Oracle Audit Defence Timeline Builder that generates the day-by-day buyer-side audit defence plan from the 45-day Oracle notice through closeout — milestones, owners, deliverables, and the forensic evidence pack at every stage.

How the Oracle audit defence timeline builder works

The Oracle audit defence timeline builder generates the day-by-day buyer-side audit defence plan from the date Oracle's formal audit notice arrives. Oracle's audit clause typically allows 45 days from notice to data submission — but the buyer-side defence work starts the day the notice lands. The timeline is built around five phases: legal and contractual response (days 0–10), evidence-pack assembly (days 10–35), Oracle data exchange (days 35–60), Oracle's findings and back-licence claim (days 60–120), and the negotiated closeout (days 120–270).

The audit type drives the milestone profile. An LMS or GLAS database audit centres on USMM script output, Options usage, and Core Factor application. A Java audit centres on Java Management Service telemetry, MOS download logs, and the contractor/employee count under the Employee Metric. A post-ULA audit centres on the certification deposit, the deployment scope at certification, and any post-certification expansion. A VMware audit centres on the soft-partitioning scope claim — see the VMware compliance risk score for the methodology.

Estate size scales the timeline. Small estates compress the evidence-pack window. Enterprise estates with multi-region deployments and multiple Oracle product lines extend the evidence-pack assembly into the second 45-day extension window — which Oracle's audit clause typically allows on written request. For the forensic methodology and the evidence-pack template, see the Oracle audit defence service and the Oracle audit defence guide.

The five phases of a buyer-side Oracle audit defence

Every Oracle audit defence moves through the same five phases. The buyer-side work in each phase:

• Phase 1 — Legal and contractual response (days 0–10). Acknowledge the notice in writing, request the contractual basis under the OMA/OLSA audit clause, request the scoping document, confirm the auditor identity (Oracle LMS, GLAS, or third-party), and freeze any Oracle Sales engagement. Do not run any Oracle scripts in this phase.
• Phase 2 — Evidence-pack assembly (days 10–35). Build the forensic deployment inventory using internal tooling — not Oracle's USMM scripts. Confirm the licence position from Order Forms, OMAs, OLSAs, and Schedules. Document the deployment architecture, soft-partitioning evidence, cloud-counting compliance, and any historical certifications. Identify the gaps between licensed and deployed. Pre-compute the back-licence exposure and the buyer-side defensible position.
• Phase 3 — Oracle data exchange (days 35–60). Submit the evidence pack to Oracle. Push back on any USMM script request that exceeds the contractual audit scope. Refuse any Java Management Service telemetry submission. Limit data flow to the contractually required minimum. Document every Oracle data request in writing.
• Phase 4 — Oracle's findings and back-licence claim (days 60–120). Receive Oracle's draft findings. Challenge every line item: scope claims, Core Factor application, soft-partitioning expansion, Options usage attribution, Java Employee Metric interpretation. Push back in writing. Force Oracle to substantiate every claim from primary evidence — not from script output interpretation.
• Phase 5 — Negotiated closeout (days 120–270). Close the audit at the defensible position. Oracle's standard closeout move is a "settlement" that converts the back-licence into a forward cloud commit or ULA. Refuse the conversion. Close the audit at zero or near-zero back-licence on the merits of the evidence pack. Do not commit forward in exchange for closing the audit.

The buyer-side defence team is a triangulated unit — legal, procurement, and a forensic audit-defence partner. See the Oracle compliance review service for the proactive version of this work, which is to build the evidence pack before the audit notice arrives.

What Oracle's LMS and GLAS audit teams look for

Oracle's License Management Services (LMS) and Global Licensing and Advisory Services (GLAS) audit teams have a defined target list in every audit. The buyer-side defence needs to address each:

• Database Options usage not separately licensed. The most common audit finding. Oracle's USMM script captures Options usage in the Database. Advanced Security, Database Vault, RAC, Partitioning, Active Data Guard, and Diagnostic and Tuning Pack are each separately licensable. Buyer-side defence: prove the usage was inadvertent or was discontinued before the audit period.
• NUP minimum thresholds breached. Named User Plus licensing requires a minimum 25 users per Processor for Database Enterprise Edition. Many audits surface NUP estates that fail the minimum. Buyer-side defence: prove the minimum was met or convert to Processor metric retroactively.
• Soft-partitioning scope expansion. Oracle's audit team targets VMware estates aggressively. See the VMware compliance risk score.
• Java SE usage without Universal Subscription. The Java audit playbook targets organisations that downloaded Oracle JDK after the April 2019 licensing change. Buyer-side defence: prove only no-charge Oracle JDK versions were in use, or that migration to OpenJDK closed the exposure. See the Oracle Java licensing guide.
• EBS / PeopleSoft module mis-licensing. Oracle Applications audits surface module usage exceeding the licensed scope — typically advanced HR modules, advanced financials, or analytics. Buyer-side defence: prove the module access was incidental or remediate inside the audit window.

For the audit-defence playbook for each scenario, see the Oracle audit complete guide.

Anonymised case: $8.3M Oracle audit claim defended to zero

A European retail group received a GLAS audit notice covering Oracle Database EE, Options, and WebLogic Server across a multi-country estate. Oracle's initial findings asserted $8.3M in back-licence plus $1.5M in unpaid support — driven by Options usage attribution and VMware scope expansion. We engaged on day 3 of the 45-day notice window, built the forensic deployment inventory in the first 30 days, refused Oracle's USMM script in favour of a customer-controlled inventory, and pushed back on every Options attribution line item. The Options usage was traced to a single development cluster that had been decommissioned 14 months earlier — outside the audit period. The VMware scope claim was refuted with documented "must" affinity rules. After 7 months of forensic audit defence, Oracle closed the audit at zero back-licence and zero unpaid support. The defence cost was a single-digit percentage of the original claim.

For comparable audit-defence outcomes, see the Oracle Licensing Experts case study library.

Related guides and tools