How to beat Oracle licence audits

The prospect of an Oracle licence review can be scary. Despite the best efforts of your business, substantial costs on software asset management (SAM) and an eye-watering amount paid to Oracle every year, your sinking heart knows the audit will result in a huge and unexpected demands.

But what are Oracle’s audit rights? And can it really come in at any time and search your systems for evidence of non-compliance? Despite Oracle’s $170bn might, and a 39-year history in which to have fashioned the toughest contracts to its benefit, the truth is that Oracle’s audit rights are weak and ambiguous. And they do not give it the rights that its licence management service (LMS) team and CIOs assume.

A new study from Cerno offers eight reasons why it is you, rather than Oracle, in the driving seat. You should consider whether these reasons can be used to respond to a demanding call from a dominant Oracle to allow its personnel in for a wide-ranging audit.

Firstly, Oracle has no right to enter your premises. UK and US laws give strong protection to the rights of individuals and businesses to protect and control their property. The laws continue to follow a 1765 case, when it was declared: “Our law holds the property of every man so sacred, that no man can set his foot upon his neighbour’s close without his leave.”

Rights to enter can therefore never be assumed, and this is not in Oracle’s contracts.

If you volunteer to give permission to the Oracle LMS to come into your datacentre, it is recommended that consent is given in writing and strictly limited to the rights in the audit clause.

Oracle’s audit right is also limited to checking your use of programs, but there is no mandatory format (“Upon 45 days’ written notice, Oracle may audit your use of the programs”).

“Audit” just means checking or examining your records or evidence as to usage. There is no contractual obligation to run specific scripts, and if you can deliver the information in another robust and credible format, that would be enough. Surprisingly, the audit is of your use of programs, and not a demand to produce the licences you hold.

Equally important is that it is not to be an audit of your infrastructure, or indeed areas or clusters where you are not using the programs. There are continuing doubts over Oracle’s rights to demand licence fees for all processors in virtualised clusters, and this should be considered and accommodated in any response you give as to “use” of the programs.

It is also important to focus on the specific word “audit”, which is not defined in Oracle’s licence definitions and rules. Therefore, it must be given its ordinary and natural meaning, “A systematic review or assessment of something”, as stated in Oxford dictionaries.

What does this tell us? An audit is against pre-existing material. It is not a report created from scratch. Indeed, it is also not a licence review. For Oracle customers, the legal process to follow the contract should be:

• The licensee itself prepares its own report, backed up by evidence such as screenshots and any scripts it chooses to run.
• It then makes these available to Oracle.
• Oracle then “audits” that material.
• Oracle may reasonably ask questions to determine areas of uncertainty.

Oracle’s audit rights lack any detail as to how the licensee needs to respond. The obligation is to give “reasonable assistance” and, by implication, any response by your organisation should be enough to permit Oracle to check that your response is adequate as to use of the programs. There is no legal obligation to use Oracle Measurement Tool, complete its questionnaire, or use its other third-party verified tools.

Even though Oracle habitually calls in outside consultants for “licence reviews”, such as Garmendia Consulting, it is not your contractual obligation to accept this. Your obligation is to assist “Oracle”, which means the specific Oracle group company named in your Oracle Master Agreement, not necessarily third parties.

You should also take your time considering how best to respond to an audit notification, and in what form. Legal proceedings simply do not follow after 45 days.

One worry is, if you are in breach of permitting the audit within Oracle’s 45-day time period, what will it do? Can it injunct you? Will it immediately issue High Court proceedings? The answer is no.

In the UK, the High Court expects that parties must first seek to settle cases with exchanges of information, without issuing legal proceedings, and, preferably, with  consensual mediation first. There are very damaging cost consequences if legal proceedings are undertaken without this process being fully exhausted first.

This means that despite increasingly agitated letters threatening “escalation”, and even alarming solicitors’ letters, Oracle almost never takes the final step of issuing court proceedings against its licensees, except in clear cases of piracy or counterfeiting. Take your time to consider how best to respond to an audit notification and in what form, as legal proceedings simply do not follow after 45 days.