How an insurance group settled a combined Symantec, Carbon Black and VMware compliance review at 24 percent of opening.

The insurance group operates property and casualty, life, and pensions lines across several European jurisdictions, with a consolidated technology function that supports the operating companies under shared infrastructure agreements. The Broadcom compliance notice arrived as a single coordinated review covering Symantec endpoint and DLP across thirty one thousand seats, Carbon Black cloud workload protection across twenty four hundred workload instances, and VMware Cloud Foundation across eleven hundred CPU cores. The opening asserted exposure across the three product lines aggregated to sixteen million two hundred thousand dollars. The notice cited inconsistencies across the deployed estate against the entitlement records of record for each product line, and the review was scheduled to complete in ninety days.

The settled position eight months later closed at three million nine hundred thousand dollars, a seventy six percent reduction against the opening assertion across the combined estate. The settlement was reached without escalation to formal arbitration, without engagement of external counsel as the primary correspondence channel, and without the compliance review converting into separate parallel reviews for each product line. The defense was structured as a single response, on a single timeline, through a single named procurement lead, and that structural decision was the precondition for the outcome.

The Quote

The compliance review's opening exposure model was constructed on three independent positions, one per product line, each prepared by a separate Broadcom compliance team and each delivered inside the same notice. The Symantec position asserted seven million eight hundred thousand against the endpoint and DLP estate, on the basis of deployed seat counts that the auditor had derived from inventory tools the group had supplied at the notice opening. The Carbon Black position asserted four million one hundred thousand against the cloud workload protection estate, on the basis that workload instance counts in the group's container orchestration platform exceeded the contracted workload license envelope. The VMware position asserted four million three hundred thousand against the VCF estate, on the basis that the core count per host had drifted above the contracted core ceiling on several hosts following hardware refreshes that had not been reflected in the contract amendments.

Each position was reasonable from the seller's perspective on the data the auditor had been given and unreasonable from the buyer's perspective on the data the buyer had not yet provided. The combined opening exposure of sixteen million two hundred thousand was the price of three contracts having been carried forward separately, with each contract having drifted away from its corresponding deployment in ways that no single contract review would have surfaced.

The Find

The reconciliation work ran across the three product lines on a single coordinated timeline, run from a defense room inside the group's vendor compliance function. The Symantec reconciliation surfaced approximately forty two hundred seats that the auditor was counting as deployed but which were decommissioned hardware persisting in inventory tools, virtual desktop sessions licensed under a separate amendment, or seats covered by an acquired entity's prior Symantec contract that had been carried into the group but not formally novated. The reconciliation reduced the Symantec contractual exposure to approximately two million one hundred thousand on the bank's own contract terms.

The Carbon Black reconciliation surfaced that the workload instance count in the container orchestration platform was being counted on a per pod basis, while the contract licensed protection on a per node basis with multiple pods per node permitted under the license. The reconciliation reduced the Carbon Black exposure to approximately seven hundred thousand on the contract's own licensing metric.

"Each product line had its own contract language. Each piece of contract language was on our side in a different way. The defense was about reading three contracts as one defense, not three contracts as three negotiations."Lead audit defender on the engagement

The VMware reconciliation was the most contested of the three. The hardware refresh history confirmed that several hosts had been provisioned with core counts above the contracted ceiling, and the contract amendments had not been filed at the time. The contractual position was weak. The reconciliation focused not on contesting the assertion in principle but on the precise host inventory at the assertion date, on the dates of the refreshes, and on the operational basis for the core count overage. The reconciliation accepted approximately one million one hundred thousand of the original four million three hundred thousand assertion, on the basis of a corrected host inventory and a precise core count delta.

The Restructure

The defense produced a single combined response to the compliance review covering the three product lines, delivered through the named procurement lead to a single nominated compliance contact on the seller side that the group had requested at the opening of the engagement. The response was structured in three sections, one per product line, with the reconciled exposure for each section, the contract citations supporting the reconciliation, and the supporting evidence indexed to a numbered document register. The response was delivered four months into the engagement and represented the entire buyer side contestation across the three product lines.

The seller's response to the combined response took eight weeks. The seller conceded the Symantec scope reductions in full, conceded the Carbon Black licensing metric reduction in full, and conceded approximately seventy percent of the VMware core count reduction. The conceded reductions placed the residual exposure at approximately four million two hundred thousand. The settlement negotiation closed three months later at three million nine hundred thousand, with the settlement structured as a single settlement agreement covering the three product lines and tied to a coordinated renewal calendar for the three contracts over the following eighteen months.

The Outcome

The insurance group closed the combined compliance review on a settlement that was twenty four percent of the opening assertion, on a structured agreement that consolidated the renewal timing for the three product lines and gave the group's procurement function a single forward calendar for the Broadcom relationship. The standing audit response group constituted for the engagement was retained as a continuing function inside the vendor compliance organisation, with the cross product reconciliation discipline carried forward as a quarterly internal review against all three contracts.

The lesson, the lesson we apply on every multi product Broadcom compliance review, is that the defense has to be structured as one defense before the review begins. A single named procurement lead, a single correspondence channel, a single nominated compliance contact on the seller side, a single document register, a single timeline. Compliance reviews that are allowed to fragment into three parallel product line reviews are reviews where each product line drifts toward the seller's opening assertion at its own pace, because the buyer has not constituted the single defense organisation that can hold the line across all three. The single envelope on the notice has to be matched by a single envelope on the response. Buyers who organise the defense that way settle compliance reviews at a defensible fraction of the opening exposure. Buyers who do not, settle at the assertion.

The takeaway

• A multi product Broadcom compliance review is one review in three envelopes. The defense has to be one defense in three sections. Fragmenting the defense across three product line teams is the structural error that costs the buyer the settlement.
• Each Broadcom product contract carries its own licensing metric and its own scope language. The cross product reconciliation depends on reading the three contracts in parallel against the actual deployment, not on accepting the inventory the auditor has constructed.
• The settlement is a renewal event. The compliance settlement and the renewal calendar for the three product lines should close as a single coordinated commercial conversation, not as three separate ones.