What to do in the first 21 days after a Tanzu audit notice.

A Tanzu audit notice arrives by email to a contractually nominated address and is dated to the day of receipt. The notice sets the clock running on a series of procedural deadlines that compound against the buyer if the first 21 days are spent improvising rather than executing a defined response. The Desk has worked through 11 Tanzu audit notices across 2026 to date. The buyers that landed at the smallest financial exposure all completed the same first 21 days of work. The buyers that landed at the largest exposure all spent the first 21 days assembling a response team and reading the notice in isolation. The work in the first 21 days is the most consequential work in the entire audit lifecycle.

This article walks through that 21 day sequence. It is not a substitute for engagement counsel and it does not replace the buyer's contractual obligation to cooperate with a properly scoped review. It is the operational framework the Desk has used across the 2026 book to convert a Tanzu audit notice from an open ended exposure into a defined and bounded process.

Tanzu audits in 2026 are running on a distinct pattern from prior VMware audit waves. The notices we have seen focus on developer seat counts, on cluster admission scopes, and on the consumption of bundled components that were nominally optional under the prior contract. The buyer's first 21 days has to address all three lines of inquiry without conceding scope on any of them.

Days one through three: the receipt and the perimeter

The first three days are about the receipt of the notice and the establishment of a defined response perimeter. The notice itself is short. The notice contains the date of the audit assertion, the scope of the assertion as the seller frames it, and a request for a written acknowledgement of receipt within a defined window. The window in the 2026 notices we have seen is 10 business days.

The buyer acknowledges receipt of the notice. The buyer does not respond to the scope assertion in the acknowledgement. The acknowledgement confirms receipt. It does not concede that the scope as the seller frames it is the contractual scope of the review. That distinction is the most important sentence the buyer writes in the first 21 days.

Within the first three days the buyer also establishes the response perimeter. The perimeter is a named single point of contact for all written communications with the seller's compliance team, a named legal lead, a named technical lead, and a named procurement lead. All four are nominated in writing. All communications with the seller's compliance team are routed through the single point of contact. The technical lead does not respond to telemetry requests from the seller without explicit routing through the single point of contact.

Days four through ten: the entitlement reconciliation

Days four through ten are the entitlement reconciliation. The buyer assembles the current Tanzu contract, all amendments, all order forms, and all bundled component schedules. The reconciliation establishes what the buyer is contractually entitled to consume across developer seats, cluster admission scope, and bundled component activation. The reconciliation does not yet establish what the buyer is actually consuming. That comes next.

The entitlement file is rarely complete in the buyer's contract repository. Tanzu bundles have been restructured at least twice across the post acquisition period and the bundled component schedule that applies to the buyer's current contract is often not the schedule the buyer's procurement team last reviewed. The reconciliation cross references the contract effective date against the published bundle schedule that was in effect on that date. The contractual scope of the review is bounded by the schedule that was in effect at the contract effective date, not the schedule in effect at the audit notice date.

"The scope of the audit is what the contract permits, not what the audit notice asserts. The buyer's first written response in the first 21 days has to establish that distinction in plain text."Tanzu Audit Lead, The Desk

Days eleven through fifteen: the consumption telemetry

Days eleven through fifteen are the consumption telemetry. The buyer's technical lead pulls the consumption telemetry across all three lines of inquiry the audit is likely to address. The telemetry includes the developer seat count as recorded in the Tanzu admission control system, the cluster admission scope as defined by the active namespace policies, and the activation state of each bundled component on each cluster.

The telemetry is gathered for the buyer's internal review only. The telemetry is not yet shared with the seller's compliance team. The telemetry is reconciled against the entitlement file from days four through ten. The reconciliation produces a written internal memo that lists every consumption line item that exceeds the contractual entitlement, every line item that is within the entitlement but that the seller might assert is out of scope, and every line item that is clearly within the entitlement and clearly within scope.

The internal memo is the buyer's private working document. It is not produced to the seller's compliance team. It is the foundation for every subsequent written exchange in the audit lifecycle. The buyer that does not produce the internal memo in days eleven through fifteen is responding to the seller's compliance team without a private reference of its own position.

Days sixteen through twenty one: the scope response

Days sixteen through twenty one are the scope response. The buyer's single point of contact responds in writing to the seller's compliance team. The response addresses the scope of the review as the seller has framed it. The response either accepts the scope as the contractual scope of the review or it identifies the elements of the seller's framing that exceed the contractual scope and proposes a revised framing that aligns to the contract.

The 2026 Tanzu audit notices we have seen all assert a scope that exceeds the contractual scope of the review. The most common excess is the inclusion of bundled components that were optional under the bundle schedule in effect at the contract effective date but that have been reclassified as default under a subsequent bundle schedule. The buyer's scope response identifies the bundle schedule that applies to the contract effective date and proposes a revised framing that aligns to that schedule.

The scope response is the first written exchange of the audit lifecycle that addresses the substance of the review. The framing the buyer establishes in the scope response is the framing every subsequent exchange operates against. The buyer that delays the scope response past day 21 is conceding the seller's framing by silence.

What we have seen on live deals

A regional financial services buyer received a Tanzu audit notice in early 2026 with an opening seller assertion of $6.2M. The buyer's single point of contact issued an acknowledgement within four business days, completed the entitlement reconciliation by day nine, produced the internal consumption memo by day fifteen, and issued the scope response on day twenty. The scope response identified the bundle schedule in effect at the contract effective date and proposed a revised framing that excluded four bundled components the seller's notice had asserted as in scope. The seller's compliance team accepted the revised framing across two written exchanges in the subsequent four weeks. The cleared settlement was $940K. The reduction against the opening assertion was 85 percent. The reduction was produced by the procedural work in the first 21 days. The subsequent four weeks ran through the framing the buyer established before day 22.

One further point on the calendar. The 21 day sequence assumes the buyer receives the notice on a Monday at the start of a normal business week. The Desk's 2026 book shows that roughly a third of Tanzu audit notices arrive on a Friday afternoon or on the day before a public holiday in the buyer's primary jurisdiction. That timing is not a coincidence. The seller's compliance team has visibility into the buyer's calendar through the prior contract administration cadence. The buyer that receives a Friday afternoon notice loses two of the first three days to the weekend if the response perimeter is not already drafted as a contingency. The Desk's recommendation is that every Tanzu customer maintains a written response perimeter draft in the contract repository, refreshed at each contract anniversary, so that a Friday afternoon notice triggers an acknowledgement on the following Monday rather than on the following Wednesday.

The takeaway

• The first 21 days after a Tanzu audit notice is a defined procedural sequence, not an open ended response. Days one to three are the receipt and perimeter. Days four to ten are the entitlement reconciliation. Days eleven to fifteen are the consumption telemetry. Days sixteen to twenty one are the scope response.
• The scope as the seller frames it in the notice is not the contractual scope of the review. The buyer's first written response has to establish that distinction. The bundle schedule that applies is the schedule in effect at the contract effective date, not the schedule in effect at the audit notice date.
• The internal consumption memo is the buyer's private working document. It is not produced to the seller's compliance team. It is the foundation for every subsequent exchange. The buyer that does not produce it in the first 21 days responds to the seller without a private reference of its own position.