The letter is a position. So is your response.
A formal compliance notice from a Broadcom product team arrives on a Tuesday. The deadline is thirty days. The body of the letter cites the contract clause that grants audit rights and asks for entitlement reports across a list of products. The instinct in most buyer organisations is to comply quickly and quietly. The instinct is wrong. The exposure number that comes back at the end of an unmanaged audit is almost always between two and ten times the actual contractual position, because the data the buyer submits without preparation overstates use, understates entitlement, and gives the auditor every reason to assume the worst.
The first ten days are posture and process, not data. We establish single channel of communication. We acknowledge the notice on contract terms, not on the auditor's terms. We map the contractual entitlement base from signed paper, not from the seller's internal record, which is almost always different. We freeze ad hoc internal data exfiltration. Days ten through twenty we run the actual deployment reconciliation, two pass, so we can show the auditor what we will show before we show it. Days twenty through forty we negotiate the scope of the data exchange and the methodology that will be used to compute exposure. The headline number that comes back at the end of all that is usually between 60 and 85 percent below the opening assumption.
The settlement is not just a number. It is a closure document, a methodology of record, and a posture for the next compliance cycle. We negotiate all three. The closure document protects you from the same finding being reopened. The methodology of record stops the next auditor from picking a different counting rule. The forward posture, often a small remediation or restructuring, is what keeps the file closed instead of warm. We have not seen a properly closed audit reopened by a Broadcom team in the practice. We have seen plenty of poorly closed ones reopened inside twelve months.
Read the case below for one example on a Symantec multi product audit. Read the field notes for what the audit triggers look like this quarter. Then write to us, ideally before day five.