Most of an audit's outcome is decided by what gets examined, yet most companies never negotiate that. They accept IBM's framing of the scope, fill in the request template, and only start pushing back once findings appear. By then the scope is set and the data is in IBM's hands. The leverage that existed at the start, when scope was still open, has been spent. Treating the scope itself as the first negotiation changes the entire arc of the audit.
The audit clause is a right, not a blank check.
Your Passport Advantage agreement gives IBM the right to verify that your deployment matches your entitlements. That right is real, and refusing it outright is not the play. But a verification right is bounded. It does not entitle IBM to unrestricted access to your environment, to every product whether or not it is in question, or to data in whatever raw form is most convenient for the auditor. The difference between the right IBM has and the request IBM sends is the room you have to negotiate.
The four dimensions worth negotiating.
Scope is not one thing. It is several, and each can be narrowed:
- Products in scope. If the trigger relates to specific products, the review should track those products, not the entire IBM estate by default. Confirm what is actually under examination.
- The time period. The lookback can run two to five years. Establishing a defined and reasonable period limits both the analysis and the exposure that a full-capacity lookback could otherwise reach.
- The data format. A curated, validated production satisfies the verification right. A raw ILMT export or unfiltered discovery scan hands over far more than required and invites the auditor to find gaps for you.
- Process and cadence. Who interprets the data, how findings are presented, and how you get to respond before numbers are fixed are all part of the working arrangement, not givens.
Why scope drives the number.
Exposure scales with what is examined and how. A wider product list, a longer period, and a rawer data set all enlarge the surface where a finding can land. Sub-capacity makes this concrete: where tracking evidence is thin, IBM defaults to full-capacity charging, and a longer lookback multiplies that across more periods. Narrowing the scope to what the agreement genuinely requires is not obstruction. It is holding IBM to the boundaries of its own clause, and it directly constrains the size of any eventual claim.
Contain first, then produce.
This is why our method begins with Contain. Control the data request and the clock before anything leaves the network. Establish the scope, validate the data against your own PVU and sub-capacity calculation, and only then produce, in a scoped and defensible form. A buyer who negotiates scope before agreeing to it walks into the reconciliation phase with the examined surface already minimized and their own numbers already in hand.