Early Audit Defense – a Valuable Strategy

The challenge

An investment firm based in a country without a strong history of auditing practices was threatened with an Oracle audit.

The firm is the holding company for multiple subsidiaries, some of which it owns outright, and some of which it owns only a portion of. Each subsidiary has its own IT team, but the holding company centralizes major IT investments for all the organizations within its portfolio, including Oracle ERP as part of Oracle’s E-Business Suite. The firm sold its Oracle licenses only to wholly owned subsidiaries (and not those in which they owned a partial share), in accordance with Oracle’s guidelines.

The firm hired a new CEO committed to expanding the company’s marketing footprint. The marketing efforts showcased all subsidiaries – even those in which the firm had only a partial stake. Following this campaign, the firm received an audit threat from Oracle.

Oracle came at the firm aggressively and assumed it was selling licenses to all its subsidiaries and was therefore out of compliance. Additionally, because many of the subsidiaries the business owned were in the service industry, such as hotels and restaurants, Oracle mistakenly assumed the businesses had many employees who were using its software.

The situation was complicated because the business was located in a country with no tradition of audits (until recently, it had been illegal for vendors to audit at all) and weak intellectual property laws. The firm recognized that it had no experience in navigating an Oracle audit and therefore needed help.

A long-standing partner of the firm recommended that it reach out to us for assistance with the Oracle auditing process. Following an initial meeting, the firm immediately gained confidence that working with
us would be beneficial and contracted with us before cooperating in any way with Oracle.

Our solution

Oracle’s reputation as a threatening, aggressive vendor preceded it, and the firm – by then our client – wanted to ensure it didn’t succumb to Oracle’s up-sale tactics. The firm found Oracle’s approach highly offensive (their confrontational style did not mesh with the national culture of which the firm is a part). The firm immediately wanted to limit its relationship with Oracle based on those tactics alone. We understand Oracle’s culture because most of our leadership team formerly worked at Oracle. Our client was well aware of this when they contracted with us.

Working with us resulted in our client gaining the upper hand in negotiations with Oracle, and getting much better rates for its Oracle usage than it would have otherwise.

We began by reviewing all the firm’s emails and licenses, and provided instructions on how to prolong the audit process to gain leverage over Oracle. During that process, the firm found that they actually had multiple instances of Oracle for which they had no need. We enabled the firm to pinpoint the number of licenses it was actually using. As a result, the firm actually shut down a number of unnecessary instances.

The firm found it could uninstall some of its Oracle instances. It also changed the default setting on its Oracle software so that premium components and features of Oracle software could not be automatically installed.

This extensive documentation process enabled the company to be resolute in its statements of just what it was using and what it wasn’t. It came to the conclusion that it was largely in compliance and an audit would not result in the significant fine the company had been concerned about.

The outcome

The outcome of working with us was that the firm responded robustly to Oracle. They gained the upper hand in negotiations with Oracle. This resulted in the firm getting much better rates for its Oracle usage than it would have otherwise. Ultimately, the firm got a significant discount that saved it at least $1.5 million. The firm has continued to use us as a consultancy partner to ensure its Oracle usage stays in compliance.

Is Oracle threatening you with an audit and you’re not sure how to respond?