Software publisher audit risk profiles.

The major audit risk after a deal comes from a short list of publishers. Know how each one behaves before you sign.

These software publisher audit risk profiles cover the vendors that drive the most exposure after a transaction. Oracle, SAP, Microsoft and IBM remain the most active, with Broadcom following its VMware acquisition, Salesforce and ServiceNow rising fast.

Publisher audit risk profiles

Each profile covers how the publisher licenses, where inherited exposure hides, and what triggers an audit after a change of ownership.

Broadcom VMware Licensing in M&A: RiskVMware licensing in M&A changed under Broadcom
IBM Licensing in M&A: Audit RiskIBM licensing in M&A turns on sub capacity reporting
Microsoft Licensing in M&A: Audit RiskMicrosoft licensing in M&A hides in per core SQL and Windows Server, tenant drift and…
Oracle Licensing in M&A: Audit RiskOracle licensing in M&A is a leading audit risk
Salesforce Licensing in M&A: RiskSalesforce licensing in M&A is committed spend, not an audit
SAP Licensing in M&A: Audit RiskSAP licensing in M&A turns indirect access, user classification and engine metrics into…
ServiceNow Licensing in M&A: RiskServiceNow licensing in M&A is committed spend, not an audit

How vendor risk profiles shape a deal

Every publisher audits differently, and the difference decides where diligence time should go. Oracle measures processor counts and virtualization boundaries, so a VMware cluster the target never documented can multiply the license requirement. SAP measures named users and indirect access, which is why the AB InBev and Diageo disputes remain the reference cases for inherited exposure, as of June 2026. Microsoft works through enterprise agreement true ups and renewal leverage rather than formal audits. IBM relies on sub capacity reporting rules, where a single missing ILMT record can convert an estate to full capacity licensing. Broadcom has repriced VMware entitlements aggressively since its acquisition, and Salesforce and ServiceNow police consumption against subscription tiers that a merger can breach in one quarter.

We turn each profile into a number before it becomes a claim. The vendor guides below explain the mechanics, and the matching engagements price the exposure for a live deal: Oracle licensing M&A advisory, SAP licensing M&A advisory, Microsoft licensing M&A advisory, IBM licensing M&A advisory, and vendor audit risk quantification for the rest of the estate.

For the audit patterns that follow transactions specifically, the M&A software audit risk guide covers each publisher in depth.

Questions deal teams ask most

Which software publishers drive the most M&A audit risk?

Oracle, SAP, Microsoft and IBM are the most active after a deal, with Broadcom (VMware), Salesforce and ServiceNow increasingly so.

Why does a change of ownership trigger a vendor audit?

A transaction is a known prompt for publisher compliance teams. The combined entity is larger and freshly capitalised, which resets attention on the estate.

How large can vendor exposure be?

Very large. SAP pursued AB InBev for a figure in the region of 600 million dollars, and the Diageo Great Britain Ltd v SAP UK Ltd judgment, [2017] EWHC 189 (TCC), confirmed indirect access can require licensing.

Facing exposure from one of these publishers?

Request a confidential software M&A risk assessment focused on your highest risk vendors.

Book a confidential assessment

Book a confidential call →