As a Drata customer, you control the scope of evidence that your auditor has access to in their Audit Hub. When you create an audit in Drata, you can select a date range for the audit, and then the auditor has access to your evidence within that range.
Key points:
You control evidence access, not the auditor: Auditors can only access evidence within the date range you set for the audit.
New evidence uploads: If you upload evidence outside the set date range, your auditor won’t have access to it unless you adjust the range.
Simply extend the audit date range to include the latest evidence upload or change.
Then, the auditor can access it after re-sampling a new evidence package.
Auditor request future date samples: If you auditor request a future date sample, there will be no reports. Automated tests generate evidence only for current or past dates.
Auditor reports missing evidence: Confirm whether the auditor requested a date outside of the range you set. If they requested within the date range, ensure that they have resampled a new evidence package.
Setting the Audit Date Range
When creating an audit in Drata, you select a specific date range. Your auditor can only access evidence within this range. Within the set date range, auditors choose specific dates to pull evidence, a process called "creating an evidence sample."
You can edit the date range later if your auditor needs access to evidence outside the originally defined scope. To view or update the audit date range:
On Audit Hub page, select the edit icon near the Audit period field.
Understanding Evidence Sampling in Drata
Auditors may occasionally request evidence for a future date that does not yet have test evidence available. Drata's automated tests runs daily, generating current or past dates.
Example Scenario: Future Date Sampling
If your auditor samples evidence for July 14, 2024, but today's date is July 2, 2024, no test evidence will exist for July 14 yet. Once that day arrives, automated test evidence will be available for the auditor to pull.
If an auditor reports missing evidence or a “blank” download, verify whether the sampled date is in the future. This may explain the absence of evidence.
Uploaded a new evidence outside the original audit data range
If you upload new evidence outside the original audit date range, your auditor won’t automatically have access to it. To grant access, adjust the audit date range to include the date you added the new evidence. Once the range is updated, your auditor must re-sample the evidence package to pull the newly added items.
Example:
Original audit date range: 7/01/2023 - 12/03/2023
You upload new evidence on 4/10/2024.
You uploaded a new piece of evidence on April 10, 2024 to a control and made other edits that you want the auditor to access.
If you upload a new piece of evidence on April 10, 2024 or make edits that you want the auditor to access, they won’t automatically have access to it. To resolve this:
On the Audit Hub page, select that specific audit, and adjust the audit date range to include April 10, 2024.
Notify the auditor that the date range has been updated.
The auditor must re-sample the evidence package to pull the new items and reflect the updates.