What to do in the first 90 days after a VCF entitlement audit notice.

A VCF entitlement audit arrives as a formal notice from the Broadcom compliance team, typically addressed to the buyer's procurement and legal contacts on the master agreement. The audit is broader in scope than a single product audit. It examines the buyer's entitlement to the VCF bundle as a whole, including the component product entitlements, the unit definition the buyer is licensed under, the deployment topology, and the historical configuration against the contract's measurement date. The first 90 days of the engagement set the scope, the timeline, and the buyer's information position for the remainder of the audit, which typically runs 9 to 14 months from notice to settlement. The Desk has worked through 14 VCF entitlement audits across 2024 to 2026, and the 90 day playbook is consistent enough to publish.

The 90 days break into three phases of roughly equal length. Days 1 to 30 are the receive, contain, and respond phase. Days 31 to 60 are the parallel build and scope settlement phase. Days 61 to 90 are the measurement methodology negotiation and the documentation exchange opening. This piece walks each phase, with the deliverables, the failure modes, and the figures from the cohort.

Two preliminary notes. The VCF entitlement audit is distinct from a vSphere usage audit. The two audits have different scopes, different measurement methodologies, and different escalation paths. The 90 day playbook described here applies to the entitlement audit. The Desk has written separately on the 45 day playbook for the vSphere usage audit. The second note: the playbook assumes qualified counsel is engaged by day 14. Buyers running a VCF audit without specialist software audit counsel are running a different engagement and the outcomes are not comparable to the cohort.

Days 1 to 30: receive, contain, respond

The first phase has four deliverables. The notice acknowledgment, the entitlement read, the estate containment, and the formal response. The notice acknowledgment is a short reply confirming receipt and requesting a calendar window for the opening conversation no sooner than 21 days from the notice date. The acknowledgment is a procedural marker, not a substantive response. Filing the acknowledgment inside the first three days prevents the auditor from scheduling the opening conversation inside the buyer's preparation window.

The entitlement read is the buyer's reconstruction of the contractual entitlement against the contract language as written. The reconstruction must include the unit definition (per socket or per core), the bundle composition at the contract date, any subsequent amendments to the entitlement, and any commercial concessions documented in the side letters or order forms. The Desk has yet to see a VCF audit where the buyer's first day recollection of the entitlement matched the documented contractual position. Days 4 through 14 are typically the entitlement read.

The estate containment is a written instruction to the operations team to freeze the VCF estate configuration as of the notice date. No new clusters. No new component deployments. No unit conversions in flight. The freeze is procedural and reversible. The freeze produces a stable snapshot the buyer can defend against the auditor's measurement. The freeze must be documented in writing with a dated instruction and a confirmation from the operations lead.

The formal response is filed on or before day 28. The response acknowledges the audit, accepts the cited contract clause as the basis for the engagement, proposes a scope conditional on a measurement methodology clarification, and proposes a calendar that allows at least 60 days between the response and the measurement date. The scope proposal is the most important paragraph. The Desk has seen scope proposals reduce eventual exposure by between 18 and 47 percent across the cohort, before any measurement methodology debate.

Days 31 to 60: parallel build and scope settlement

The second phase runs two parallel tracks. Track one is the buyer's complete information build. The operations team produces a dated inventory of the VCF estate at the measurement date specified in the notice and at the current date. The inventory must cover cluster count, host count per cluster, CPU model and core count per host, memory per host, vSAN capacity per cluster, Aria managed object count, and Tanzu workload count by class. The inventory should sit alongside the entitlement reconstruction as the buyer's evidentiary basis.

Track two is the scope settlement with the auditor. The auditor's opening scope is rarely the final scope. The buyer's counsel challenges any element of the scope that is not directly supported by the cited clause. The scope settlement typically requires three to four written exchanges and lands by day 55 in the median engagement. The Desk's view is that the scope must be settled in writing before any documentation crosses from the buyer to the auditor. Documentation produced into an unsettled scope is documentation the auditor can use against the buyer indefinitely.

Day 60 also marks the executive sponsor briefing. The sponsor is typically at the CIO or CTO level with documented authority to commit to a settlement at the eventual exposure range. The sponsor receives a written brief covering the notice, the settled scope, the buyer's information position, the timeline, and the projected exposure range. The brief is signed by counsel and by the procurement lead. The sponsor's role from this point is to remove internal obstacles to the buyer's information build and to approve settlement parameters at the final stage.

"The VCF audit is a 12 month engagement. The first 90 days set the terms. The buyer who runs the 90 day playbook can defend the rest. The buyer who skips the 90 day playbook spends the next 10 months negotiating from the auditor's information set."Audit Defence Lead, The Desk

Days 61 to 90: measurement methodology, documentation exchange opening

The third phase is the measurement methodology negotiation. The contract's entitlement definition produces a measurement methodology that may or may not be the methodology the auditor proposes to use. The buyer's counsel reviews the proposed methodology against the contract and challenges any element that does not align. The Desk has seen methodology challenges reduce the measured entitlement by between 9 and 31 percent across the cohort. The challenges typically focus on the unit conversion (sockets to cores), the inclusion of non production environments in the measured population, and the treatment of decommissioned hosts inside the measurement window.

The documentation exchange opens at day 80 in the median engagement. The buyer produces the first tranche of documentation into the settled scope under the settled methodology. The first tranche should be limited to the documentation directly required by the methodology, not anticipatory documentation. The Desk's view is that the buyer should produce only what is specifically requested in writing, and should request a written acknowledgment from the auditor for each tranche produced. The documentation exchange will continue for the next several months. The discipline established in the first tranche sets the pattern.

Day 90 is the inflection point. By day 90 the buyer has a settled scope, a settled methodology, an established documentation exchange protocol, and a defensible information position. The remainder of the audit proceeds from this foundation. Buyers who reach day 90 without these four items in place do not have the foundation to defend the remainder of the engagement.

The three things buyers do that damage the position

Three buyer side actions, all common, materially damage the position inside the 90 days. The first is informal conversation with the VMware account representative outside the formal audit channel. The account representative is not the auditor and any commitments made in those conversations bind the buyer without binding the auditor. The second is the production of any documentation to the auditor before the scope and methodology are settled in writing. The third is the failure to engage qualified software audit counsel by day 14. General contract counsel without specific software audit experience does not produce the same outcomes. The Desk's data across the 14 audit cohort: buyers with specialist counsel from day 14 settled at a median 71 percent below opening exposure. Buyers with general counsel only settled at a median 34 percent below opening exposure.

What we have seen on live deals

A Fortune 500 manufacturer received a VCF entitlement audit notice in March of last year. The opening exposure estimate the auditor presented at the day 90 mark was $47.2M. The buyer ran the 90 day playbook with specialist counsel and the Desk. The scope settlement removed the auditor's overreach into non production environments. The methodology challenge converted the unit measurement from the auditor's default core inflation to the contract's documented unit definition. The estate freeze held. The documentation exchange protocol limited the buyer's production to specifically requested tranches. The settlement landed at $9.8M after 13 months, a reduction of 79 percent against the day 90 estimate. The Desk's view is that roughly 70 percent of the reduction was set inside the first 90 days. The remaining 30 percent came from the protocol discipline established in those 90 days.

The takeaway

• A VCF entitlement audit is a 9 to 14 month engagement. The first 90 days produce roughly 70 percent of the eventual exposure reduction. The 90 days break into three phases of equal length: receive contain respond, parallel build and scope settlement, measurement methodology and documentation exchange opening.
• Qualified software audit counsel must be engaged by day 14. The cohort with specialist counsel from day 14 settled at a median 71 percent below opening exposure. The cohort with general counsel only settled at 34 percent. The differential is the cost of the wrong counsel choice.
• Three buyer side actions damage the position. Informal conversation with the account representative outside the audit channel. Documentation produced into an unsettled scope or methodology. Failure to engage specialist counsel by day 14. Avoid all three for the full 90 days.