The first seventy-two hours decide the outcome. Five opening moves for the moment the audit notice arrives.

Part one of two. The letter arrives — or, increasingly, the friendly invitation to a "SAM engagement" that is an audit wearing a nicer coat. What you do in the first seventy-two hours shapes everything that follows.

Bill lays out five opening moves: contain it, read the contract, control the terms, build your own position before you share anything, and control the data. Along the way: which publishers audit most aggressively, why third-party audit firms are paid by the vendor and what that means for you, why unverified script output drives more inflated claims than actual non-compliance does, and the single most expensive instinct in this situation — panic-buying licenses after the notice arrives, which frequently doesn't count toward the findings anyway.

Plus a listener question from Sandra in Grand Rapids on the soft-audit trap.

Part two picks up when the findings document lands.

IN THIS EPISODE

- The five opening moves for the first seventy-two hours
- Soft audits and "SAM engagement" invitations — the audit wearing a nicer coat
- What your contract's audit clause actually permits, and what it doesn't
- Why third-party audit firms are paid by the publisher, and what that changes
- Building your own license position before you share a single data point
- Controlling the data: what you provide, in what format, and what you never send
- Why unverified script output drives more inflated claims than real non-compliance
- The most expensive instinct in the room: panic-buying licenses after the notice
- Which publishers audit most aggressively, and what the current data shows

CHAPTERS

• (00:03) - Audit Defense Begins
• (02:11) - Audit Reality Check
• (05:10) - Five Opening Moves
• (08:00) - Negotiating Audit Terms
• (09:35) - Build Your Position
• (11:08) - Control the Data
• (13:29) - Settlement and Takeaways

Flexera 2026 State of ITAM Report — audit activity by publisher
https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

ISO/IEC 19770-1 — IT Asset Management Systems
https://www.iso.org/standard/68531.html

Audit incidence and publisher behavior in this episode is drawn from licensing advisory practice and from thirty years of firsthand audit response. Where a figure rests on industry survey data rather than primary research, it is stated as such on air.

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com