The word audit is often used loosely. In practice Oracle pursues compliance through two distinct channels. The informal channel is the soft audit, sometimes called a script review or a deployment check. The formal channel is the hard audit, sometimes called a contractual audit or an Oracle LMS review. The two channels look similar from a distance and behave very differently up close.
Understanding which channel you are in is the first step of any defence. This article is a companion to our audit defence pillar and supports our audit defense service.
The Soft Audit Defined
A soft audit is an informal compliance inquiry initiated by Oracle's account team, often through the customer's Oracle account manager. It is not a formal exercise of the audit clause in the contract. It does not have a contractual notice. It does not have a contractual response timeline. Participation is voluntary in a technical sense.
The typical soft audit begins with a friendly request from the account manager. The wording varies but the pattern is consistent. The account team wants to run a quick check on the deployment, validate the licence position, share new tools that simplify licence management, or prepare for an upcoming renewal. The request is framed as a helpful service.
The output of the soft audit is a report. Oracle's account team produces a deployment summary, identifies gaps between the deployment and the licensed position, and presents the gaps as a commercial opportunity. The customer is offered a chance to close the gaps through purchase before the situation escalates.
The Hard Audit Defined
A hard audit is a formal exercise of the contractual audit clause. It begins with a written audit notice from Oracle, often signed by Oracle's License Management Services team or by an external audit partner acting on Oracle's behalf. The notice cites the audit clause in the contract and specifies the audit scope, the products covered, and the data request.
The hard audit follows a defined contractual process. The customer has obligations under the audit clause. The audit team has rights under the same clause. The output is a formal audit report identifying compliance gaps and a settlement proposal that converts the gaps into a financial demand.
The hard audit is conducted by people whose job is audit. They have audit tools, audit methodology, and a measured incentive structure. The conversation has the texture of a formal compliance exercise rather than a sales conversation.
How Oracle Chooses the Channel
The choice between soft and hard audit is driven by Oracle's commercial judgement. Soft audits are cheaper to run, faster to conclude, and more likely to produce a commercial outcome that benefits the account team's quota. Hard audits are slower, more expensive, and produce a settlement that often goes to a different Oracle business unit.
Account teams generally prefer soft audits because they retain control and capture the commercial outcome. License Management Services prefers hard audits because they produce settlements that flow to the LMS quota. The choice is sometimes contested internally and the customer's posture can influence which channel is selected.
Customers that respond cooperatively to a soft audit typically remain in the soft channel. Customers that refuse to engage often escalate to the hard channel. The threat of escalation is the lever the account team uses to keep the soft conversation going.
The Voluntary Nature of the Soft Audit
The single most important fact about a soft audit is that participation is voluntary. The contractual audit clause has not been invoked. There is no obligation to share deployment data, run scripts, or accept findings. The customer can decline to participate without breaching the contract.
Most customers do not decline. The reasons are partly relationship management and partly fear of escalation. Declining feels confrontational. Participating feels cooperative. The cost of cooperation is the data the customer reveals, which Oracle uses both in the soft audit conclusion and in any later hard audit if escalation does occur.
The soft audit is a sales tool that generates negotiation leverage for an upcoming renewal or renewal cycle. Customers who treat it as a benign deployment check rather than a commercial event consistently end up with worse outcomes than customers who treat it as the first phase of a commercial negotiation.
The Audit Clause Mechanics
The hard audit clause in standard Oracle contracts gives Oracle the right to audit the customer's deployment with a defined notice period, usually 45 days. The audit can cover a defined scope of products. The customer is obligated to provide reasonable access to systems and records.
The clause has limits. The audit must be reasonable. The audit cannot disrupt the customer's business. The audit data must be used only for compliance purposes. The audit findings must be specific to the contractual licence position rather than to Oracle's interpretive policies that were not part of the contract at signing.
The buyer side defence often turns on these limits. The audit team's data request is rarely as narrow as the clause requires. The methodology often relies on policies that postdate the contract. The findings often reflect Oracle's current view of virtualisation, cluster definition, or named user counting rather than the contractual text. Each of these is a defensible position when challenged.
The Response Posture for a Soft Audit
The recommended posture is to convert the soft audit into a structured commercial conversation rather than a deployment check. The conversation should be moved to the procurement or vendor management function rather than left with the technical teams. Information requests should be evaluated against the principle that voluntary disclosure can be used against the customer later.
The customer should request that Oracle put any compliance position in writing. Verbal claims about gaps should be challenged. Documentation should be requested for any policy claim. The methodology used to derive any number should be questioned.
The customer should also retain an independent audit defence advisor at this stage. The advisor's role is to challenge Oracle's methodology, validate the customer's deployment data before any of it is shared, and provide a counterweight to Oracle's commercial pressure.
The Response Posture for a Hard Audit
The response to a hard audit is more procedural. The audit notice should be reviewed against the contractual clause. The scope should be confirmed in writing. The methodology should be agreed before any data is shared. The customer's right to validate findings should be preserved.
The customer should never accept the auditor's tools without review. Oracle's scripts collect data the auditor will use to make findings. The data should be collected by the customer, validated against the customer's own inventory, and shared only after validation. Raw script outputs should not be sent to the auditor without review.
The settlement conversation should be approached as a negotiation. The audit findings are a starting position rather than a closing position. The customer's defence should address each finding with documentation, methodology challenges, and contractual interpretation. Most audit settlements are negotiated down materially from the original demand.
The Escalation Path from Soft to Hard
Soft audits escalate to hard audits when the soft conversation does not produce a commercial outcome. The trigger is often a refusal to engage, a refusal to accept the gap analysis, or a refusal to discuss a commercial settlement of the soft findings.
The escalation is not always immediate. Oracle often gives the soft conversation several months to mature before formalising. The customer can use the runway to prepare internally, validate the deployment, and assemble the negotiation team. A formal audit that begins when the customer is prepared is much easier to defend than one that begins cold.
The buyer side approach is therefore to use the soft audit period as preparation rather than as resolution. The longer the soft phase runs, the more time the customer has to build the defensive position before the formal channel opens.
Where to Read Next
For settlement strategy see our audit settlement article. For indirect access exposure see indirect access audit defense. The Oracle Audit Defense Handbook covers the full methodology across 48 pages. The perpetual licences deal page covers the contractual framing. The Oracle Database product page covers the product most often at the centre of audit findings.