Oracle audits after certification look for the same handful of mistakes every time: deployment past the count, undocumented virtualization, forgotten options, scope drift, and a stale evidence file. Each one is avoidable with a control that costs almost nothing, which is exactly why letting them slide is so expensive.
Post certification audits are not random. Oracle reviews the same recurring weaknesses because they are where certified positions reliably drift into exposure. The encouraging part is that the list is short and every item on it has a known, cheap control. This article names the mistakes Oracle hunts for and the discipline that closes each one, so you can audit yourself before anyone else does. Because every estate and contract differs, treat the items below as the pattern to check against your own agreement and deployment.
Oracle looks for deployment that has grown past the certified count, virtualization that was never documented and so sweeps whole clusters into scope, database options and management packs that were enabled without entitlement, deployments that have appeared in entities or territories outside the certified scope, and an evidence file that has gone stale and no longer matches the estate. These five account for the large majority of findings. None of them requires bad faith to occur. They are the ordinary results of an estate that kept moving while the governance that should track it stood still.
Every finding Oracle reaches for is a control you did not run. The audit does not create the exposure. It discovers the drift that nobody was watching.
| Mistake Oracle hunts for | The control that prevents it |
|---|---|
| Deployment grown past the certified count | Quarterly reconciliation against the certified entitlement |
| Undocumented virtualization sweeping clusters in | Maintained cluster boundary and isolation evidence |
| Options and packs enabled without entitlement | A record of what is enabled, reviewed on change |
| Deployments outside certified scope | Entity and territory mapping kept current |
| A stale evidence file | A standing owner who updates it as the estate changes |
Letting the evidence file go stale. The file built at certification is the defense for the certified count, and the moment the estate changes without the file being updated, the number stops reconciling to reality. Most findings trace back to this single failure, because a count you cannot tie to the current estate cannot be defended even when it is correct. Keeping the file current as servers are added, retired, or moved is the cheapest and most effective control available, and it is the one most often dropped once the certification project team disbands. Assigning a standing owner is what keeps it alive.
Run light governance from day one. Track deployment against the certified count, gate new installs through a quick headroom check, review virtualization and option changes for scope effects, and keep the evidence file alive. The findings Oracle hunts for are all avoidable with controls that cost little, because they catch drift while it is small rather than after it has compounded into a shortfall priced at full value. The organisations that sail through a post certification audit are rarely the ones that grew the least. They are the ones that watched their growth against the count and recorded it as they went.
Avoiding these mistakes is the practical side of defending the certification. Read the certification mistakes that haunt you later for the errors made at exit that resurface in an audit and defending your certified counts in an audit for how the position holds up under review. For the full context, see the post certification audit defense pillar.
Oracle looks for deployment past the certified count, undocumented virtualization that sweeps clusters into scope, database options and management packs enabled without entitlement, deployments in entities or territories outside the certified scope, and a stale evidence file that no longer matches the estate. Each is a common way a certified position drifts into exposure, and each has a simple control that prevents it.
Letting the evidence file go stale. The file built at certification is the defense for the certified count, and once the estate changes without the file being updated, the number can no longer be reconciled to reality. Most findings trace back to this. Keeping the file current as servers are added, retired, or moved is the cheapest and most effective control you can run.
Run light governance from day one: track deployment against the certified count, gate new installs through a headroom check, review virtualization and option changes, and keep the evidence file alive. The findings Oracle hunts for are all avoidable with controls that cost little, because they catch drift while it is small rather than after it has compounded into a shortfall.
Book a confidential assessment and we will run the same checks Oracle would, close any drift, and leave you with the controls that keep your certified position safe.