Most companies treat an audit as a compliance chore and start exporting data the moment IBM asks. That instinct is the single most expensive mistake in the process. Once raw deployment data is in IBM's hands, you cannot un-share it, and you have lost the ability to frame what it shows. Privilege and confidentiality are not legal niceties here. They are the controls that keep you in charge of the narrative while you build your own position.
Why the data request is the real exposure.
The audit clause in your Passport Advantage agreement gives IBM a right to verify compliance, not a blank check to your environment. The scope of what you owe is negotiable, and the form it takes matters. A raw ILMT export, an unfiltered discovery scan, or a spreadsheet of every install across the estate hands IBM more than the agreement requires and more than you can defend on the spot. The goal is to satisfy the verification right while controlling what is produced and how it is read.
Route the audit through counsel.
Bringing legal counsel in early, whether in-house or outside, lets the bulk of the analytical work proceed under attorney direction. Internal analysis of your own exposure, the reconciliation of entitlements against deployment, and the strategy memos that follow are far better protected when they are prepared at counsel's request rather than circulated freely as operational email. This does not make facts disappear, but it does keep your working assessment of weak spots from becoming a document IBM can demand.
Practical steps that preserve the position include:
- Channel sensitive analysis through counsel so that internal compliance assessments are prepared under privilege rather than as open business records.
- Limit the circulation of draft findings, gap analyses, and exposure estimates to the smallest group that needs them.
- Mark and handle work product carefully, separating raw factual data from the legal and strategic conclusions drawn about it.
Confidentiality on what you do produce.
Whatever you decide to share with IBM should go out under the confidentiality terms of your agreement and a clear understanding of how IBM may use it. Auditors and the third-party firms IBM engages are bound by confidentiality provisions, and it is reasonable to confirm those terms before data moves. Production should be scoped to the products and the period genuinely in question, delivered in a controlled format, and logged so you have a record of exactly what was handed over and when.
Curate, do not dump.
Containing the data request is the first step of our method for a reason. Nothing should reach IBM until it has been scoped, validated, and reconciled against your own PVU and sub-capacity calculation. A curated production answers the verification right with accurate, defensible numbers. A raw dump invites IBM to find the gaps for you, then price them at full-capacity rates. The difference between those two approaches is frequently the difference between a manageable settlement and a multi-million claim.