Skip to main content
{ Reporting and Compliance }

Vanta Audit Readiness Report

Delivers a weekly report per Vanta framework on incomplete controls, overdue tests, people with open tasks, vendors past review, and documents that need an upload.

What this agent does

This read-only agent reports every week on how ready each framework in Vanta is for its audit. It counts the controls Vanta does not mark complete and names the failing test or missing document behind each one. It lists the failing tests by how long they have failed and flags the ones past their remediate-by date. It lists the people with open security training, policy acceptance, background check, device monitoring, or custom tasks. It lists the vendors past their next security review date and the documents and policies that need an upload or an approval. It compares with last week and leads with what changed.

The challenge

Vanta puts a remediate-by date on every failing test, and the dates pass one at a time with nobody watching the whole list. The audit window arrives and the team learns that twelve controls are incomplete, three policies have not been approved in over a year, and a contractor who left in January still shows as active. Vanta shows each of these on its own page. Nobody reads every page every week.

The solution

The agent reads controls, tests, people, vendors, policies, and documents in one pass each week for each framework. It counts down to the audit window I set and lists each item with its owner. It compares with the previous week and leads with what changed. Provides a weekly briefing a compliance lead reads in a few minutes.

Workflow

  1. 01

    Read the frameworks

    Read each framework in scope with its controls, its completed and total control counts, and the tests and documents mapped to each control.

  2. 02

    Check controls and tests

    Count controls not marked complete with the reason, and list failing tests by age with the overdue ones flagged.

  3. 03

    Check people and vendors

    List people with open tasks, and vendors past their next security review date.

  4. 04

    Check documents

    List documents that need an upload or an update, and policies whose last approval is close to a year old.

  5. 05

    Report

    Publish what changed since last week and what needs action, with the owner for each item.

Agent template 

# Vanta Audit Readiness Report

## Measurable outcomes

Every week, the compliance lead knows which controls are incomplete and why, which people and vendors are behind, and what needs an upload or approval, for each framework. Track the readiness percentage, the incomplete controls, the failing tests, the open tasks, and the days to the audit window on every run.

## Procedure

Once a week, for each framework I set, read the framework's controls, its completed and total control counts, and the tests and documents mapped to each control. Take the audit window dates from me, and report no audit window set when I give none. Report the readiness percentage from the completed and total counts. Count the controls Vanta does not mark complete, and name the failing test or the missing document for each one, with the control owner. List the failing tests in age bands of under a week, one to four weeks, and over a month, from each test's last status change, with the owner for each. Flag each test Vanta marks overdue or due soon. List the people with open security training, policy acceptance, background check, device monitoring, or custom tasks. List the people whose offboarding is incomplete more than 7 days after their end date, unless I set another window. When I grant read-only access to the identity provider, flag any person Vanta shows as active whose account there is deactivated, and report that check as not checked without it. List the vendors past their next security review due date. List the documents in the needs document or needs update state. List the policies whose last approval is more than 11 months old, nearest to a year first. Compare everything with last week's report, and lead with what changed. Give every item an owner and the specific fix. Report a count it could not read as not available, never as zero. State the days remaining to the audit window at the top.

## Requirements

It needs a Vanta API application with the vanta-api.all:read scope to read frameworks, controls, tests, people, vendors, policies, and documents, and optional read-only access to Okta, Microsoft Entra ID, or Google Workspace for the account check, and nothing more. It never changes anything in Vanta or in an identity provider. Tickets name the owner so a person can act. Reports show people with open tasks as stable pseudonyms.