Surviving a Software Audit, Part Two: The Settlement

The findings document is an opening offer, not a verdict. How claims get inflated, and how settlements actually get made.

Part two of two, picking up exactly where the last episode left off: the findings document has landed and the number on it is worse than you expected.

That number is a negotiating position. This episode covers how publisher claims get inflated in the first place, why opening claims routinely land several times higher than eventual settlements, what the publisher actually wants out of this — which is rarely the cash figure in front of you — and how zero-cash resolutions get traded into renewal and subscription commitments instead.

Audit defense ends in commerce. The practitioners who understand that walk away with a business outcome. The ones who treat it as a compliance verdict write the check.

IN THIS EPISODE

- Why the findings document is an opening position, not an invoice
- How claims get inflated: measurement errors, wrong metrics, and unverified assumptions
- Auditing the audit — challenging methodology before you challenge the number
- What the publisher actually wants, and why it's rarely the cash figure
- Zero-cash resolutions: trading findings into renewal and subscription commitments
- Where the leverage sits, and the timing that determines who has it
- Back maintenance, penalties, and which line items are genuinely negotiable
- Getting it in writing: release language and what a settlement should close
- Building the evidence discipline that prevents the next one

CHAPTERS

• (00:02) - Audit Defense Payoff
• (02:43) - Claim Anatomy Unpacked
• (04:14) - Rebuild the Count
• (06:17) - Trading for Settlement
• (10:39) - Locking the Paper
• (11:44) - Fix the Leaks
• (12:27) - Library Fee Lesson
• (13:12) - Four-Part Audit Game

TRANSCRIPT
SOURCES & FURTHER READING

Flexera 2026 State of ITAM Report
https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

ISO/IEC 19770-1 — IT Asset Management Systems
https://www.iso.org/standard/68531.html

A note on evidence: software audit settlements are almost universally subject to non-disclosure terms, which means no public dataset of settlement outcomes exists. The negotiation guidance in this episode reflects licensing advisory practice and thirty years of firsthand experience on the customer side of the table. It is presented as practitioner knowledge, not as research.

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

Creators and Guests

Host

Bill Van Nort

Founder of Operational ITAM. Thirty years leading IT asset management in banking, mortgage, and automotive.

What is Operational ITAM Podcast?

Thirty years of enterprise IT, distilled into something you can use on Monday morning.

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them. Host Bill Van Nort has led IT asset management, end-user computing, and workplace technology at large organizations across banking, mortgage, and automotive, reclaimed millions in software spend, and survived audits from the biggest publishers on the planet.

No vendor pitches disguised as advice. No jargon for its own sake. When something is an opinion, he says so. When the honest answer is "it depends," he tells you what it depends on.

New episodes cover the fundamentals that never change: know what you have, know where it is, know what it costs, know when it leaves.

Hey everybody and welcome back to the Operational ITAM podcast.

I'm Bill Van Nort and this is part two of the Audit Defense two-parter, the payoff episode.

Last time we left you on a cliffhanger and today we resolve it.

The findings have landed, the number is enormous, and we're going to walk it

down together, step by step, all the way to the handshake at settlement.

If you haven't heard part one, episode four, stop right here and go listen. I mean it.

Today's episode assumes you've made the five opening moves. You contained the

letter, you read the contract, you controlled the terms, you built your own

position, and you verified every row of data before it left the building.

If you did all that, today is where it pays off. If you didn't,

well, today is where you find out exactly what it would have been worth.

Good morning, good afternoon, or good evening, wherever you happen to be listening from.

This is the Operational ITAM Podcast, the show where we take the unglamorous

machinery of enterprise technology and make it make sense.

I'm your host, Bill, and today we're going to the settlement table.

Welcome in. Grab your coffee, grab your headphones, and like I said last week,

grab a calculator. Let's get into it.

So, the document arrives.

It's usually called something like preliminary findings, and it comes with a

spreadsheet, a methodology section nobody reads, and a number.

And the number is designed, designed to stop your heart. Seven figures, sometimes eight.

Somebody forwards it to your CFO with the subject line urgent,

and suddenly you're the most popular person in the building, and not in the good way.

Here is the single most important sentence of this entire two-parter,

so I'm going to say it slowly.

An audit finding is an opening position, not an invoice.

It is priced at list, counted at worst case, and delivered with a straight face.

And every part of it is negotiable.

The organizations that get hurt in audits are the ones that read the finding as a bill.

The organizations that come out whole are the ones that read it as the first offer in a negotiation.

And the industry data backs this up. Opening claims commonly run two to four

times what the matter eventually settles for, and well-defended organizations

routinely settle at a fraction of the opening number.

That gap, between the number on the page and the number on the check,

is what today's episode is about.

I'm going to teach it as four numbers.

Every audit endgame is a journey through four numbers in order.

The claim, the correction, the deal, and the paper.

Miss a number or skip a step and you'll pay for it. Let's walk through them now.

1. The claim. Know how it was built.

Before you can fight a number, you have to understand its anatomy.

And the anatomy of an audit claim is worst-case assumptions stacked on worst-case assumptions.

Let me show you the standard construction. Every processor counted at full capacity,

whether the software can actually use every core or not.

Every installed option and feature assumed to be in use, even the ones nobody ever enabled.

The most aggressive possible interpretation of virtualization,

sometimes counting the entire cluster a workload could move to,

not the host it actually runs on.

Non-production environments swept in as production.

And then the pricing layer. Everything at current list price.

Not the discount you've negotiated for 15 years. List.

Because, the argument goes, non-compliance shouldn't earn preferred pricing.

And on top of that, frequently, back support. Retroactive maintenance fees on

licenses you allegedly should have owned, calculated backward for years.

Now, is that dishonest? Here's my honest answer, opinion clearly labeled.

It's advocacy. The auditor's client is the publisher, and the claim is the publisher's

best case, the same way a plaintiff's opening demand is a best case.

Your job is not to be outraged by it. Outrage is wasted calories.

Your job is to take it apart, professionally, factually, line by line. Which brings us to...

2. The Correction.

Challenge the count before you ever discuss the price. Write this down,

because this is where most of the money moves.

In audit negotiations, challenging the count typically delivers more of the

reduction than negotiating the price ever will.

The count, not the discount.

Amateurs argue about percentages off an inflated number. Professionals rebuild the number.

So you go finding by finding, with your own data, the position you built in Move 4 last episode.

That disaster recovery site counted as production? Contractually covered.

Here's the clause. Strike it.

Those options flagged as deployed? Installed by default. Never enabled.

Here's the configuration evidence. Strike them.

Those servers in the count? Decommissioned in March. Here's the change record. Strike them.

That entitlement gap? We found the proof of purchase from the acquisition.

Remember the entitlement library from episode 3?

Here it is. strike it.

And the metric itself. Does the auditor's interpretation actually match the

contract language, or does it match the publisher's current preferred reading

of a contract you signed under different rules?

Those are not the same document. Read yours. Then you put it in writing.

A formal position statement.

Evidence attached. Delivered through your single point of contact within the response window.

Usually 30 days. And if you negotiated the engagement terms properly in part

one, you made sure you had a real response window at all.

Calm, factual, thorough. No adjectives. Evidence doesn't need adjectives.

And through this entire phase, one discipline above all, never let the correction

phase and the money phase blur together.

First we agree on what's true. Then we discuss what it costs.

The publisher would love to skip straight to the check. Don't.

Alright, so the claim has been corrected. In my experience, and in the industry

data, a rigorous technical rebuttal alone routinely cuts the opening number dramatically.

Now, and only now, we talk money. 3.

The Deal Understand what the publisher actually wants Here's the secret that

changes everything about the settlement table, and I told you it was coming last episode.

The publisher usually doesn't want the check.

A one-time compliance payment is the least interesting outcome for them.

What they want is forward revenue, a bigger renewal, a subscription conversion,

a cloud commitment, a longer term.

The audit, remember, is a sales function wearing a compliance costume.

The finding is leverage, and the leverage is pointed at your next agreement.

And here's the twist. That's your advantage. Because it means the settlement

is not a fine. It's a trade.

And trades have terms.

In practice, a settled audit is rarely a single check. It's a blend.

A forward purchase. Usually the biggest line.

Back maintenance. And hear me. Back maintenance is the most negotiable line on the page.

It is routinely reduced or waived entirely when you're buying licenses and putting

them under support going forward, because the publisher is getting the future

revenue it actually wanted.

And the penalty framing, the list price uplift, that's the fight over whether

your negotiated discount applies to the settlement.

Fight it. Your purchase history and your contracted rates are your evidence.

A well-run settlement often ends up looking less like a punishment and more

like a renewal you were probably going to do anyway, at terms you can live with,

with the compliance claim resolved inside it.

The worst outcome on the menu is paying the full claim, at list,

as a one-time penalty and getting nothing forward looking for it.

That outcome is almost always a failure of negotiation, not a requirement of the situation.

Three pieces of tradecraft for this phase earned the hard way.

1. Timing. Publishers have quarters, and quarter end, especially fiscal year

end, makes deals flexible in ways mid-quarter never is.

If you can steer the close toward their year end, the same settlement gets measurably cheaper.

You've been on the other side of that clock your whole career. Now it works for you. 2.

Never reveal your budget, your internal deadline, or your walk-away number.

Obvious? Sure. And yet I have personally watched a manager mention a reserve

in a meeting, and then watched the settlement land, miraculously,

at exactly that figure. Funny how that works.

Three, brief your executives before the publisher does.

Escalation is a standard pressure move. The publisher's VP calls your CFO,

sounds grave, mentions large numbers.

If your CFO already has your one-page brief, here's the claim,

here's our corrected position, here's our strategy, here's the range we expect, that call bounces off.

If they're hearing the number for the first time from the vendor,

you've lost control of your own negotiation.

Inoculate first. And after every session, send a written summary of what was

discussed and agreed. Paper the trail as you walk it.

Let me give you the war story, because part one got one, and fair is fair.

Different publisher this time. Again, they know who they are.

The corrected claim was still substantial.

Real gap, honestly owed. No way around it.

And the publisher's team wanted a check. A big, ugly, one-time list price check

with three years of back support stapled to it.

Here's what we knew that changed the game. We had a renewal coming in 11 months

anyway, and we knew their fiscal year ended in eight weeks.

So we stopped negotiating the penalty and started negotiating the future.

We proposed folding the entire compliance gap into an early renewal.

Bigger commitment than we'd planned, sure. But at our contracted discount,

with the back support waived, the audit released in full, and a couple of contract

terms fixed that had bothered me for years.

They got a larger deal booked inside their fiscal year. We got the gap resolved

at a fraction of the claim, protections we didn't have before,

and a renewal we needed anyway.

Their rep hit a number. Our CFO kept a budget.

And the penalty, the seven-figure check that started the conversation, never existed.

Nobody wrote it because it was never really the point.

That's the trade, done right. It doesn't feel like losing because,

if you run it correctly, it isn't.

4. The paper.

The settlement is only as good as its language. You've agreed on a number and a structure.

Do not relax yet, because the last 5% of the work protects 100% of the value.

The settlement document needs, at minimum, full and final settlement language.

This matter is resolved, entirely, for the audited period and products.

A clean release. No reopening the same period next year under a new theory.

No retroactive application of new metrics to old agreements. payments.

Payment terms that respect your cash flow. Settlements can be structured across quarters. Ask.

And going forward, if you're signing a new agreement as part of the trade,

this is the single best moment you will ever have to fix the audit clause itself.

Notice periods, scope limits, tool transparency, a real response window,

your discount locked for future true-ups. You're at the table anyway.

The publisher wants to close. Every one of those protections is cheapest right now.

And then, the epilogue nobody performs.

The audit exposed exactly where your gates failed. The rogue purchases.

The unrecorded entitlements. The drifted deployments.

You now hold a professionally prepared map of your own weaknesses. And you paid for it.

Use it. Route the findings into your program.

Fix the gates that leaked. Fund the reconciliation that lapsed. Update the ledger.

The organizations that get audited badly twice are the ones that treated the

settlement as the end instead of the beginning.

Same publisher, three years later, same findings?

That's not bad luck. That's a subscription. Let's close the library doors on this one.

The inspector finished the walkthrough, and the late fee notice is spectacular.

Every book ever borrowed, at full retail replacement price, plus interest.

But here's what 40 years of library science teaches. The librarian doesn't actually

want your late fees. The librarian wants you borrowing more books.

So you sit down at the front desk, together, and you go through the notice.

These books were returned. Here are the stamps. These were never borrowed.

Check your own ledger. And these, fine. These we owe for.

And what do the late fees become? They get folded into next year's membership.

A bigger one, sure, but at member pricing, with the fine forgiven and the record cleared.

That's the settlement. It was never really about the fees. It was about keeping you in the library.

One closing principle, and with it, the two-parter's full arc.

Hardware asset management is a custody discipline. Software asset management

is an evidence discipline.

Audit defense, part one, is a process discipline. And the settlement?

The settlement is a commercial discipline.

The finding is an opinion with

a price tag attached, and opinions are negotiable. Price tags doubly so.

You don't win the endgame with indignation, and you don't win it with a checkbook.

You win it with a corrected count, a clear head about what the other side actually

wants, a leadership team that heard it from you first, and paper that closes the door behind you.

Custody. Evidence. Process. Commerce.

That's the whole game. Four words. Class dismissed.

And here's your homework. Do it before any letter ever arrives,

because that's the entire point.

This week, draft the one-page executive brief for your highest-risk publisher,

as if the findings landed tomorrow.

Four sections. What we own and can prove, where we think we're exposed,

and roughly what it's worth, who our single point of contact is,

and what our strategy would be.

One page. Put it in a drawer.

Because the difference between an organization that panics and an organization

that negotiates is that one of them wrote this page on a calm Tuesday,

and the other one is writing it at midnight with the publisher's VP already on the CFO's calendar.

Be the Calm Tuesday people.

Next episode, we follow the trail backward because every audit finding we just

fought about was born somewhere, and an awful lot of them were born in the shadows.

Shadow IT. The tools your business bought without telling you.

The servers nobody owns. The SaaS spend hiding in expense reports.

The episode I warned you might make your security team sweat.

It'll make your CFO sweat too. Bring a flashlight.

That's today's episode, and that's the two-parter, from the letter on the desk

to the ink on the settlement.

You now know more about surviving a software audit than most people who've been through three of them.

I'm Bill Van Nort. This is the Operational ITAM Podcast.

Correct the count. Make the trade.

Get the paper. And I'll see you in the shadows next week. Take care.