Sometimes the audit is unavoidable. Recently went through one, and my first thought was "wait, people still use oracle jdk?". Thankfully not my job to deal with, but I guess some companies never migrated off which blows my mind, but, to each their own I guess. Oracle is coming around looking for a paydays.
The jdk itself is fine, but the licensing terms are ridiculous. To their credit they waited to implement the terrible terms until there were multiple drop-in replacements.