VMware

What the Broadcom VMware audit team is opening files on this quarter.

The 2026 second quarter audit pattern across VMware accounts has narrowed. Four file types are opening at materially higher rates than the prior quarter. The buyer who can read the pattern can prepare before the notice arrives.

By The Negotiation Desk · VMware · Archetype: The Calendar

Published 9 Jan 2026

The Broadcom audit operation in 2026 is sending compliance review notices at a rate the Desk has not seen since the original VMware acquisition closed. Across the Desk's North America and EMEA notification book, the second quarter of 2026 produced 41 percent more inbound notices than the first quarter. The pattern is not random. The notices are clustering against four file types that the audit team has decided to prioritise this quarter, and the prioritisation looks calendar driven rather than estate driven. This article reports what the four file types are, what triggers each one, and what the buyer can do this quarter to prepare. The intent of the article is calendar awareness, not legal advice on any specific notice.

Two notes before the file types. First, an audit notice is not an enforcement action. It is a request for compliance documentation that the contract allows the seller to make. The buyer's response to the notice shapes the seller's next move more than the buyer's documentation does. Second, the file type prioritisation visible this quarter may shift in the third quarter. The Desk publishes a refresh on the Live Desk weekly. The four file types described here are the second quarter pattern.

File type one: vSphere usage drift inside a VCF subscription

The first file type is the vSphere usage drift file. The audit team is requesting evidence that the buyer's vSphere consumption inside a VCF subscription matches the entitled scope. The trigger is a discrepancy in the management plane reporting feed that the seller's compliance system flags as anomalous. The most common cause of the flag is a cluster running a vSphere edition that is higher than the entitled edition under the subscription, often as a result of an upgrade pushed at the cluster level without an entitlement update.

The preparation work this quarter is to reconcile the vSphere edition deployed at each cluster against the entitled edition under the subscription, and to produce a written reconciliation document before any notice arrives. The seller's compliance system reads the management plane feed automatically. The buyer who can show the same reconciliation in writing closes the file faster and at lower cost than the buyer who reconciles after the notice opens.

File type two: vSAN policy class consumption

The second file type is the vSAN policy class consumption file. The audit team is requesting evidence that the buyer's vSAN consumption by policy class matches the entitled policy mix. The trigger is a policy class profile in the cluster management plane that includes a class outside the entitled mix, typically a higher tier policy class introduced for a specific workload without a contract amendment.

The preparation work is to export the current policy class profile from each vSAN cluster and compare it to the entitled policy mix under the contract. Where the cluster includes a policy class outside the entitled mix, the buyer documents either the removal of the policy class or the contract amendment that authorises it. The audit team is more interested in the documentation than in the policy class itself.

"Audit notices are calendar driven. The audit team has a quarterly target and a file mix. The buyer can prepare for the quarter the buyer is in by reconciling the four files the audit team is opening this quarter, before the notice arrives. The reconciliation costs hours. The notice costs weeks."Audit Defense Lead, The Desk

File type three: Tanzu workload class allocation

The third file type is the Tanzu workload class allocation file. The audit team is requesting evidence that the buyer's Tanzu Application Platform workload consumption maps to the entitled workload class. The trigger is a workload class profile in the platform telemetry that includes stateful workloads in excess of the entitled stateful allocation, typically as a result of stateless workloads being refactored without a class reassignment in the entitlement.

The preparation work is to export the current workload class profile from the Tanzu platform telemetry and to compare it to the entitled allocation. Where the actual profile exceeds the entitled stateful allocation, the buyer either reclassifies the workloads in the entitlement or refactors the workloads to match the entitlement. Both paths close the file. The choice depends on the buyer's operational posture.

File type four: Aria Operations metric volume

The fourth file type is the Aria Operations metric volume file. The audit team is requesting evidence that the buyer's actual metric ingestion is within the entitled volume band. The trigger is a metric volume reading from the Aria ingestion endpoint that exceeds the entitled volume at any point in the prior reporting window. The window is monthly in most contracts and quarterly in some.

The preparation work is to retrieve the metric volume reading from the Aria ingestion endpoint at the same cadence the contract specifies, and to maintain a rolling record of readings within the prior reporting window. Where any reading exceeds the entitled volume, the buyer either records the spike with operational context and a return to normal in the same record, or documents the increase as the basis for a contract amendment.

What this quarter's calendar means for buyer posture

The four file types share a common preparation pattern. Each one requires the buyer to produce a current state export and a comparison to the contract entitlement. None of the four require legal advice or third party assistance to assemble. All of them are cheaper to prepare before the notice than to assemble after the notice. The Desk's view is that any VMware buyer should run all four reconciliations once this quarter, file the four documents internally, and refresh them quarterly going forward. The quarterly refresh is a working practice that converts a reactive audit response into a documented compliance position.

Inbound audit notices in Q2 2026 across the Desk book▲ 41 percent QoQ

Largest single file type by notice countvSphere usage drift

Median weeks to close with prior reconciliation2 to 3

Median weeks to close without prior reconciliation7 to 10

What we have seen on live deals

A North America regulated buyer received a vSphere usage drift notice in April. The buyer had a current reconciliation in file from a routine quarterly refresh completed in January. The reconciliation showed two clusters with editions above the entitled scope and the corresponding contract amendments in process. The notice closed in 16 days at no commercial impact. A separate buyer received a comparable notice in the same week without a prior reconciliation. The same notice closed in 58 days with a commercial settlement against the drift. The difference between the two outcomes was the document filed before the notice, not the underlying compliance posture.

The takeaway

The Broadcom VMware audit team is opening four file types at materially higher rates in Q2 2026: vSphere usage drift, vSAN policy class consumption, Tanzu workload class allocation, and Aria metric volume.
All four files require the same preparation pattern: a current state export from the management or telemetry plane, compared to the contract entitlement, filed in writing before any notice arrives.
The median close time with a prior reconciliation in file is two to three weeks. Without one, seven to ten. The difference is a working practice the buyer can adopt this quarter at low cost.