What to do in the first fourteen days after a Broadcom portfolio wide audit notice.

A portfolio wide Broadcom audit notice is different from a single product audit notice in three ways that matter to the buyer side response. The asserted exposure is larger because the assertion covers more product lines. The internal response group is wider because no single technical owner has authority across the whole estate. And the auditor's negotiation has more dimensions because each product line has its own contractual basis, its own deployment record, and its own remediation options. The single product seven day protocol does not stretch to portfolio scale. The portfolio audit needs its own fourteen day discipline.

The Desk has defended nine portfolio wide Broadcom audit notices in the last 18 months. Across those nine, the buyer side teams that ran a deliberate fourteen day protocol settled at an average of 23 percent of the initial asserted exposure. The buyer side teams that ran an ad hoc response without a protocol settled at an average of 61 percent of the initial asserted exposure. The financial gap between the two groups was large enough that a fourteen day protocol now exists as a standing Desk recommendation for every portfolio wide audit notice.

Day one and two: receive, log, convene the portfolio response group

The notice arrives. On day one the notice is logged with a date stamp, copied into the legal hold system, and routed to a named senior procurement or legal lead. The named lead convenes the portfolio response group within 48 hours. The response group on a portfolio audit is larger than the single product group. The portfolio response group needs procurement leads from each Broadcom product line, a technical owner for each product line, legal counsel, finance, and an external buyer side advisor if one is engaged.

The convening discipline matters. The technical owners from each product line do not typically work together. The procurement leads do not typically report to the same person. The convening is the act that creates a single response unit out of teams that operate independently in normal commercial cycles. Without the convening, the audit response fragments along product lines and the buyer side loses the portfolio level negotiating posture before it has had a chance to use it.

Day three: read the notice slowly, separate by product line

On day three the response group reads the notice together. Slowly. A portfolio wide audit notice on Broadcom paper is typically eight to fifteen pages. The notice contains the same four classes of content as a single product audit notice. Contractual basis, scope, timeline, deliverables. The work on day three is to separate those four classes by product line. The contractual basis is rarely uniform across the products. The scope language can vary by product. The timeline can be unified or staggered. The deliverables differ by product.

The separation work produces a matrix. On one axis, the four content classes. On the other axis, each product line under audit. Each cell of the matrix is the substance the buyer side must respond to. The matrix is the working document for the rest of the fourteen day protocol. Without the matrix the buyer side cannot keep the response coherent across products.

Day four: polite acknowledgement, no substance

Day four is the day the buyer side sends the polite acknowledgement to the auditor. The acknowledgement is two paragraphs. It confirms receipt of the notice, identifies the buyer's single point of contact for the audit, confirms that the buyer side is taking the matter seriously, and requests a brief extension on the auditor's timeline to permit a coordinated portfolio response. It does not concede scope, basis or deliverables on any product line.

The single point of contact discipline is essential on a portfolio audit. Without it, the auditor reaches into each product line directly and the buyer side loses the coordination the portfolio response group is supposed to provide. The single point of contact on the buyer side routes every auditor communication through the response group. No exceptions, no side channels.

Days five through nine: internal entitlement baseline by product line

Five days are reserved for the internal entitlement baseline across every product line under audit. The work is parallel. Each product line's technical owner produces a clean entitlement record and a clean deployment record. The deployment record is reconciled against the entitlement record. The reconciliation produces three categories per product line. Clear compliance, material exposure, and items requiring deeper review.

"The portfolio audit is won when the buyer can produce one matrix on day nine that the entire response group has signed off on. The matrix is what tells the auditor that the buyer is organised, the buyer is credible, and the negotiation will be portfolio level rather than product by product."Audit Defender, The Desk

The categorisation is the substance the buyer side will negotiate with the auditor. Clear compliance items are responded to with full documentation and a fast close. Material exposure items are negotiated before any documentation is produced. Items requiring deeper review are held back from the audit response entirely until the buyer side has clarity on its own position. The portfolio response group reviews each product line's categorisation in a single working session on day nine.

Days ten and eleven: shape the response to scope

On days ten and eleven the response group works the scope question across the portfolio. The scope asserted on a portfolio wide audit is almost always broader than the contracts support. Each product line has its own scope language. Each contract excludes certain entities, geographies or environments. The work is to read each contract against the asserted scope and identify the gaps on each product line.

The scope reduction is where buyer side leverage rebuilds on the portfolio audit. The reductions add up across product lines. On the nine portfolio audits the Desk has defended, scope reframing across the portfolio reduced asserted exposure by an average of 47 percent before any negotiation on the in scope items began. The reframing is a contract reading exercise. It is not a commercial negotiation. The auditor has to concede the scope where the contract does not support the assertion. The work is to find the places where the contract does not support the assertion and present them in a structured way.

Day twelve: align the response across product lines

Day twelve is the alignment day. The response group meets to ensure the response on each product line is consistent with the response on every other product line. Inconsistency is the seller side opening. If the buyer side asserts a tight reading of scope on the Symantec line and a loose reading on the VCF line, the auditor will press the loose reading and use it to argue the buyer accepts a loose reading generally. The alignment day removes those inconsistencies before the response leaves the buyer side.

The alignment day is also where the response group agrees the portfolio level negotiating posture. The posture covers the buyer's willingness to discuss remediation, the buyer's preferred remediation structure, the buyer's view on auditor cost recovery, and the buyer's view on the timeline. The posture is one buyer side position across the portfolio. It is not five different positions on five product lines.

Day thirteen: draft the structured response

Day thirteen is the drafting day. The structured response is one document. It acknowledges the audit, accepts the process subject to the buyer's reservations, requests confirmation of contractual basis on each product line, proposes a refined scope on each product line, requests a revised unified timeline, and lists the deliverables the buyer is prepared to provide on each product line and on what conditions. The document is six to ten pages on a portfolio audit. It contains almost no technical detail. The technical detail follows in a second wave once the structure is agreed.

Day fourteen: response goes out

Day fourteen is the day the structured response leaves the buyer side. The response is signed by the named senior procurement or legal lead. It is routed to the auditor through the single point of contact. The portfolio response group then enters the second phase of the defense, which is the commercial negotiation with the auditor on each product line within the agreed structure.

What we have seen on live deals

On a Fortune 200 insurer's portfolio audit defended last year, the initial asserted exposure across four Broadcom product lines was $34M. The buyer side ran the fourteen day protocol. The day four polite acknowledgement was two paragraphs. The day fourteen structured response was eight pages. By day 60 the asserted scope had been reduced by 51 percent across the portfolio. By day 180 the settlement was $7.1M, with remediation structured as a renewal credit on the next anniversary rather than a one time payment. The insurer continues to run all four Broadcom product lines on materially improved commercial terms.

The takeaway

• A portfolio wide audit needs a fourteen day protocol rather than the single product seven day protocol. The wider response group, the parallel entitlement work, and the alignment day are what the additional time buys.
• The single point of contact discipline is essential. Every auditor communication routes through it. No technical owner responds directly to the auditor on any product line at any time during the defense.
• The structured response on day fourteen converts the audit from an information request into a commercial negotiation at portfolio level. The portfolio level negotiating posture is where the largest financial outcomes are made on portfolio audits.