IBM Audit Defence: Italian Retailer Reduces €11.4M Claim by 91%

Client Overview and IBM Product Estate

The client is a multi-channel Italian retailer with brick-and-mortar stores across Italy, France, Spain, and three additional European markets, supported by a significant e-commerce operation. With roughly 6,800 employees and a complex omnichannel infrastructure, the company runs a centralised IT environment from Milan that supports store point-of-sale systems, inventory management, customer data platforms, and a B2B fulfilment portal.

The IBM product footprint at the time of audit centred on IBM WebSphere Commerce (the platform underpinning the e-commerce and B2B portal), IBM Db2 as the primary transactional database, IBM MQ for messaging between store systems and central data services, and a more recently adopted IBM Cloud Pak for Business Automation deployment to modernise invoice processing and supplier onboarding workflows.

The company had operated on IBM Passport Advantage since 2013. In 2020, it had transitioned the IBM MQ and a subset of Db2 workloads to a containerised deployment on a Red Hat OpenShift cluster as part of a broader application modernisation initiative. This transition — which created a mixed PVU and VPC environment — was the principal source of the audit complexity IBM exploited.

The Audit Trigger: PVU-to-VPC Transition Exposure

IBM's audit notice arrived in March 2022, covering the period from January 2019 to December 2021. The timing was deliberate: IBM was auditing the three-year period that spanned the company's application modernisation work, when the transition from PVU-based licensing to VPC-based licensing for containerised workloads created a window of compliance documentation gaps.

What IBM Targeted

IBM's audit team identified three primary exposure areas in its preliminary assessment. The first was the WebSphere Commerce deployment, which remained on physical and virtualised infrastructure with PVU licensing. IBM claimed that ILMT coverage had been incomplete during a six-month period in 2020, when the infrastructure team had been focused on the containerisation programme and had temporarily allowed ILMT agent maintenance to fall behind. IBM used this ILMT gap to assert full-capacity PVU pricing for the entire WebSphere Commerce estate during that period.

The second area was the Db2 deployment. IBM's audit team had identified multiple Db2 instances on the OpenShift cluster and counted them as requiring separately licensed VPC entitlements, without crediting the Db2 entitlements bundled within the Cloud Pak for Business Automation subscription against these instances. The Cloud Pak credit omission alone accounted for €3.1 million of IBM's total claim.

The third area involved the transition documentation for IBM MQ workloads moved from PVU to VPC. IBM claimed that the organisation had not correctly executed the PVU-to-VPC metric conversion process, resulting in the company holding PVU entitlements for workloads that now required VPC entitlements, and having deployed additional VPC capacity without corresponding VPC entitlements.

Building the Defence: ILMT Remediation and Evidence Construction

The ILMT gap claim for WebSphere Commerce was the most straightforward element to challenge. Investigation of the six-month ILMT gap period revealed that while automated ILMT scanning had partially failed due to a network segmentation change during the containerisation project, the infrastructure team had been generating manual hypervisor reports throughout the period that captured actual CPU allocation data for all VMware virtual machines running IBM software.

These hypervisor reports — while not ILMT-generated — provided contemporaneous evidence of sub-capacity usage during the gap period. IBM's position that ILMT gaps automatically mandate full-capacity pricing for the entire historical period is an aggressive interpretation of Passport Advantage terms that is rarely upheld when challenged with credible alternative evidence of actual sub-capacity usage.

We presented IBM with a package of 24 consecutive weeks of VMware vSphere performance data showing that WebSphere Commerce VMs had consistently operated on six to eight virtual CPUs out of a 32-core physical host. This evidence, combined with a written explanation of the ILMT disruption cause (network segmentation during an approved infrastructure project), successfully challenged IBM's full-capacity assertion for the WebSphere estate.

Cloud Pak for Business Automation: Correcting the Db2 Credit

The €3.1 million Db2 overclaim stemmed from IBM's failure to credit the Db2 entitlements included within the Cloud Pak for Business Automation subscription against the containerised Db2 instances running on the OpenShift cluster.

IBM Cloud Pak for Business Automation includes Db2 as a core bundled component under the VPC entitlement structure. The critical distinction — which IBM's audit team had ignored — is that Db2 instances running exclusively in support of Cloud Pak for Business Automation workloads on the Cloud Pak's designated OpenShift cluster consume entitlements from the Cloud Pak VPC allocation, not from a separate Db2 VPC licence.

We prepared a deployment mapping document demonstrating that each Db2 instance on the OpenShift cluster was deployed exclusively to support Cloud Pak for Business Automation workflows. The document included the Cloud Pak for Business Automation VPC entitlement certificates, the IBM License Service reports showing usage within the Cloud Pak cluster boundaries, and a configuration diagram showing the cluster segregation between Cloud Pak workloads and the (separately licensed) remaining application stack.

IBM accepted this evidence and withdrew the Db2 overclaim entirely, reducing the claim by €3.1 million in a single submission. This is a pattern we encounter frequently: IBM audit teams that construct claims without properly crediting Cloud Pak bundled entitlements. Organisations that do not understand their Cloud Pak entitlement rights will pay for products they have already licensed.

PVU-to-VPC Conversion Documentation Challenge

The IBM MQ metric transition challenge required more forensic work. The company's procurement team had worked through its IBM account team to transition IBM MQ licences from PVU to VPC as part of the containerisation project. However, the formal Passport Advantage metric conversion process — which requires specific documentation and agreement from IBM — had not been properly executed. The transition had been treated as a technical matter by the infrastructure team rather than a commercial licensing matter requiring IBM's formal sign-off.

This is one of the most common PVU-to-VPC transition mistakes. The technical deployment of a workload on an OpenShift container does not automatically convert the licensing metric from PVU to VPC. The Passport Advantage agreement requires that metric transitions be formally documented, and absent that documentation, IBM will treat the deployment as a new VPC entitlement requirement while the original PVU entitlements remain outstanding.

The good news in this case was that the company's IBM MQ PVU entitlements were in surplus relative to the pre-transition deployment footprint. The VPC requirement for the containerised IBM MQ workload, properly calculated using the IBM License Service reports, was smaller in cost terms than the PVU entitlements being retired. By formally documenting the metric transition retroactively — working with IBM's licensing team to create the correct Passport Advantage records — the company converted a claimed €1.8 million VPC shortfall into a recognised PVU surplus that partially offset the residual settlement.

Settlement: Using IBM's December 31 Fiscal Year

The negotiation reached its final phase in October 2022. IBM's fiscal year ends on December 31, and IBM account teams operating in Q4 are under significant pressure to close outstanding commercial matters before the year-end close. This creates a genuine settlement window for organisations that have managed their audit defence well — IBM is more willing to accept pragmatic settlement structures in Q4 than at any other point in the year.

The company had a pre-existing Passport Advantage renewal due in early 2023. We structured the settlement to incorporate the residual compliance shortfall into the renewal agreement, combining the settlement payment with a two-year subscription renewal at negotiated rates. IBM's commercial team was able to book the full renewal value — including the settlement component — against their Q4 targets, providing the commercial incentive to close before December 31.

Final Settlement Breakdown

The €1.03 million settlement comprised: a retroactive licence fee for the verified WebSphere Commerce gap period (calculated at sub-capacity rates using the vSphere evidence), a small IBM MQ VPC shortfall after offsetting the PVU surplus, and a modest amount covering ILMT gap administration fees waived from IBM's original claim. No penalties were applied. The settlement was integrated into a two-year Passport Advantage renewal that provided IBM with forward revenue visibility through to December 2024.

An audit moratorium of 30 months was included in the settlement agreement, protecting the organisation from re-audit through early 2025.

Lessons for European Enterprises Running IBM Workloads

This engagement illustrates three IBM audit vulnerabilities that are particularly common among European enterprises undertaking application modernisation programmes. The first is ILMT maintenance disruption during infrastructure projects — organisations that allow ILMT coverage to lapse during major infrastructure changes create the most straightforward full-capacity claims for IBM's audit teams.

The second vulnerability is Cloud Pak entitlement credit failures. IBM Cloud Paks bundle significant IBM software capabilities under a VPC subscription model. Organisations that fail to track which bundled entitlements apply to which deployments routinely find themselves paying IBM twice for the same capability.

The third is the PVU-to-VPC transition documentation gap. The move to containerised IBM workloads is a technical and a commercial event. Organisations that treat it purely as a technical migration without completing the formal Passport Advantage metric conversion process give IBM grounds to assert shortfalls on both the legacy PVU metric and the new VPC metric simultaneously.

For IBM audit defence support across European jurisdictions, or for assistance with ILMT implementation and PVU-to-VPC transition documentation, see our IBM Knowledge Hub or contact our IBM advisory team directly.