The first 48 hours after an audit letter: what to send, what to hold, who speaks
Your first reply sets the tone for the entire audit — and most companies concede their leverage in it without noticing. A step-by-step protocol for the two days that matter most.
The audit letter is designed to make you move fast. Formal language, a named response deadline, a reference to your contract's audit clause — everything about it says reply immediately and completely. That instinct is precisely what it is engineered to trigger, and it is precisely wrong.
In fourteen years of defending audits from the buyer's side — and years before that watching them from inside a publisher — I've seen more money lost in the first two days than in the following six months. Not because companies are careless, but because the vendor has run this play hundreds of times and you are running it for the first time. This is the protocol that levels that asymmetry.
01What the letter actually means
An audit letter is not an accusation, and it is not (yet) a compliance finding. It is the opening move of a commercial negotiation dressed in legal clothing. Publishers audit for revenue — the audit team's output feeds the sales team's pipeline, and the most common resolution of an audit is not a penalty but a purchase: cloud credits, a new agreement, a renewal signed early on worse terms.
Read the letter twice and extract exactly three facts: who is auditing (the publisher's own team, or a third-party firm like Deloitte or KPMG acting for them), what scope is claimed (products, entities, geographies), and what deadline is stated. Everything else in the letter is tone.
02Hours 0–2: acknowledge, don't answer
Send a short written acknowledgment the same day: you have received the letter, you take contractual obligations seriously, and a designated contact will revert on process and timeline. That's it. Three sentences.
This does two things. It removes the vendor's ability to claim you are unresponsive — which matters if the dispute ever escalates — while committing you to nothing: no scope, no dates, no data, no meeting. The deadline in the letter is the vendor's preference, not your obligation; most audit clauses require "reasonable" cooperation and say nothing about ten business days.
03Day 1: one voice, frozen data
The vendor's audit team will try to open multiple channels: an email to your DBA asking for "a quick script output," a call to the account's usual IT contact, a LinkedIn message to someone in procurement. Every one of those channels is a leak. On day one, two rules go out internally:
- One spokesperson. Name a single person — usually the SAM lead or a procurement director — through whom every audit communication flows. Everyone else, including the CIO, refers the auditor to that person.
- Data freeze. No scripts run, no tool outputs shared, no environment details discussed with the vendor or its auditor until scope and process are agreed in writing. Helpful admins lose audits.
This is not obstruction — it is process discipline, and every serious auditor expects it. What you are preventing is the vendor building its claim from informal, unverified fragments that you can never retract.
04Day 2: scope, NDA, tooling
Now open your contract to the audit clause and compare it, word by word, against what the letter demands. The gaps are usually significant. Typical examples: the clause covers one legal entity, the letter demands the whole group; the clause allows the publisher to audit, the letter arrives from a third party the clause never mentions; the clause is silent on tooling, the letter presumes you will run the vendor's scripts on production systems.
| CHECK | QUESTION TO SETTLE BEFORE ANY DATA MOVES |
|---|---|
| ENTITIES | Which legal entities does the audit clause actually cover? Subsidiaries and recent acquisitions are frequently out of scope. |
| PRODUCTS | Is the audit limited to specific agreements or product sets? Hold it there. |
| AUDITOR | If a third-party firm is involved, is that permitted — and is an NDA in place directly with them, not just the publisher? |
| TOOLING | Are you obliged to run their scripts? Often you can supply equivalent data from your own SAM tooling instead. |
| TIMELINE | What does "reasonable" mean for your environment? Propose a schedule that fits change-control windows. |
Every one of these is negotiable at hour 30. Almost none of them is negotiable once data has flowed.
05Five things not to do
THE UNFORCED ERRORS — WHERE AUDITS ARE LOST
Don't run the vendor's scripts unreviewed. Some collect far more than the audit scope requires, and you cannot un-share it.
Don't volunteer history. Answer what is asked, about the period asked. Narrating past migrations invites new questions.
Don't "fix" things mid-audit. Uninstalling software after the letter arrives looks like spoliation and can convert a commercial dispute into a legal one.
Don't let the account manager broker it. Their job is to convert your audit into their quota. Keep audit and commercial conversations separate for as long as possible.
Don't sign anything in week one. Early "settlement offers" are priced against your panic, not your position.
06The reply that goes out
By the end of day two you send the first substantive response: confirmation of your designated contact, a request for the audit plan in writing, your position on scope and tooling based on the contract, and a proposed timeline that respects your change-control calendar. Professional, cooperative, and entirely on your terms.
From here the audit becomes what it always really was — a negotiation about evidence. And negotiations about evidence are won by the side that controls its own data. That work starts now too: while the process questions are being settled, build your own Effective License Position in parallel, so that when the auditor's findings arrive, you are comparing them against your numbers instead of accepting theirs.
The vendor has run this play hundreds of times. After these 48 hours, so have you.
An audit letter on your desk right now?
Advisor on Call exists for exactly this week — audit triage with a former Oracle VP, backed hour-for-hour by analysis of your contracts and data.
07Straight answers to the questions we get most
THE AUDIT LETTER — PLAIN-LANGUAGE FAQ
How long do you have to respond to an Oracle audit letter? Oracle’s standard notice is around 45 days — but that clock governs acknowledgement, not surrender. Confirm receipt promptly and commit to nothing else; the stated deadline is the vendor’s preference, and the pace of everything that follows is negotiable.
Can you refuse or postpone an Oracle audit? If your contract grants audit rights you generally can’t refuse, and stalling reads as non-cooperation — a material breach in many agreements. You can negotiate a realistic schedule, and Oracle will sometimes grant a short postponement for a genuine business reason.
Do you have to run Oracle’s LMS scripts? You’re obliged to provide reasonable data, not necessarily to run Oracle’s scripts on your production systems. You can frequently supply equivalent evidence from your own SAM tooling — and review anything before it leaves your side, because some scripts collect more than the audit scope requires.
Should you buy licenses during an audit? No. Early settlement offers are priced against your panic, not your position. Wait for the findings, verify them against your own Effective License Position, and remediate — disable or right-size — before you ever treat a purchase as the answer.