IBM Audit Defense

Stay one step ahead of IBM and its license compliance audit firms.

THE CHALLENGE

High impact audit expertise

IBM periodically audits its customers through third parties such as KPMG and Deloitte. These audits can be disruptive and sometimes lead to significant license compliance exposure. We provide immediate support, helping you to navigate the audit process to ensure optimal results, whichever audit phase you are in.

Many organizations unknowingly face license compliance risks far exceeding their annual spend. We can help reduce any license shortfall value by more than 90%, even when the audit firm has already shared the draft audit report.

Free Mastering IBM Audit Guide

Looking to get ahead of an IBM audit? Download our comprehensive guide – covering strategies for preparation, negotiation, and accurate data handling.

Enter your email to download the guide:

how we help

IBM Audit Defense Services

End-to-end audit support, from initial risk assessment through to final settlement negotiations.

Speak to an IBM expert

Initial Risk Assessment

During our one-week risk assessment we compare your IBM entitlements list and discovery tool reports with our audit benchmark data. We then identify your key risk areas and establish a high-level plan to mitigate those risks.

Internal audit

Using detailed audit procedures for all IBM products in scope, we produce an effective license position (ELP) report, equivalent to those produced by IBM’s own audit firms.

External audit support

From negotiating the audit scope and data collection approach, to delivering technical evidence, we guide you through the external audit from start to finish.

Audit report review and settlement support

Our careful and detailed analysis of the draft ELP identifies all mitigating evidence, technical arguments and licensing interpretations, helping to reduce your compliance exposure and strengthen your settlement negotiating position with IBM.

What you get

The Benefits of IBM Audit Defense

Working with ITAA on your IBM audit means less disruption, less risk, and a stronger position at the negotiating table.

Manage the timeline

During our IBM audit support process, we do whatever we can to take the pressure off your organization by pushing back the audit dates where needed, so you have the time and peace of mind to make well-considered decisions.

Streamlined audit process

IBM audits can often take up to two years. Our extensive technical audit experience reduces the effort required to navigate the audit process.

Avoid future non-compliance

If your organization does need to pay a settlement, we strive to tailor this investment to your future IT environment, by ensuring it fits within your medium-term IT strategy, helping to avoid future non-compliance.

Risk mitigation

We align each recommendation with IBM’s licensing requirements, giving organizations confidence in their compliance position.

Why ITAA

Independent expertise. No vendor agenda.

ITAA combines Microsoft licensing expertise, software asset management experience, and commercial understanding to help organisations establish a clearer license position and make more informed decisions.

Independent advice

Our advisors have no affiliation with any software providers. Many of them transitioned from the software world, choosing to help organizations insulate themselves from compliance risk.

Industry specialists

Our trusted consultants have worked closely with international organizations for decades, bringing deep expertise in SAP, Microsoft, IBM, Oracle and other publishers.

Tangible results

We provide advice in order to make a tangible difference in your business. Our value-driven service revolves around doing the right things in the right way.

REAL WORLD OUTCOMES

IBM audit defense mitigates $250M license compliance risk

ITAA were engaged to help an IBM customer address the draft findings in an IBM software license review report (audit report) created by Deloitte.

Learn more →

FAQ

An IBM software audit is a check of whether the IBM software you have deployed is covered by the licenses you hold. IBM calls it a Software License Review, and its Passport Advantage terms refer to it as Compliance Verification.

IBM usually appoints a third-party audit firm, such as KPMG or Deloitte, to carry it out. The auditor collects deployment data, compares it with your entitlements, and reports the result in an Effective License Position (ELP) report, which IBM uses as the basis for any settlement. What to expect from an IBM software license review walks through each stage.

Before you hand over any data, agree the scope with the auditor and IBM. Check which legal entities, products and environments are included, and raise any concerns about the scope or data requests at this stage, before the review progresses. Internally, decide who is running the response and appoint one central contact to manage all communication with the auditor. It’s also worth putting a non-disclosure agreement in place early. Read our blog: How to Respond to an IBM Audit Notice in 2026

IBM audits can take many months and, in our experience, some have lasted up to two years. The overall duration depends on the scope, how quickly data is collected, and how much of the draft report is disputed. Deadlines for key stages, such as providing data and signing off the draft ELP before discussions with IBM, are usually agreed at the start. Review these timelines carefully when the auditor first shares them, and avoid committing to them until you’re confident they’re realistic for your team.

Costs are settled once IBM prices the shortfalls in the ELP. Along with the licenses themselves, the bill may include past-due Subscription & Support fees, and exposure can be far higher than annual spend. In extreme cases, organizations spending $3 million a year on IBM licenses have faced reported shortfalls of more than $200 million. Buying the licenses listed in the ELP is one way to close a shortfall, but depending on the product’s licensing terms and the entitlements you hold, a different metric or product may sometimes cover the same use for less. Review the draft report in detail and assess the available options before settlement talks start. See 7 IBM audit report areas you should review.

An IBM audit carries several kinds of risk. The process can be intrusive and take up significant time from IT, procurement and legal teams. Sharing more data than the agreed scope requires can create security and privacy risks, particularly where it includes personal information. The main financial risk is exposure from products that aren’t licensed correctly. Sub-capacity licensing is a common example: if the auditor decides you haven’t met IBM’s sub-capacity requirements, you can be assessed on the full capacity of the physical server. Container deployments are another potential source of compliance findings.

Auditors often ask for a wide range of information, including server configurations, user access logs and details of custom deployments. Your agreement requires you to cooperate with license verification, but individual data requests can vary depending on the scope and environment.

You can ask what each request is for and propose alternative sources. In one IBM audit we supported, we found alternative sources that met the evidence requirements with much less effort.

Yes. IBM’s licensing terms can be complex and open to interpretation, and auditors may rely on assumptions or estimates where data is incomplete, so draft findings aren’t always accurate. The draft ELP is your opportunity to review and challenge the findings with evidence before IBM prices them. In our experience, the review window can sometimes be as short as two weeks, so it’s important to check that every entitlement has been credited, licensing terms have been applied correctly, and auditor estimates are replaced with real data where possible. In previous IBM audits, our work has helped clients reduce the identified license shortfall value by more than 90%.

In our experience, the issues that come up most often are:

False positives from discovery tools, such as bundled components counted as separate products
Sub-capacity systems assessed at full capacity
Authorized user lists that include duplicate accounts, departed employees or system accounts
Standby machines used for redundancy or disaster recovery counted as production, even though they can qualify for free licensing depending on the product’s terms

Where you have the evidence, these findings can often be challenged before IBM prices the shortfall. See 7 IBM audit report areas you should review.

Yes. Our advisors have no affiliation with any software provider, so the advice we give is based only on your organization’s interests. This matters most in an audit. IBM appoints the audit firm and pays for its work, while we’re engaged and paid by you. Many of our advisors previously worked in the software industry, so they understand how audits are run from the other side. We’re also open with you about how other parties may earn money, directly or indirectly, from the licensing choices you make.

GET IN TOUCH

Expert IBM support

If you’re facing an imminent IBM audit, book a call with one of our experts today. Fill out the form and we’ll be in touch within 24 hours.

+44 (0) 3302 050 215

info@itaa.com