Day by day audit defense, from notice to settlement.

An audit notice from Red Hat or its agents arrives in writing on a specified day. The day the notice arrives is D plus 0. The first three days are not about gathering evidence; they are about preserving optionality. The defended customer logs the notice with date and time stamp, identifies the contracting entity the notice is addressed to, identifies the actual contract that governs (which is frequently not the contract the audit team named in the notice), and engages legal and procurement leadership before any communication with the audit team. The technical team is informed but is not yet authorised to communicate externally.1

The practice's reading is that the single most common error in the first three days is technical staff replying directly to the audit team's request with raw data dumps. Once raw data has been sent, the audit team's reach into that data is functionally permanent and the defensive options narrow materially. The defended customer holds direct communication until the framework is in place. The parent service note on Red Hat audit defense treats the general posture; the present note treats the operational timeline.

Days three through fourteen are the framework phase. The defended customer assembles the contract package (the master agreement, the order form, the audit clause, any negotiated addenda); maps the workloads in scope (which contracts cover which workloads); identifies the audit team's actual scope of authority (which contracts the audit team is authorised to examine and which fall outside); and drafts the first written reply that frames the engagement. The first written reply is the most consequential document in the defense after the contract itself.

The first written reply acknowledges the notice, identifies the controlling contract and audit clause, sets out the customer's understanding of scope, requests any clarification the audit team's notice did not address, and proposes a working timeline for evidence exchange. The reply is courteous and substantive; the audit team's view of the defense's seriousness is partly set in this reply. The companion notes on the 14 day response window used well and responding to a compliance letter treat the reply mechanics.

Days fourteen through forty five are the evidence phase. The defended customer assembles the curated evidence productions, drafts the accompanying memoranda, and exchanges productions with the audit team on the agreed schedule. The productions cover whichever evidence types the audit clause permits the audit team to request: typically a curated vCenter or hypervisor inventory, a structured subscription-manager aggregation, and any contract or invoice data the audit team has requested. Each production is accompanied by a memorandum that frames the production and pre answers likely audit team questions.

The companion notes on vCenter host inventory, KVM and Proxmox evidence, subscription-manager output, and container image scans each treat the production posture for the relevant evidence type. The day fourteen to day forty five window is the work intensive phase of the defense; the framework set up in the prior phase pays off here.2

Days forty five through sixty are the findings phase. The audit team issues its initial finding letter, which states the calculated shortfall (in entitlements or in dollars), the basis for the calculation, and the audit team's proposed remediation. The defended customer reads the finding letter carefully against the evidence productions, identifies any computational errors in the audit team's calculation, identifies any scope expansion the audit team has attempted, and identifies any contractual terms the finding letter does not address.

The companion note on reading the settlement letter treats the finding letter mechanics in depth. The defended customer's first reading is calm and analytical; the finding letter's number is almost always materially larger than the settlement number, and the gap is where the defense's work goes in the next phase.

Days sixty through seventy five are the negotiation phase. The defended customer files a counter position that addresses the finding letter point by point. The counter position cites the audit clause's scope, references the evidence productions, identifies the calculation errors, and proposes a counter number with reasoned support. The counter is typically a substantial fraction of the finding letter's number; the gap between them is the settlement envelope.

The companion note on settlement negotiation leverage treats the negotiation mechanics in depth. The defended customer typically also surfaces commercial considerations during the negotiation phase: the customer's renewal calendar, alternative product roadmap, and other contract economics that the audit team's commercial counterparts care about. The audit team's settlement authority is usually wider than its evidence authority; the negotiation phase frequently closes on commercial rather than strictly technical grounds.

Days seventy five through ninety are the settlement phase. The parties agree to the settlement number, document the settlement in a settlement letter or contract amendment, and execute the remediation (which is typically a true up purchase, a credit against renewal, or a combination). The settlement letter is reviewed carefully against the audit clause's remediation language; the defended customer ensures that the settlement language does not extend audit reach into future contract terms and does not create new audit triggers.

The companion note on post audit posture treats the protection of the next contract; the audit defense ends with the settlement letter, but the next renewal begins immediately afterward. The cross link into Lane 11 on Red Hat Advanced Cluster Security pricing is relevant when the settlement includes ACS or other adjacent products; the broader OpenShift portfolio frequently appears in settlement structuring.

The practice runs the day by day timeline as a structured engagement with named owners for each phase. The framework phase is owned by legal and procurement leadership with practice support; the evidence phase is owned by technical staff under the practice's coordination; the findings and negotiation phases are owned by commercial leadership with the practice in active negotiation; the settlement phase is owned by legal and procurement leadership signing the documents. The practice maintains the schedule and ensures each phase closes cleanly into the next. The parent practice note on RHEL licensing treats the product side that the timeline orbits.

Across audit defenses in the practice's trailing twelve months that ran the structured timeline, settlements consistently closed at lower percentages of the initial Red Hat finding and at lower fractions of the calendar elapsed than defenses that ran ad hoc. If the audit notice is in hand, the first useful hour is a call with the desk. The companion notes on audit clause anatomy, vCenter host inventory, and subscription-manager output treat the operational levers the timeline draws on.

Preparing a response? The practice keeps a one-page Red Hat audit response checklist — what to acknowledge, what to preserve, and what not to volunteer in the first fourteen days after the letter arrives.