A formal audit during certification is uncommon, but the review of your declared count behaves very much like one. Oracle can question your numbers, ask for evidence, and challenge how cloud and virtualized deployments were counted. The safe assumption is that your certification will be scrutinised, so you prepare as though it will be.
By the Meridian advisory team · Ex Oracle licensing analysts · Updated June 2026
When you certify, you submit a declaration of deployed quantities, and Oracle reviews it before those quantities become your perpetual entitlement. That review is not a formal contractual audit in most cases, but it can carry the same scrutiny. Oracle may ask how you arrived at a number, request server lists or tool output, and press on the areas where customers most often get counts wrong: virtualization, cloud, and options usage. The distinction between a review and an audit is procedural. The preparation it demands is the same.
Do not certify a number you cannot evidence. The certified count and the file behind it are inseparable. A clean evidence file makes the certification review fast, and it becomes your defense if a real audit follows in the next two years.
This is the first place a reviewer looks. Under Oracle's partitioning stance, soft partitioning does not limit licensing scope, so Oracle's position is that an Oracle instance on a shared cluster can require licensing across the hosts that cluster can reach. If your Oracle workloads were never isolated, a reviewer can argue for a far larger footprint than you intend to certify. Dedicated clusters, isolation, and documentation are the defense, and they have to exist before the review, not be improvised during it.
Cloud is contract specific and reviewers know it. Many ULAs require deployments in AWS or Azure to run for 365 continuous days to count toward the certification baseline. Some exclude public cloud entirely. Contracts are frequently silent on Google Cloud, and silence is not inclusion. If you are counting cloud deployments, expect to show that they meet your contract's specific conditions. If your contract excludes cloud, counting it anyway is the kind of error a review is designed to catch.
Database options and management packs are easy to enable and easy to forget. A reviewer can probe whether features outside your named product scope were in use, because usage of an unlicensed option is exposure rather than entitlement. A complete certification accounts for option usage honestly and keeps it inside the scope your agreement actually grants.
No, and this is one of the most consequential decisions in the whole process. Running Oracle LMS or GLAS data collection scripts is a choice, not an automatic obligation, and the choice deserves real analysis against your contract. Scripts produce data, but Oracle controls how that data is interpreted, and the interpretation tends to favour the larger number. An independent measurement that you own can establish the same facts while keeping the methodology, the narrative, and the timing in your hands. There are situations where running scripts is reasonable, but it should be a decision, not a default reflex prompted by a request.
The most important timing fact about audits and ULAs is that the risk rises after certification. In the first two years following the exit, your unlimited right is gone and a fixed certified count has replaced it. Any deployment beyond that count is now a licensing gap, and Oracle knows the period after a ULA is when gaps appear, as estates keep growing while the unlimited cover no longer exists. The defense in that window is the evidence file behind your certified count, plus a deliberate process for buying new licenses when you genuinely grow rather than panicking back into a renewed agreement.
Readiness is a small number of disciplines applied early. Measure independently so you own the numbers. Isolate Oracle workloads so the virtualization position is clean. Decide the cloud position against your exact contract language rather than against a general impression of how cloud counts. Build an evidence file that ties every certified number to server lists, tool output, and a documented methodology. And keep that file after certification, because it is the asset that turns a later audit from a threat into a formality.
Take an anonymized example with indicative figures. A financial services firm prepared its certification with an independent baseline, isolated Oracle onto dedicated hosts, and documented every number. When Oracle reviewed the declaration and questioned the virtualized footprint, the firm answered in days with the cluster topology and the evidence behind it, and the review closed without a dispute. Eighteen months later a formal audit notice arrived, and the same file answered it. A comparable firm that had certified on script output it did not fully understand spent months reconstructing a position it should have built once. The difference was not luck. It was the file.
Read the certification timeline and its deadlines to see when the review pressure arrives, and correcting a certification mistake for what to do if a number was already submitted and turns out to be wrong. When you want a review ready position built for your own estate, our Oracle ULA certification guide is the pillar that covers the full process.
A formal audit during the certification process is uncommon, but the review of your declared count functions much like one. Oracle can question your numbers, ask for supporting evidence, and challenge how cloud and virtualized deployments were counted. The practical answer is to treat certification as if it will be scrutinised, because it usually is.
Running Oracle LMS or GLAS scripts is a choice, not an automatic obligation, and the decision deserves analysis against your contract. Scripts produce data Oracle controls the interpretation of. An independent measurement you own can serve the same purpose while keeping you in control of the methodology and the narrative.
Audit risk rises in the first two years after certification. Once your unlimited right has converted to a fixed certified count, any growth beyond that number is a licensing gap, and the evidence file behind your certified count is the defense. The scrutiny does not end at the signature, it shifts.