The audit response framework.
A vendor audit letter is an opening position, not a bill. This note sets out the sequence that keeps an audit a measurement exercise rather than a forced purchase: acknowledge without conceding, control the scope, run your own count, dispute the findings, and settle at your contracted rate. Handled with discipline, the average compliance claim falls by 60–75%.
An audit outcome is decided by how the buyer responds in the first weeks, not by the raw deployment data. Most opening claims are inflated by counting errors, list-price assumptions, and scope the buyer never owed. A disciplined response — one voice to the vendor, scope held to the contract, every line verified before conceding — routinely cuts the claim by 60–75% and turns a list-price demand into a contracted-rate true-up.
01 Key findings
The opening claim is a negotiating position, not a verified fact. Vendors rarely hold a complete picture of your entitlements; many claims shrink the moment the buyer produces purchase records the vendor had lost.
The most common self-inflicted wound is letting technical staff answer the vendor directly. Casual admin replies about deployment become admissions, and ad hoc data dumps hand over scope the contract never obliged you to grant.
Audits expand to fill the access they are given. Holding the audit to the entities, products, and period the contract actually covers removes a large share of speculative findings before they form.
Inflation sources are predictable and contestable. Non-production counted as production, double-counted virtual instances, the wrong metric, and list-price settlement each move the number by a large margin — and each has a clean counter.
Time is a buyer’s tool. The vendor works to a fiscal quarter; a buyer willing to let the clock run, verifying every figure, settles lower than one rushed into a year-end deal.
02 The response timeline
The single highest-value choice a buyer makes is the tempo of the response. A controlled, evidence-first sequence and a reactive scramble start from the same audit letter and end at very different numbers.
Controlled response Recommended
Acknowledge receipt only, route everything through one point of contact, hold scope to the contract, run your own count, and answer each finding with evidence. The pace is set by the buyer’s verification, not the vendor’s quarter. Outcome: a contracted-rate true-up, often 60–75% below the opening claim.
Reactive scramble Weaker
Administrators answer vendor questions directly, data is handed over on request, and a settlement is rushed to meet an artificial deadline. Scope drifts, admissions accumulate, and the shortfall is priced at list. Outcome: a forced purchase at or near the vendor’s opening number.
03 The first 72 hours
The audit begins with a notification letter, and the buyer’s first moves set the tone for everything after. Do not acknowledge any deployment figures, do not grant access, and do not let individual administrators respond to vendor requests. Acknowledge receipt, confirm you will engage through a single named point of contact, and ask the vendor to state the contractual basis, scope, and products in writing. This buys time and forces the vendor to define the audit precisely rather than fishing across the estate.
Internally, the same window is for assembling the response team and locating the entitlement records — the contracts, order forms, and amendments that define what you are licensed for. An audit is answered by a team with explicit roles: a single point of contact who owns all vendor communication, a license or asset specialist who builds the deployment position, a procurement lead who runs the commercial side, and legal counsel who reads the clause and guards scope. On larger audits, an independent advisor who has run the same vendor’s audits before adds pattern knowledge an internal team facing its first audit lacks.
One voice to the vendor. The most damaging error is letting technical staff answer vendor questions directly. Route every communication through one trained point of contact; technical staff supply data to the internal team, not to the vendor. When these lines blur the audit expands, because a vendor talking directly to an administrator gets answers the contract never obliged the company to give.
04 Do and don’t
The response divides cleanly into moves that protect your position and moves that quietly surrender it. The distinction holds at every phase of the audit.
| Phase | Do | Don’t |
|---|---|---|
| Notification | Acknowledge receipt; name a single point of contact | Confirm any deployment figures or grant access |
| Scope | Confirm entities, products, and period in writing | Answer questions beyond the contracted scope |
| Data collection | Run measurement scripts yourself and review output first | Let the vendor run tools unsupervised on your estate |
| Findings | Verify each line against entitlement and contract | Accept the opening claim or answer with silence |
| Settlement | Price the shortfall at your contracted discount | Settle at list or concede back maintenance by default |
05 The response framework
Four disciplines carry the response from the notification letter to a closed settlement. Applied in order, they keep the audit a measurement exercise the buyer controls.
Acknowledge and contain
Confirm receipt without conceding figures, appoint one point of contact, and require the vendor to state the contractual basis and scope in writing. Assemble the team and pull the entitlement records in parallel.
Control the scope
Hold the audit to the entities, products, and period the contract covers, and refuse requests that reach beyond them. Where the vendor proposes measurement scripts, run them yourself and review the output before it leaves your control.
Run your own count
Reconcile deployment against entitlement independently, so you know where you are genuinely short, compliant, or over-licensed. The independent number defines your walk-away point and lets over-licensing in one product offset a shortfall in another.
Dispute and settle
Answer each finding with evidence — entitlement record, topology, licensed metric, discount rate — then settle at your contracted rate. Document the outcome so it closes the period, bars re-audit, and resets the baseline cleanly.
06 Where claims inflate
An opening claim is a negotiating position. The common inflation sources are predictable, and each is contestable with the right evidence — a specific, evidenced rebuttal settles far lower than silence or a blanket denial.
| Inflation source | How it appears | Counter |
|---|---|---|
| Non-production counted | Dev/test billed as production | Exclude per contract terms |
| Virtualization double-count | Same instance counted twice | Provide topology evidence |
| Wrong metric | User count where it should be device | Cite the licensed metric |
| List-price settlement | Shortfall priced at full list | Settle at contracted discount |
| Back maintenance | Penalty demanded for past years | Cap or remove per clause |
Build a counter-position document that addresses each line with evidence: the entitlement record, the deployment topology, the contract metric, and the discount rate. The work of verification is what converts a list-price claim into a contracted-rate true-up — and it is the bulk of the 60–75% reduction a disciplined response achieves.
07 Settle on your terms
Settlement is a negotiation, and the levers that win a new contract apply. Price any genuine shortfall at your contracted discount, decline back maintenance and penalties where the clause allows, and where possible fold the true-up into a forward purchase that earns a better rate on the whole estate. Timing matters: a vendor under quarter-end pressure settles faster and cheaper, and a buyer willing to let the clock run holds the advantage.
Document the settlement so it closes the audited period definitively, bars re-audit of the same years, and resets the entitlement baseline cleanly. A settlement that leaves the period open or the records ambiguous invites the next audit. Keep the relationship intact for what comes after: the same vendor will sell again, and a response handled with professional firmness makes the buyer a less attractive audit target than one that pays to make the process stop.
The reconciliation you build under audit pressure is an asset, not a one-time cost. Maintained afterward as a living license position, it turns the next audit from a scramble into a routine confirmation — and gives you the evidence to negotiate a self-certification clause that can retire the formal audit altogether. Harden the terms at renewal with the audit clause negotiation guide.
08 Our recommendation
Acknowledge receipt only, name one point of contact, and require the vendor to state scope in writing. Concede no figures and grant no access until the team is assembled and the entitlement records are in hand.
Run your own count, hold scope to the contract, and answer every finding with evidence. Do not settle against an artificial deadline — the vendor’s urgency is itself a signal that patience is worth money.
Keep the reconciliation current as a living license position, fix the practices that created the exposure, and tighten the audit clause at the next renewal using what this audit revealed.
Facing a software audit?
Our advisors run the response from the buyer side — controlling scope, verifying the claim, and settling for a fraction of the opening number.
The Licensing Edge
Weekly vendor and licensing intelligence for enterprise IT leaders. 3,000+ subscribers.