The 48-hour rule
Acknowledge the notice — commit to nothing.
Vendor audit notices are constructed to extract a fast, broad confirmation. The cover letter typically asks the buyer to "confirm receipt and propose a kick-off date within ten business days." Two things go wrong if the buyer complies on that timeline. First, the kick-off discussion happens before the buyer has internally assembled the contract library, governance group and advisors needed to control scope. Second, "confirmation" is interpreted by vendor counsel as acceptance of the audit clause's broader assertions in the letter — products, entities, methodology — that the buyer has not actually agreed to.
The correct response, sent within 48 hours of receipt, is a short letter that does four things and only four things: confirms the letter was received, identifies the single point of contact going forward, notes that all substantive discussion will be deferred pending internal review under the master agreement, and proposes a longer kick-off window. Nothing more. The template below has worked in 340+ engagements. Before the kick-off call, a fast software license compliance assessment tells the buyer where the real exposure sits so the scope reply is grounded in facts, not guesswork.
Audit notice arrived this week?
We respond within 24 hours. The 14-day clock has started.
The template
Copy, paste, customise — the 72-hour buyer response.
Subject: Acknowledgement — your letter dated [DATE], reference [VENDOR REF NUMBER]
Dear [NAMED AUDITOR / ACCOUNT MANAGER],
We acknowledge receipt of your letter dated [DATE] referencing [CUSTOMER LEGAL ENTITY NAME] and the master agreement dated [MASTER AGREEMENT DATE].
For the avoidance of doubt, all communications relating to this matter from this date forward will route through a single named contact: [NAME], [TITLE], [EMAIL]. We request that no other contact in our organisation be approached on this subject; any such approach will not constitute communication.
We are conducting an internal review of the letter against the master agreement, including the audit-rights, notice, scope and methodology provisions. Following that review we will propose a kick-off discussion to align on scope, timing, methodology, data handling and dispute mechanisms. Please reserve a window between [DATE +30 days] and [DATE +45 days].
Until that alignment is documented in a mutually-executed scoping letter, no data, system access, deployment information or interview commitments are being made and none should be inferred. Any verbal or informal exchanges with employees of [CUSTOMER] should not be treated as buyer responses for the purposes of the audit.
This letter is sent without prejudice to all rights and defences available under the master agreement.
Yours sincerely,
[NAME]
[TITLE]
[CUSTOMER LEGAL ENTITY NAME]
cc: [GENERAL COUNSEL or DELEGATE]
cc: [EXTERNAL ADVISOR if engaged]
Why each line matters
The mechanics behind the template.
- "We acknowledge receipt" — neutral; does not accept the letter's substantive assertions.
- "Single named contact" — closes the side-channels the vendor account team will otherwise use to extract information informally.
- "Internal review against the master agreement" — signals contractual literacy; vendors recognise the language.
- "Audit-rights, notice, scope, methodology" — names the four contractual loci the buyer is going to negotiate.
- "Mutually-executed scoping letter" — converts the audit from a vendor-driven activity to a jointly-governed one.
- "Without prejudice to all rights and defences" — preserves every contractual lever for later.
- "cc: General Counsel" — establishes attorney-client privilege scope for subsequent work product.
Download the Vendor Audit Defence Handbook.
Includes the full first-72-hour template, the scope-letter response, the data-room protocol and the settlement framework.
What not to write
The phrases that cost buyers seven figures.
- "We are happy to cooperate fully." Cooperation is contractual, not voluntary. Saying "happy to" elevates the obligation.
- "We can have data ready within two weeks." Anchors a fast timeline. The buyer's interest is in a slower timeline.
- "Our SAM team will work with your auditor." Names a function and exposes a role; the vendor will request that person's deliverables directly.
- "We don't believe we are out of compliance." Premature substantive position with no ELP to back it.
- "Let's run your discovery scripts on our environment to get started." Hands the vendor unilateral data extraction; almost never reversible.
Need help drafting the response letter?
We provide a within-24-hour drafting service for active audit notices. No retainer required.
