What to do in the first 48 hours after an audit notice.

The first two days after an audit notice arrives set the tone for everything that follows. The seven day notice clock starts immediately, but the most consequential mistakes are made long before day seven. They are made in the first 48 hours, in the reflex to be helpful, to answer quickly, and to prove there is nothing to worry about.

This is a short window with long consequences. Nothing you do in the first two days will win the audit, but several things you might do can lose ground that is expensive to recover. The aim is containment, not resolution. Slow the process, protect the record, and avoid the early concessions that the vendor's process is designed to collect.

Hour one: stop the informal replies

The instinct on receiving a notice is to forward it to the people who run the systems and ask them to look into it. That instinct, unmanaged, is how the first damage is done. An administrator who answers a technical question, a manager who confirms a headcount, or an architect who describes a deployment on a call is creating data the vendor can build on. Before anyone responds to anything, declare a single point of contact and instruct the organization that no one else communicates with the vendor. Why one channel matters is set out in choosing a single controlled channel during an audit.

Hour two: preserve, do not purge

It can be tempting to clean up the estate the moment a notice lands: delete dormant accounts, decommission idle servers, tidy the user tables. Resist this. Altering systems after a notice can look like spoliation and can undermine your credibility when you later argue that those very accounts should never have been counted. Preserve the current state, document it, and make your arguments about dormant and service accounts through reconstruction and evidence rather than deletion. The legitimate way to remove those populations from the count is analytical, not operational, and it is described in building an effective license position before the vendor script runs.

Hours three to twelve: read the clause

Locate the agreement and read the audit clause as written, not as the notice characterises it. Confirm what the vendor is actually entitled to. The contract typically grants seven days notice and the right to copy relevant records, and treats compliance as the sole responsibility of the licensee. It does not usually grant a right to install measurement tooling on demand, to interview staff without scope, or to receive every export the moment it is requested. The gap between the contractual right and the opening ask is where you hold the line. The boundaries are covered in what OpenText can and cannot demand during an audit, and the reason the burden sits with the licensee in why compliance is the sole responsibility of the licensee.

Hours twelve to twenty four: map the likely exposure

Without sending anything to the vendor, sketch your own picture. Which products are named in the notice. Which agreements and Additional License Authorizations govern them. Roughly how many instances and users exist, and how many of those are service accounts, dormant users, non production environments, or duplicates across systems. This is not a finished analysis and it does not need to be. It is enough to understand where the vendor is likely aiming and to answer opening requests narrowly and accurately rather than broadly and defensively.

Hours twenty four to forty eight: acknowledge and set the tempo

Within the notice window, acknowledge receipt through your single channel, confirm you will engage, and propose a realistic schedule. Do not commit to running a self assessment script, do not hand over raw exports, and do not accept any framing of the finding. A measured acknowledgement that engages on the audit while declining the artificial deadline establishes the tempo for the weeks ahead. The remedy that makes the eventual finding expensive, and why timing pressure is applied, is explained in the deemed acquisition at list price clause explained.

Write down what you know before it moves

The first 48 hours are also the moment to capture the state of things while it is fresh and uncontested. Record when the notice arrived, through what route, and exactly what it requested. Note who has already been contacted by the vendor, if anyone, and what was said before the channel was closed. Save the agreement, any order forms, and any Additional License Authorizations in one place so the governing terms are not reconstructed from memory later. This early record becomes the spine of the defense, because months into an audit the details of the first contact are easy to misremember and expensive to get wrong.

Equally, resist the urge to form conclusions on day one. A notice is not a finding, and a rough sense that the estate might be exposed is not the same as owing anything. Early certainty, in either direction, leads to mistakes: panic produces premature concessions, while false confidence produces dismissive replies that the vendor records and uses. The disciplined posture for the first two days is neither alarm nor denial. It is containment, documentation, and a refusal to commit to any position until the analysis supports one.

What not to do in the first two days

Do not run the vendor's measurement script to show good faith. Do not send a full user export to demonstrate transparency. Do not let multiple people answer questions in parallel. Do not delete or decommission anything. Do not accept the finding, even provisionally, as a basis for discussion. Each of these feels cooperative and each of them strengthens the vendor's position before you have built your own.

From containment to defense

The first 48 hours are about preserving your options, not exercising them. Once the channel is contained, the record preserved, the clause understood, and the exposure roughly mapped, the structured defense can begin: reconstruct the position, rebut the finding line by line, and resolve on the buyer's terms. The wider response plan for the full notice window is in how to respond to an OpenText seven day audit notice, and the full method across product lines is in the complete OpenText audit defense playbook. The fastest way to get the first two days right is to open a case and let an experienced team take over the channel immediately.