The Oracle License Audit Process: A Step-by-Step Guide

An Oracle licence audit is a commercial event dressed as a technical one. Oracle’s licensing team measures your deployments, but the audit ends with a purchase proposal from Oracle’s sales team, and the size of that proposal depends on how the data was gathered, what was shared and how the contract was read. Customers who understand the process before it starts usually settle for a fraction of the first claim. Customers who treat it as a routine compliance check usually do not.

This guide walks through how an Oracle audit runs, step by step, what triggers one, and what to do at each stage.

In short

• The steps: Notice, declaration, Oracle’s tools, analysis, findings and a commercial proposal. The last step is a sale.
• The rights: Oracle’s standard audit clause gives it the right to audit your use of the programs on 45 days’ written notice, without unreasonable interference with your business. It does not oblige you to run every script Oracle sends or to share data outside the audit’s scope.
• The triggers: Audits are not random. No new purchases for two or three years, a new sales representative, a merger, a hardware refresh, VMware, or a ULA certification are common starting points.
• The defence: Measure your own deployments first, read your contracts, check Oracle’s findings line by line and negotiate the remedy. Oracle’s reports contain mistakes, and the first figure is a starting point.

Who runs Oracle audits

Oracle’s audits are run by Global Licensing and Advisory Services (GLAS), the team formerly called License Management Services (LMS). Its role is to establish your compliance position and, where there is a gap, hand it to Oracle’s sales team to close with a purchase. That hand-off is why we describe the audit as a commercial event. The licensing team is not your adviser, however helpful its emails sound.

The Oracle audit process, step by step

1. Notice

A formal audit starts with a letter citing the audit clause in your Oracle Master Agreement or licence agreement, naming the products and the entities in scope and asking for a kick-off meeting. Softer versions come first more often than not: an offer to “help you understand your licensing”, a “licence review” or a “customer success” call. Treat any request for deployment data as the start of an audit, whatever it is called.

2. Declaration

Oracle asks you to declare your deployments, usually in its Server Worksheet: every server, its processors, its virtualisation and the Oracle products installed. The worksheet asks for more than the contract requires, such as details of every host in a VMware cluster. What you write here becomes the basis of the findings.

3. Tools

Oracle sends its measurement scripts for the database, options and packs, middleware and Java. They read the database’s own records, including the feature usage history, so they report options that were used once years ago and packs that were enabled by default. Run them only after you have run your own measurement, understood what they collect and agreed the scope in writing.

4. Analysis

Oracle’s team compares the declared and scripted data against the licences it has on record. Two things inflate results here: Oracle’s partitioning policy for VMware, which counts every core a virtual machine could move to, and gaps in Oracle’s records of what you bought, especially licences acquired through mergers or resellers.

5. Findings

You receive a preliminary report listing the gaps Oracle believes exist. This is the most important moment of the audit. The report is a claim, not a bill: check every line against your own data and your contracts, and respond in writing before it becomes final.

6. Commercial proposal

Where Oracle finds a gap, its sales team proposes a purchase to close it, usually at list price with back support, often bundled with something Oracle wanted to sell anyway: a ULA, cloud credits, or a Java subscription. Everything in the proposal is negotiable, including the scope of the gap itself.

What triggers an Oracle audit

• No new licence purchases for two or three years.
• A new Oracle sales representative or a change in territory.
• Growth that is going to non-Oracle technology.
• A merger, acquisition or divestment.
• New data-centre hardware, or a move to VMware, Nutanix or another virtualisation platform.
• Use of E-Business Suite, where audits are frequent.
• A decision to certify, rather than renew, a ULA.
• A support request about a product you have not bought.

Your rights under the audit clause

Most Oracle agreements give Oracle the right to audit your use of the programs on 45 days’ written notice, require you to cooperate and to pay any underpaid fees within 30 days of the final findings. Read your own version: the scope, the notice period and any limits on frequency differ between contracts. The clause covers your use of the programs. Oracle’s policies on partitioning and its worksheets are not part of it, and neither is any obligation to install Oracle’s tools on systems outside the audit’s scope.

How to handle an audit

• Name one owner. All contact with Oracle goes through one person, in writing.
• Measure first. Run your own inventory of deployments, options, packs and Java before Oracle’s scripts, so nothing in the findings surprises you.
• Read the contracts. Collect every ordering document, licence agreement and amendment, including those of acquired companies. Your entitlements are often larger than Oracle’s records show.
• Agree the scope. Products, entities, servers and dates, in writing, before any data is shared.
• Check the findings. Challenge every line that rests on policy rather than contract, on a one-off use of a feature, or on a server that is not in scope.
• Negotiate the remedy. Remove what you do not need, license only what is left, and negotiate price and back support separately from anything else Oracle offers.

We defend Oracle audits for customers at every stage, from the first letter to the final settlement, and our expertise can help you save 30% to 100% of the exposure Oracle first claims. Our Oracle license audit defense page explains how, and our tips for Oracle license audits cover the mistakes to avoid.

Questions we are asked about the Oracle audit process

How long does an Oracle licence audit take?

Usually three to nine months from the notice to a settlement, longer for large or multinational estates. Most of the time goes on data collection and on disputing the findings.

Do I have to run Oracle’s audit scripts?

Your agreement obliges you to cooperate with an audit of your use of the programs. Agree the scope and understand what each script collects before running it, and run your own measurement first.

How much notice does Oracle give before an audit?

Most Oracle agreements require 45 days’ written notice. Check the audit clause in your own agreement.

Can I negotiate Oracle’s audit findings?

Yes. The findings are a claim, and Oracle’s reports contain mistakes. Both the size of the gap and the price of the remedy are negotiable.

What is Oracle GLAS?

Global Licensing and Advisory Services, Oracle’s licence audit team, formerly called License Management Services (LMS).

If you have received an Oracle audit letter, or been asked to run Oracle’s scripts, talk to us before you reply. A senior advisor replies within 48 hours.