The first seven days after any Broadcom audit notice.

The first seven days after a Broadcom audit notice are the days that determine the financial outcome. We have run 28 formal audit defenses across Symantec, Carbon Black, mainframe, VMware and CA in the last 24 months. The variance in outcome between buyers who used the first week well and buyers who used it badly is large enough to be the single biggest lever in audit work. The good news is that the playbook for the first seven days is small. The bad news is that almost nobody on the buyer side has it memorised when the notice arrives.

This is the Desk's standing protocol for the first week. It is product agnostic. It applies whether the notice arrives by certified mail, by email from a regional Broadcom counsel, by escalation from a Broadcom audit team partner like one of the established compliance firms, or by an informal phone call from the account team that hints that a formal letter is on its way.

Day one: receive, log, and convene

The notice arrives. The first thing that should happen on day one is the most important thing that should happen all week. The notice goes to a named individual on the buyer side, that individual logs it with a date stamp and a copy in the legal hold system, and the named individual convenes the audit response group within 24 hours.

The audit response group is small. Procurement lead, legal counsel, the technical owner of the products under audit, finance, and an external buyer side advisor if one is engaged. It is not a town hall. It is not the IT operations team at large. The smaller the group, the cleaner the audit response. Every additional person in the room on day one is a person who can produce a statement that becomes a fact in the audit record later.

Day two: read the notice slowly

On day two the audit response group reads the notice together. Slowly. Most audit notices are three to seven pages. They contain four classes of content that need to be separated. The contractual basis the auditor is invoking. The scope of products and entities the auditor is asserting falls under audit. The timeline the auditor proposes. And the deliverables the auditor expects the buyer to produce.

Most buyers conflate the four. Most audit notices encourage them to. The defense playbook requires that the four be separated on day two and that the buyer's response to each be drafted independently. The contractual basis is a legal question. The scope is a technical and commercial question. The timeline is a negotiation. The deliverables are an information control question.

Day three: do not respond yet

Day three is the day buyers most often damage their own position. The instinct is to respond quickly to demonstrate good faith. The instinct is wrong. The Desk's protocol is that no substantive response goes to the auditor until the buyer side has completed its own internal entitlement audit and produced a clean baseline of what the buyer believes is licensed versus deployed.

"The buyer's worst day in an audit is almost always day three. Good faith is signalled by responding accurately, not by responding fast. We tell every client that a polite acknowledgement is the only thing that should go out before day seven."Audit Defender, The Desk

The polite acknowledgement on day three confirms receipt, confirms that the buyer is taking the matter seriously, identifies the buyer's point of contact, and requests a brief extension on the auditor's timeline to permit a proper internal review. The acknowledgement does not concede scope, does not concede contractual basis, and does not concede deliverables. It is two paragraphs long.

Day four and five: internal entitlement baseline

Two days are reserved for the buyer's internal entitlement audit. This is the work that should have been done in the 90 days before the notice arrived, and on most engagements it has not been. The two days are not enough to do a complete entitlement audit. They are enough to do a credible first pass that distinguishes products in clear compliance from products with material exposure from products that require deeper review.

The categorisation matters because the audit response strategy is different for each category. Products in clear compliance are responded to with full documentation and a fast close. Products with material exposure are negotiated with the auditor before any documentation is produced. Products that require deeper review are held back from the audit response entirely until the buyer has clarity on its own position.

Day six: shape the response to scope

On day six the buyer side and its advisors shape the response to the scope question. The scope the auditor asserts is almost always broader than the scope the contract supports. The buyer side reads the contract against the asserted scope and identifies the gaps. Entities not covered. Products outside the licensing term. Geographies the contract excludes. Affiliates the contract does not cover.

The scope conversation is the first place in the audit where buyer side leverage rebuilds. Every entity, product or geography the auditor concedes is outside scope is exposure that disappears from the financial exposure model. Across the 28 audits the Desk has defended, scope reframing alone has reduced asserted exposure by an average of 41 percent before any negotiation on the in scope items begins.

Day seven: respond with structure, not content

The day seven response is structured. It acknowledges the audit, accepts the auditor's process subject to the buyer's reservations, requests confirmation of contractual basis, proposes a refined scope, requests a revised timeline, and lists the deliverables the buyer is prepared to provide and on what conditions. It is three to five pages. It contains almost no technical detail. The technical detail follows in a second wave once the structure is agreed.

The structured response shifts the audit from a one way information request into a two way commercial negotiation. The auditor has not yet been told what the buyer is or is not licensed for. The auditor has been told what the buyer is willing to discuss, on what terms, and on what timeline. Every Broadcom audit we have defended has been substantially easier from the day seven response forward, and substantially harder if the day seven response did not happen this way.

The communications discipline that holds it all together

Every communication that leaves the buyer side during the first seven days passes through the audit response group. No exceptions. The technical owner does not respond directly to the auditor. The account manager on the buyer side does not respond directly to the auditor. The IT operations team does not respond directly to the auditor. The reason for the discipline is not legal posturing. The reason is that the audit record is built from the buyer's communications, and a single off message statement from a technical owner can become an admission the buyer spends three months walking back.

The Desk's standing approach is to route all auditor communication through a named procurement or legal lead, with the audit response group reviewing every outbound message before it leaves. The overhead is small. The protection is large. On every audit we have defended where this discipline held, the asserted exposure was reduced substantially. On the small number of audits where the discipline broke, usually because a well meaning technical owner answered an auditor email directly, the asserted exposure expanded by an amount that took weeks to recover.

What we have seen on live deals

On a regional bank's Symantec audit defended last year, the auditor's initial asserted exposure was $11.4M. The buyer ran the first seven day protocol with the Desk. The day three response was a single page acknowledgement. The day seven response was a three page structured letter. By day 21 the asserted scope had dropped by 47 percent. By day 90 the settlement was $2.1M. The bank continued to run Symantec endpoint and renewed the contract the following quarter on revised terms.

The takeaway

• The first seven days set the audit outcome more than any other window. Buyers who respond fast usually concede position. Buyers who respond carefully almost always recover position.
• The day three polite acknowledgement is the only substantive communication that should leave the buyer side before day seven. Anything more detailed leaks scope or concedes basis.
• The day seven structured response converts the audit from an information request into a commercial negotiation. The shift is the single biggest determinant of final settled exposure across the audits we have defended.