Software vendors run audits where the expected recovery is highest. IBM is no different. The selection is driven by the account history and deployment profile, and most of the inputs are things a buyer can see in their own record before IBM acts on them. The patterns below are the ones that move an account up the list.
Support non-renewal is the loudest signal.
When a customer lets Subscription and Support lapse on a product but keeps running it, IBM has a clean read that deployment may have outpaced entitlement. The product is still in use, the relationship has cooled, and the recovery case is straightforward. Non-renewal of S and S is one of the most reliable audit triggers there is. Requesting support for a product that does not appear in the entitlement record sends the same signal from the other direction.
A multi-year gap since the last review.
Estates drift. Three or more years without an audit is long enough for virtualization changes, new clusters, and user growth to pull deployment away from the original purchase. IBM knows this, and a long quiet period on a sizeable account is itself a reason to look. The longer the gap, the larger the lookback that can follow, and that lookback can run two to five years of back charges at full-capacity rates.
Heavy use of high-risk products.
Some products carry more audit exposure because their metrics are easy to get wrong. Concentrated use of these draws attention:
- WebSphere and MQ, where sub-capacity and PVU counting on virtualized hosts is easy to miscalculate.
- Db2, where bundled and restricted-use editions get stretched past their allowed scope.
- Cognos, Maximo and Tivoli, where user counting and bundled components create quiet over-deployment.
The common thread is a metric that depends on configuration. When the count is sensitive to how the software is deployed, the odds that the record and the reality have diverged go up, and so does the audit value.
Bundling that has drifted past scope.
Many IBM products ship with a restricted-use component, most famously the Db2 bundled with Cognos for its content store. That entitlement is limited to supporting the parent product. Using it as a general-purpose database is a finding IBM looks for specifically, because it is common and easy to evidence. The same logic applies to a Cloud Pak bundle whose entitlement is stretched across workloads it was never meant to cover.
Corporate change and license transfer.
Mergers, acquisitions, and divestitures move software between legal entities, and IBM licenses do not always travel cleanly. A transaction that changes who owns or runs a deployment is a natural moment for IBM to test whether the entitlements followed the software. Rapid infrastructure change of any kind, a cloud migration, a data center consolidation, a virtualization refresh, raises the chance that deployment has outrun the paperwork.