OpenText ECM and Documentum audit defense.

OpenText's ECM line predates the Micro Focus acquisition and is governed by the OpenText EULA rather than the Micro Focus Additional License Authorizations. Under that EULA, compliance is treated as the sole responsibility of the licensee, and OpenText reserves the right to give seven days notice before an audit and to copy relevant records. A Documentum audit therefore opens with the vendor counting every account it can find in the repository and pricing the gap against your entitlement.

The headline metric on most ECM products is the named seat or named consumer, and this is exactly where the opening finding overreaches. In a large Documentum estate the user table accumulates entries that no longer represent a real human consumer, including:

• Service and system accounts used by integrations, batch jobs, and connectors, which the vendor often counts as consumers even though no person sits behind them.
• Dormant and orphaned accounts left behind by leavers, test users, and migrations, still present in the directory but never authenticating.
• Repository sprawl, where the same individual appears across multiple repositories or federated nodes and is counted more than once.
• Read only and occasional access measured against a full consumer definition that does not match how those users actually touch content.

On top of the seat count, ECM findings frequently include server and instance based charges for non production environments, disaster recovery standbys, and decommissioned repositories that should have left the count entirely. Each of these is a line in the opening number, and each is challengeable on the facts. Our task is to separate the entitlement you actually hold from the population the vendor has assembled, and to make the difference visible before any measurement script is allowed to run.

The reconstruction step is where ECM findings come apart. A vendor self assessment counts what is present in the directory; an effective license position counts what is actually entitled and used. The gap between those two numbers is the finding, and most of it is built from accounts and instances that do not belong in a defensible count. The full sequence is set out in the four Rs method and in the complete OpenText audit defense playbook.

An insurance group received a Documentum ECM finding priced at $7.2M, built on a named seat population that swept in service accounts, dormant leavers, and duplicate identities across federated repositories. After we reconstructed the entitlement and disqualified accounts that did not represent real consumers, the defensible figure settled at $1.6M, a reduction of 78 percent. The outcome sits within the firm average of 68 percent across more than 200 defended OpenText and Micro Focus audits.

For the underlying mechanics that apply across every product line, see how to respond to an OpenText seven day audit notice. The matching gated briefing is the OpenText seven day notice response paper.