Reference · Audit defense · Issue I, MMXXVI.

The audit response checklist, day by day.

The one-page protocol the practice runs when a Red Hat compliance letter is in hand. What to acknowledge, what to preserve, what to count, and what not to volunteer — in order.
By The Buyer-Side Desk, an independent advisory practice. 190+ engagements, $180M+ recovered. Published
Abstract

The fourteen days after a Red Hat audit letter arrives decide more of the eventual settlement figure than the twelve months that follow. This checklist sets out the moves in order. Print it, assign an owner to each line, and work it top to bottom. Nothing here requires special tooling — it requires discipline about scope.

§ 1

Days one to three — contain.

  1. Log the letter. Record the date received, the channel it arrived through, and the stated response deadline. The clock that matters starts now.
  2. Appoint a single owner. One person controls all further contact with Red Hat — including the account team. Everyone else refers inbound questions to the owner.
  3. Acknowledge receipt, nothing more. Confirm the letter arrived and that a response will follow within the stated window. Do not discuss deployments, tooling, or history.
  4. Start document preservation. Freeze deletion policies on entitlement records, purchase history, subscription-manager output, hypervisor inventories, and prior Red Hat correspondence.
  5. Brief the account team channel. Instruct anyone with a Red Hat relationship: no informal calls about the audit. Friendly conversations become findings.
§ 2

Days four to seven — count privately.

  1. Reconcile entitlements against deployment. Build your own count — RHEL systems, OpenShift cores, Ansible managed nodes — before anyone builds one for you.
  2. Map the three surfaces. Check CentOS-era estates for legacy exposure, virtualization for counting mismatches, and OpenShift for growth beyond contracted capacity.
  3. Read the audit clause. The contract defines what Red Hat may actually request, in what form, and on what timeline. Scope beyond the clause is negotiable, not owed.
  4. Engage buyer-side counsel. If the estate is material, this is the week to bring in representation — before the first substantive response, not after.
§ 3

Days eight to fourteen — respond on your terms.

  1. Answer what was asked. Respond to the formal request precisely. Volunteered scope is the single most common self-inflicted wound in a Red Hat audit.
  2. Keep everything on the record. Written responses through the controlled channel. Requests made by phone get confirmed in writing before they get answered.
  3. File deliberately, not early. A response filed well inside the window signals preparation; one filed on day one signals an organization that answers before it thinks.
  4. Do not negotiate the finding yet. The first figure is an opening position. Settlement discussion starts after the methodology behind the figure has been tested.

If the letter is already in hand and the estate is material, the desk runs two analyst calls at no fee — the first within twenty-four hours. For the fuller treatment of the response window, see the fourteen-day response window, used well and the document preservation protocol.

§ 5 · Engagement

Engage before the response is filed.

Two analyst calls. No fee. We tell you what we would do, what the leverage actually is, and whether we are the right firm. If the audit notice is already in hand, the first call happens within twenty four hours.