Skip to main content
{ Reporting and Compliance }

Drata Audit Readiness Report

Delivers a weekly report per Drata framework on controls not ready, failing monitors, personnel with incomplete checks, vendors past review, and policies due for approval.

What this agent does

This read-only agent reports every week on how ready each framework in Drata is for its audit. It counts the controls that are not ready and says why for each one. It lists the failing monitoring tests by how long they have failed. It lists the personnel with incomplete policy acceptance, security training, background check, identity MFA, or device checks. It lists the vendors past their next security review date and the policies and external evidence due for approval or renewal before the audit period ends. It compares with last week and leads with what changed.

The challenge

Drata asks for every policy to be approved once a year, and the approval dates come due one at a time with nobody watching the whole list. The audit period arrives and the team learns that twelve controls are not ready, three policies missed their annual approval, and a contractor who left in January still shows as active. Drata shows each of these on its own page. Nobody reads every page every week.

The solution

The agent reads controls, monitors, personnel, vendors, policies, and evidence in one pass each week for each framework. It counts down to the audit period I set and lists each item with its owner. It compares with the previous week and leads with what changed. Provides a weekly briefing a compliance lead reads in a few minutes.

Workflow

  1. 01

    Read the frameworks

    Read each framework in scope with its controls, their readiness, and the monitors and evidence mapped to each control.

  2. 02

    Check controls and monitors

    Count controls that are not ready with the reason, and list failing monitors by age.

  3. 03

    Check personnel and vendors

    List personnel with incomplete policy acceptance, training, background check, identity MFA, or device checks, and vendors past their next security review date.

  4. 04

    Check evidence

    List policies due for annual approval and external evidence whose renewal date falls before the audit period ends.

  5. 05

    Report

    Publish what changed since last week and what needs action, with the owner for each item.

Agent template 

# Drata Audit Readiness Report

## Measurable outcomes

Every week, the compliance lead knows which controls are not ready and why, which personnel and vendors are behind, and what needs approval or renewal before the audit, for each framework. Track the readiness percentage, the not ready controls, the failing monitors, the incomplete personnel, and the days to the audit period on every run.

## Procedure

Once a week, for each framework I set, read the framework's controls, their readiness, and the monitoring tests and evidence mapped to each control. Take the audit period dates from me, and report no audit period set when I give none. Report the readiness percentage from the ready and total control counts. Count the controls that are not ready, and state the reason for each one: a failing monitor, missing evidence, evidence past its renewal date, or a policy without a current approval. List them with the control owner. List the failing monitors in age bands of under a week, one to four weeks, and over a month, with the owner for each. List the personnel whose policy acceptance, security training, or background check is incomplete, the personnel with no identity MFA, and the personnel whose device fails the checks for disk encryption, lock screen, antivirus, password manager, or automatic updates, from the Drata agent or the connected MDM. List the personnel whose offboarding is incomplete more than 7 days after their end date, unless I set another window. When I grant read-only access to the identity provider, flag any person Drata shows as active whose account there is deactivated, and report that check as not checked without it. List the vendors past their next security review due date. List the policies due for annual approval and the external evidence whose renewal date falls before the audit period ends, nearest first. Compare everything with last week's report, and lead with what changed. Give every item an owner and the specific fix. Report a count it could not read as not available, never as zero. State the days remaining to the audit period at the top.

## Requirements

It needs a Drata API key with read access to frameworks, controls, monitors, personnel, vendors, policies, and evidence, and optional read-only access to Okta, Microsoft Entra ID, or Google Workspace for the account check, and nothing more. It never changes anything in Drata or in an identity provider. Tickets name the owner so a person can act. Reports show personnel with incomplete checks as stable pseudonyms.