After the settlement, keeping the next audit from finding you.
Red Hat post settlement monitoring and true up protocol is the operating discipline that runs in the months and years after the audit closes and prevents the settlement from quietly unwinding into the next audit cycle. Once the settlement letter is signed, the customer has roughly thirty days to absorb the remediation, ninety days to stand up a quarterly reconciliation rhythm, and twelve months to demonstrate that deployment has stopped drifting beyond entitlement. This note treats the monitoring cadence, the true up protocol, and the governance that keeps a settled audit settled.
Why monitoring matters after settlement.
Red Hat post settlement monitoring is the operating discipline that determines whether the settlement holds across the years that follow. A settlement letter typically resolves the past and resets the entitlement baseline; it does not freeze the deployment. Workloads continue to grow, new clusters spin up, mergers and acquisitions add inherited estate, and the same drift that produced the original audit exposure can produce a fresh exposure inside the next renewal cycle if no one is watching the gap between entitlement and consumption.1
The parent service note on Red Hat audit defense treats the defense itself; the present note treats what runs after the defense closes. The companion notes on the internal audit readiness program and audit document preservation protocol treat the readiness and records discipline that the post settlement protocol draws on. Without that scaffolding, the monitoring cadence has no inputs to reconcile against and no records to defend the reconciliation when the next account team asks.
The quarterly reconciliation cadence.
The post settlement protocol runs on a quarterly cadence. Each quarter the customer pulls a fresh deployment inventory from the same sources used during the audit defense (hypervisor exports, subscription-manager output, Smart Management inventory, cloud marketplace billing, OpenShift cluster manifests) and reconciles it against the entitlement position established by the settlement letter and any post settlement additions. The deltas are categorised as in compliance, within tolerance, exceeding entitlement, or under entitlement, and each category drives a defined response.2
The quarterly reconciliation is a single page summary that the platform owner, the procurement lead, and the licensing analyst sign off on; it produces the input to the next true up decision and to the renewal forecast. The companion note on the day by day audit defense timeline treats the cadence during a live defense; the same operational muscles do the work in the post settlement period, just on a calmer schedule.
| State | Definition | Response |
|---|---|---|
| In compliance | Deployment at or below entitlement | File the report, no action |
| Within tolerance | Within five percent buffer | Watch; plan for true up |
| Exceeding entitlement | Above buffer threshold | True up at renewal or interim |
| Under entitlement | Material unused subscriptions | Mark for renewal reduction |
The true up protocol, when and how.
The true up protocol governs how the customer closes a gap between deployment and entitlement once one is identified. The default cadence is at renewal: the customer documents the gap, sizes the additional entitlement needed, negotiates the additional subscriptions inside the renewal envelope, and books them with the rest of the contract. The interim cadence is mid term: where the gap is material and growing, the customer initiates a mid term true up with the account team rather than waiting for the renewal date, on the principle that voluntary disclosure inside an existing relationship typically prices better than involuntary disclosure inside an audit.3
The protocol defines what the customer discloses and what stays inside the reconciliation file. Disclosure is calibrated to the gap, the contract language, and the customer's broader posture; the records that feed the disclosure stay under the records discipline that the audit defense established. The companion note on the audit clause anatomy and negotiation treats the contractual frame that determines how the true up conversation begins and what reporting obligations the customer carries forward from the settlement.
The cross link into RHEL BYOL versus pay as you go on cloud is relevant when the deployment has migrated portions of the estate into cloud marketplace billing since the settlement; the true up math runs differently on BYOL than on PAYG, and the post settlement protocol has to reconcile both streams. The sibling note on mid renewal audit mechanics treats the parallel case where Red Hat initiates an audit inside the renewal window rather than the customer initiating a true up.
Internal governance and reporting.
The post settlement protocol depends on internal governance that survives the staff turnover, organisational changes, and platform shifts that typically unfold across a renewal cycle. The governance structure assigns a named owner for the quarterly reconciliation, a reporting line into procurement and finance, a defined escalation path when the reconciliation flags an exceeding entitlement state, and a record in the records management system that preserves the inputs and the sign offs.4
The reporting cadence into the executive sponsor is typically biannual: a one page summary of the quarterly results, the cumulative gap to entitlement, the projected true up cost, and the renewal envelope it will land in. The sibling note on preparing the board for audit disclosure treats the upward reporting threshold that distinguishes operational reporting from material disclosure; the post settlement protocol's governance avoids ever needing the upward report by catching the drift before it crosses the materiality line.
The first twelve months set the pattern.
The first twelve months after settlement are the highest risk period and the highest leverage period. The audit defense is fresh in the institutional memory, the records discipline is at peak rigour, and the account team is paying attention. The window closes quickly: by month eighteen the staff that ran the defense have rotated, the records discipline has decayed, and the next entitlement gap is forming. The protocol's first year operating tempo determines whether the discipline becomes routine or evaporates.
The practice's recommended first year sequence is: month one absorbs the remediation actions in the settlement letter and stands up the records preservation tail; month three completes the first full quarterly reconciliation; month six produces the first executive sponsor report; month nine identifies any true up that will flow into the next renewal; month twelve closes the first year file and opens year two. The parent practice note on RHEL licensing treats the product side that the protocol orbits across the cycle.
How the practice helps run the protocol.
The practice helps customers stand up and run the post settlement monitoring and true up protocol through a retained advisory relationship that runs alongside the customer's internal teams. The first quarterly reconciliation is typically run jointly; subsequent reconciliations are run by the internal team with the practice on call for escalations, true up negotiations, and renewal posture. The retainer protects the institutional memory of the defense and preserves the documentary scaffolding that the next renewal cycle draws on.
Across post settlement engagements in the practice's trailing twelve months, customers running the structured monitoring and true up protocol experienced materially lower entitlement drift and entered their next renewal cycle with a defensible position rather than an exposure. If the settlement letter is recently signed, the first useful hour is a call with the desk to scope the first year sequence. The sibling notes on audit defense by deal size, audit after acquisition inherited exposure, and dev test environment audit exposure treat the operational levers the protocol draws on.
Notes & references
- 1. Drift mechanics. Settlement letters reset the entitlement baseline but do not freeze deployment; the same drift that produced the original exposure can produce a fresh exposure inside the next renewal cycle.
- 2. Quarterly reconciliation. The customer pulls a fresh deployment inventory each quarter and reconciles it against the post settlement entitlement position; deltas are categorised and each category drives a defined response.
- 3. True up protocol. The default cadence is at renewal; the interim cadence is mid term where the gap is material and growing; voluntary disclosure typically prices better than involuntary disclosure inside an audit.
- 4. Governance scaffolding. The protocol depends on a named owner, a reporting line into procurement and finance, a defined escalation path, and a record preserved in the records management system.
- 5. First twelve months. The first year after settlement sets the operating pattern; the second year sees institutional memory decay if the discipline has not become routine.
Preparing a response? The practice keeps a one-page Red Hat audit response checklist — what to acknowledge, what to preserve, and what not to volunteer in the first fourteen days after the letter arrives.