, every proof of entitlement, and every prior agreement, and reconcile them into one clean baseline. IBM will reconcile deployment against entitlements that suit its finding. You want the complete and correct entitlement picture, including offsets, bundled rights, and prior purchases that the account team may have overlooked.

Step three: run your own reconciliation

This is the Reconcile step. Independently recalculate PVU and sub-capacity for every product in scope, using your own ILMT data rather than waiting for IBM to interpret it. Confirm that the per core PVU rating is correct, that sub-capacity eligibility holds for each environment, and that virtualization rules are applied correctly by hypervisor type. When IBM presents a number, you already have yours, built on the same evidence.

Step four: control the data response

Only now do you release data, and only what a properly scoped audit requires. Curate the response so it answers the question without volunteering new scope. A raw tool dump handed over unvalidated becomes the baseline IBM negotiates from. A curated, reconciled response keeps the baseline on your terms.

• Acknowledge receipt without accepting scope, product list, or audited entities
• Route every IBM contact through one named person
• Rebuild entitlements before measuring deployment
• Recalculate PVU and sub-capacity independently
• Release curated data only, never an unvalidated tool dump

Step five: challenge, then settle

When the findings arrive, dispute them item by item: incorrect PVU values, denied sub-capacity, missing entitlement offsets. Challenges land thirty to fifty percent of audit findings on average. Then settle on terms that name the products and the number, and fold forward renewal terms and any sub-capacity reinstatement into the settlement letter rather than negotiating them separately later.