Unless you’ve been living under a rock, you most likely are aware of the series of changes Oracle has made to licensing its Java products over the past few years. If you need a quick refresher, check out our timeline of events here. While enterprise software publishers rarely make changes to benefit the end user, some of the Java changes, such as price per employee, are especially penalizing to larger organizations with many employees — we’ve seen Java audit bills upwards of $4M USD per year. Even for smaller organizations managing your Java footprint is nearly impossible with the availability of Java access via one-click downloads. Just one of these downloads from an employee can require a license for your entire organization.
As we’ve seen Java audits pick up steam — in frequency and aggressiveness — it’s never been more crucial to understand your organization’s Java usage and manage your footprint. In this blog, we cover the Java audit process and outline key points for your organization to focus on throughout the process.
Audit Notification
The audit process initiates when you receive an audit notification from Oracle. Take the notification letter seriously, as it indicates Oracle’s intention to audit your Oracle Java licenses. Understand that compliance verification is necessary, and failing to cooperate may result in penalties or legal consequences.
Pro Tip: Be wary of the “soft audit,” where the vendor asks “innocent” questions about your Oracle Java usage. These scenarios, if not managed properly, can quickly escalate into an official audit.
Key points to consider:
- Audit start date: Generally, audit terms are 45 days unless otherwise negotiated.
- Scope of the audit: !IMPORTANT! Understanding the scope of the audit is key. Your auditor will often probe your organization for information irrelevant to the audit’s scope to uncover other licensing violations.
- Deadline for response: Missing any deadline impairs your leverage for any negotiations.
- Licensing agreements: Pull all the relevant licensing agreements to your Java entitlements.
Java Audit Kick-off Meeting
Following the notification, Oracle requests a meeting with your organization to kick-start the audit process. The purpose of this meeting is to establish an understanding between your organization and Oracle regarding the audit’s timeline and expectations. During the meeting, Oracle representatives will discuss the necessary steps, requirements, and the timeline for you to provide all the relevant data.
Key points to consider:
- Clearly communicate your organization’s availability and constraints during the Java audit process.
- Discuss and agree upon a realistic timeline for data sharing and cooperation with Oracle. Audits are not to interfere with regular business operations.
- Seek clarification on any unclear expectations or requirements from Oracle. This is important to understand to avoid oversharing unnecessary details.
PRO TIP: To ensure clarity and accountability, compile all the agreed-upon changes in an email and promptly send them to the auditor. It is crucial to have the new terms of the audit documented in writing.
NOTE: If you’ve chosen to see this audit through alone and forgo third-party help, here is some homework for your team before the next step in the Java audit process:
- Familiarize yourself with the terms and conditions of your Java licenses.
- Review the scope of usage and any restrictions or limitations mentioned in the license agreements.
- Ensure that you have documented proof of purchase and valid licenses for all instances of Java usage.
- Understand the various license metrics, such as Processor, Named User Plus, or Device, and ensure you clearly understand how they apply to your environment.
- Identify any potential gaps in compliance and be prepared to address them.
- Consult with your legal and IT teams to understand any contractual or legal obligations related to the audit scope.
- Understand that some Java license usage may be covered by an existing third-party vendor agreement.
But remember, it’s not too late to seek guidance at this point. The longer you wait, the stickier the situation gets, and you often lose valuable negotiating power when too much has already been revealed.
Java Server Worksheet & Oracle Scripts
As part of the audit process, Oracle will grant you access to a web-based license audit portal. Through this portal, you will be asked to complete a questionnaire about your organization’s usage of Oracle Java. Additionally, Oracle may provide an Oracle Server Worksheet (OSW) and request that you fill it out. Finally, they may ask you to run their PowerCLI tool to gather information about your virtual environments. Oracle will then review your licensing agreements and compare them against the information you provided.
Key points to consider:
- Ensure the provided data on the OSW is accurate, as it will influence the audit outcome. If you can’t accurately state your usage, Oracle uses this knowledge against you, claiming that your organization does not have the ability to track your Java usage.
- Be prepared for Oracle to scrutinize your Java deployments, focusing on compliance with license metrics and usage restrictions.
- Be cautious when using Oracle’s scripts and questionnaires, as they may collect more data than necessary for the audit.
Third-party Tool Assessment
Oracle may inquire about the existence of a third-party software asset management tool within your organization. They have verified that most third-party tools are capable of acting as an audit tool on their behalf. It is advisable for you to carefully consider your response. If you do have a third-party tool, it would potentially streamline the audit process for Oracle — which is generally not in your best interest.
Key points to consider:
- An Oracle-aligned software asset management (SAM) tool may rely solely on Oracle’s policies and guidelines, potentially overlooking specific contractual obligations or custom licensing agreements your organization has with Oracle.
- Oracle’s policies and guidelines may change over time, and the SAM tool may not be updated promptly to reflect these changes, leading to discrepancies between actual contractual obligations and the tool’s recommendations.
- The SAM tool’s reliance on Oracle’s policies may not adequately consider virtualization, clustering, or other complex IT environments, potentially leading to inflated license requirements.
Java Audit Report
Upon completion of the data collection phase, Oracle analyzes the gathered information. They generate an audit report outlining the worst-case scenario regarding licensing non-compliance and the associated fees payable to Oracle. The report summarizes the audit findings and presents a potential financial liability based on the audit’s outcome.
Key points to consider:
- Approach Oracle’s audit findings with skepticism, as they may initially present exaggerated violations and associated fees as a negotiating tactic.
- Keep in mind that Oracle’s initial exaggerated figures are part of a negotiation tactic (audit, bargain, close), and it’s crucial to negotiate from a position of knowledge and evidence to protect your organization’s interests and avoid overpaying for licensing fees.
Review and Response
After receiving the audit report, your organization is given a period of 30 days to correct any Oracle licensing deficiencies. This is your time to shift through the audit claims and develop an Oracle audit defense.
Key points to consider:
- Seek clarification on any discrepancies or concerns you may have about the audit results.
- Gather evidence and documentation to support your position, including contractual agreements, licensing records, and any other relevant documentation that can refute or challenge the exaggerated violations presented by Oracle.
- If your scenario is not ideal, we’d urge you one last time to seek professional assistance before accepting the findings. We’ve helped customers reduce their audit findings by millions of dollars at this point in the audit process.
- Request an audit close letter with a release clause to officially and legally close out the audit process.
Remediation and License Management
Once compliance issues are addressed, it’s essential to establish effective license management practices moving forward.
Key points to consider:
- Implement a robust software asset management (SAM) program to track and manage your Java deployments accurately.
- Stay up to date on Java licensing changes.
- Regularly review your Java usage and licenses to ensure ongoing compliance.
- Establish internal policies and procedures for license management, including employee awareness and training. Managing your Java footprint is an enterprise-wide task.
- Consider a SAM managed service like the ArxPlatform, to prevent future audit challenges and maintain continuous compliance monitoring and proactive license management practices.
Facing an Oracle Java audit can be overwhelming, but with a clear understanding of the Java audit process, you can navigate through it more effectively. Many organizations end up paying way too much for an audit. Your ability and willingness to push back on false audit claims is key. We understand that some organizations simply don’t have the time and end up paying Oracle to make the compliance problem go away. Let us fight that battle for you so you can get back to doing what’s most important for your organization.
