Common Cognos audit findings and how to challenge them.

Cognos sits on the list of high-risk IBM products that draw audits for the same reasons WebSphere and Db2 do: it is widely deployed, its metrics are easy to drift out of compliance, and it ships with a bundled database that is simple to misuse. When the findings letter arrives, the items on it tend to come from a short, familiar set. Each one has a known shape, and each one has a known way to push back. The estates that settle well are the ones that recognized the findings early and assembled the counter evidence before the data request closed.

Role inflation across the user base

The most common finding is that more users hold authoring or administrative roles than actually use them. Cognos weights roles differently, and a consumer who only views reports is a far lighter entitlement than an author who builds them. IBM counts roles as assigned. The challenge is to count roles as used: pull the platform usage, map each named user to the capability they genuinely exercise, and demonstrate that the heavy roles are fewer than the grants suggest.

Dormant, duplicate, and non human accounts

Leavers who were never deprovisioned, service accounts, and the same person appearing across two directories all inflate the named user total. These are not licensable users in the way IBM's opening count treats them, and each one struck reduces the finding. The evidence is a clean identity reconciliation against the directory and the leaver records.

Bundled Db2 used beyond its scope

Cognos includes a restricted-use Db2 license, entitled only to support Cognos itself. Pointing that database at another workload breaches the bundle, and bundling misuse is a named IBM audit trigger. The challenge is to scope the finding to the actual outside usage rather than conceding the whole instance, and to reconcile against any full-use Db2 entitlement already held that could cover the overflow.

Environment and edition mismatches

• Non production and development copies counted as if they were licensed production instances
• A higher Cognos edition deployed than the entitlement covers, often after an in place upgrade
• Capabilities enabled that belong to a tier the organization never purchased
• Mobile or embedded access counted twice against users already licensed for the core platform

How we challenge the set

Every one of these findings is answered with evidence rather than argument. We reconcile assigned roles to used roles, strike the accounts that should not count, scope the bundled Db2 to its real usage, and match every claim against the entitlements already on record. The corrected numbers go into a settlement that names the products and the counts, and we fold the right edition and role mix into the forward renewal so the same findings do not return next cycle.