WebSphere audit: the top five findings we see.

One. Edition creep.

The most frequent finding is Network Deployment running where only Base or Express is entitled. Because the editions install from overlapping media, teams stand up clustering features without a license decision behind it. IBM prices the gap at the richer edition across every core in scope. The defense maps each instance to the edition it actually requires and the entitlement on file, and removes the cores that never needed Network Deployment at all.

Two. Full-capacity defaults.

The largest single swing is sub-capacity denied. WebSphere using 4 of 32 host cores is 480 PVU under a clean sub-capacity claim and 3,840 PVU at full capacity. IBM defaults to full capacity when it believes ILMT was missing, broken, or unreported for a period. Where your data shows the eligible tool was deployed within 90 days, ran continuously, and the quarterly reports were retained, the sub-capacity position is reinstated period by period.

Three. Idle and orphaned installs.

Discovery tooling counts binaries on disk, not workloads in use. Decommissioned servers that were never wiped, test instances left running, and images cloned with WebSphere baked in all show up as live deployments. Each must be evidenced as retired or out of scope rather than conceded. Removing dead installs from the count is pure arithmetic, not negotiation.

• Confirm the running edition against the entitlement for every live instance
• Apply sub-capacity per host using the correct hypervisor rule
• Evidence decommissioned and non-production installs out of the count
• Check bundled WebSphere rights are used within their allowed scope

Four. Bundling misuse.

WebSphere ships bundled inside other IBM products with restricted-use rights. Using that bundled entitlement as if it were a full standalone license, for workloads outside the host product, is a classic finding. The defense reads the restricted-use terms precisely and separates legitimate bundled use from deployments that need their own entitlement.

Five. Broken ILMT.

Even where sub-capacity was intended, a broken agent, a missing VM Manager connection, or a gap in quarterly reports can void the claim for that window. This is the difference between a defensible position and a full-capacity default. Reconstructing what ILMT actually recorded, and correcting its known miscategorizations, restores the sub-capacity position for the periods the evidence supports.

What this means under audit.

These five findings are why WebSphere draws so much audit attention, and why the Reconcile and Challenge steps of Contain, Reconcile, Challenge, Settle do most of the work. Each finding is a claim to be tested, not a number to be discounted. Answered item by item on your own evidence, a WebSphere draft typically settles well below where it opened.