As a small business, it’s easy to assume that your size will prevent you from being audited by Oracle. After all, if you have less than a hundred employees and only a handful of licenses, you might think you’d escape notice because Oracle has larger, higher volume businesses to which they should devote their attention.
Those assumptions are wrong.
In fact, your business is never too small to face an Oracle audit. “Smaller companies are an inviting target for Oracle to audit,” said Craig Guarente, CEO of Palisade Compliance, a specialist in advising companies on Oracle auditing and licensing. “Smaller audits can take much less time so Oracle can conduct the audit, collect the cash, and move on to the next audit. It can be a very lucrative model for Oracle.” (Note: I’ve worked with Palisade Compliance to create a variety of white papers and research reports.)
It’s possible to interpret Oracle’s behavior about licensing in many ways – their aggressiveness could be to ensure compliance or it could just be a way to generate more revenue. But it’s clear that size will not prevent a company from facing the Oracle microscope.
Recently, I had the chance to speak with Paul Crane, Vice President of Information Technology at Pets Best Insurance, an online pet insurance company. Though it operates in 50 states, Pets Best has only 60 employees. It had operated as an Oracle licensee for more than a decade before receiving a letter alerting Crane of the audit.
Crane's experience can serve as an example of what other small businesses could face. It offers up some important rules for how other small businesses should handle an audit.
1. Don’t go it alone
The process for handling an audit for a small business is obviously different than an audit at a business where tens of millions of dollars are at stake. Yet the experience can be just as daunting and time-consuming. Even more importantly, the costs of an audit can also be far more likely to affect the long-term viability of a small business than a larger one.
As small businesses generally do not have the in-house staff expertise or capacity to effectively handle an audit, it’s wise to bring in outside consultants to help navigate the process. Crane found this to be essential and contracted with Palisade Compliance.
“Once you receive the audit letter, it’s very tempting to think you immediately have to comply with Oracle’s demands. And our initial interactions with Oracle were friendly,” Crane said. “But we took a step back and realized Oracle’s overtures weren’t going to be like that for an audit and so we reached out for help.”
2. Don’t go in blind
Crane emphasized that the most vital benefit of working with a compliance consultant was that it allowed Pets Best to thoroughly understand their current Oracle commitments and future needs when entering into negotiations.
“I’d really recommend that other small businesses don’t go in blind to an audit,” Crane said. “We suspected we had holes in terms of compliance and talking with experts helped us understand the best result we could realistically get. Once we got the audit, our main goal was to be in compliance – but in compliance only with what we needed and what we were using. Once you know what you need, then you can go in and you can negotiate a little better. Otherwise, you run the risk of being at their mercy.”
Working with Palisade, Pets Best was able to map out their current licenses and their future license needs with a full analysis that factored in growth. Such an analysis helps to avoid audits down the line.
3. Disclose only what you need to
A small business facing an Oracle audit can feel a bit like David and Goliath. And upon receiving an audit letter, it’s understandable that small businesses might respond by throwing open the doors and providing Oracle with access to everything. Crane heavily cautioned against this.
“You have to realize that they’re not the law,” he said. “They’re a company that you signed a contract with. You think they’ve got you wrapped around their finger because you’re using their software and so many people don’t push back at all. You think you have to give them everything, but that’s really not the case. We believed that Oracle was over-reaching in some of their requests and we felt that they were risky from a security and stability standpoint. ”
Pets Best recognized that Oracle was seeking as much information as possible about their licensing and usage. Yet Crane pointed out that Oracle has no desire to give any information back to the small business. “We kept asking for our order,” he said. “We knew exactly what they thought we had versus what we actually had. And you have to make it your process, not theirs, regardless of their pushback.”
The good cop routine is a cliché of cop shows, and Oracle can use a similarly friendly tactic to make the process seem more like a friendly relationship, than what it is: an audit. Small businesses should make sure they keep their hands close to the vest and disclose only what is necessary.
4. Take control of the process
During the audit, Pets Best faced what they found were excessive demands about the need for new licenses. According to Crane, despite having only 60 employees and two servers, Oracle requested that the company purchase 750 licenses. With a full understanding of the process and the desired outcome, Pets Best had the confidence to challenge the audit process and negotiate from a position of strength. Though the audit ended up taking over a year, the company saw a far better result by taking their time.
“750 licenses represents a huge expense for us – about 60% of our total annual IT budget,” Crane said. “We ended up with more licenses than we had, but they’re the right licenses for the business both now and in the future. We have the flexibility to grow.”
5. Don’t buy what they’re selling
Crane also emphasized that the audit is a way for Oracle to increase their sales. “Palisade told us this was a tactic Oracle would use – that they were going to hit us with a big number so that you would think you were getting a good deal when they came back with a smaller one. They’re out to sell – their job was to get money from us.”
Following these rules and getting help from experts are crucial to ensuring small businesses avoid falling into Oracle’s audit trap. Just because your business is small doesn’t mean you must succumb to Oracle’s demands.
