The single point of contact rule for IBM audits.

An audit touches dozens of people inside a company: infrastructure engineers, database administrators, procurement, the account manager who still takes IBM's calls. Each of them can answer a question, confirm a deployment, or forward a spreadsheet. Every one of those interactions is a potential concession, and most happen with no record and no review. The single point of contact rule exists to close that exposure.

Why scattered contact is so costly

When an engineer answers an IBM question directly, they answer it helpfully and technically, with no view of the negotiating position. A casual confirmation that a product runs in three more environments can convert an open scope question into a conceded fact. A forwarded inventory export can hand IBM raw, unvalidated data that becomes the baseline for the finding. None of this is bad faith. It is the predictable result of many people each holding a small piece of the picture.

What the rule actually requires

The moment the audit is acknowledged, every communication with IBM, inbound and outbound, routes through one named person. That person does not need to be the most technical individual in the room. They need the authority to say nothing leaves without review and to make the rest of the organization hold to it. The wider team is told, in writing, to forward any IBM contact to that person and to engage with nothing directly.

• One named owner for all IBM communication, inbound and outbound
• A written instruction to staff to forward, not answer, IBM contact
• No data, exports, or tool output released without review
• A single log of every question asked and every answer given

It controls the clock, not just the content

A single channel also governs timing. IBM's process assumes momentum: a data request with a date, a tool to run, a follow up call. When everything funnels through one owner, you decide the cadence of responses rather than reacting to whoever was emailed last. That is the Contain step in practice, and it is what gives the reconciliation work room to happen before any data is exchanged.

It creates the record you will need later

A single point of contact produces a single log: every question IBM asked, every answer given, every document released and when. When findings arrive and you challenge them line by line, that log is the evidence that scope crept, that a question was answered narrowly, or that data was provided under a stated limitation. Scattered contact leaves no such record, and a position you cannot document is a position you cannot defend.