Quick Recap

In our previous blog, we explored how to follow up on settlement obligations – implementing changes, fixing reporting gaps, and cleaning up accounts to avoid repeat non-compliance.

Once those obligations are met, the next step is to capture how your audit was performed. Documenting your data collection procedures ensures transparency, consistency, and preparedness for whatever IBM (or another vendor) brings next.

Why Documentation Matters

Every IBM audit produces a wealth of data, communication, and procedural insight. Too often, that knowledge disappears once the audit closes—leaving the organization unprepared when the next one begins.

By systematically documenting how data was gathered, reviewed, and validated, you create a single source of truth that supports both Software Asset Management (SAM) and future compliance efforts.

Think of it as turning audit pain into audit preparedness.

What to Include in Your Audit Documentation

A well-structured audit record should answer five key questions:

1. What data sources were used?

Identify all the systems and tools that contributed information, such as:

• IBM License Metric Tool (ILMT) or BigFix Inventory
• CMDBs or other discovery systems
• Usage reports and product dashboards
• Spreadsheets or manual inventories

Capturing this list ensures traceability—and helps assess whether all relevant sources were covered next time.

2. Who provided the data?

Perhaps the most valuable record is your list of internal contributors.
Finding the right contacts is often the most time-consuming part of any audit. Recording who supplied each dataset, their role, and their system expertise can dramatically streamline future requests.

3. How was data collected?

Document the specific methods used—scripts, tools, exports, screenshots, or reports. Note who executed each task and whether data was extracted directly from IBM tools or from internal systems.

This clarity enables others to replicate or verify the same process later on.

4. How was data reviewed and validated?

Summarize how information was checked for accuracy and how license calculations were confirmed. Record the review stages, validation steps, and any discrepancies found along the way.

For example:

• Cross-checking ILMT reports against infrastructure records
• Reviewing Authorized User lists for inactive accounts
• Revalidating PVU calculations after hardware changes

5. What audit methodology was applied?

Capture the logic behind your compliance assessment—especially any licensing nuances, product bundling relationships, or exceptions that influenced the Effective License Position (ELP).

If you later face inconsistencies in future audits, these notes will help explain why previous conclusions were reached.

The Benefits of a Documented Process

✅ Repeatability: Anyone can reproduce your audit process with the same data sources and validation steps.
✅ Consistency: Each audit builds on the previous one, reducing confusion and rework.
✅ Transparency: Clear documentation helps justify compliance positions to IBM and internal stakeholders alike.
✅ Efficiency: Future audits or internal reviews start with a ready-made framework, saving significant time and effort.
✅ Risk Reduction: You can identify deviations between audit approaches early—before they become compliance disputes.

Final Thoughts

An IBM audit shouldn’t be viewed as an isolated event—it’s part of an ongoing compliance cycle.

By documenting every source, method, and decision point, you create a living record that strengthens internal governance, supports SAM maturity, and reduces future audit risk.

In short, the best time to prepare for your next IBM audit is the day the last one ends.

Looking ahead

This marks the final chapter of our 10-part IBM license compliance blog series.

From preparation to settlement, we’ve covered every stage of the IBM audit lifecycle—helping organizations approach compliance not as a burden, but as a controllable, strategic process.

Want to access the full guide on IBM license compliance audits? Download it here:

Comments

This field is for validation purposes and should be left unchanged.

Your Email*

Consent*

By submitting this form you are agreeing to our Privacy Policy.*

About the Author

Koen Dingjan, IBM Service Director

Koen is a seasoned expert in IBM licensing with nearly two decades of experience. A former Deloitte auditor, he has led over 60 IBM compliance reviews and developed an industry-recognised IBM compliance certification course. At ITAA, Koen helps clients manage IBM license compliance, defend against audits, and optimize license management strategies.