When a control requires approval, it must be reviewed and approved by designated approvers before it can be marked Ready. Required approvals add a governance step to ensure controls are not only implemented, but formally reviewed.

The goal is to confirm that a control is ready, reviewed, and auditable.

With required approvals, you can:

Only users with write access to the Controls page can manage required approvals.

When a control requires approval, it moves through the following stages.

Select a control and scroll to the Review and approval section to view its current stage.

⚠️ If any selected control does not have an owner, an error message identifies it. Add owners before retrying.

You can remove required approvals if they are no longer needed.

When selecting controls in bulk, you can choose to Delete approvals rather than select Add approvals.

Deleting approvals:

You can reapply required approvals at any time.

Controls without required approvals follow standard readiness rules. Controls with required approvals must:

👉 Only after both conditions are met does the control status update to Ready.

This ensures readiness reflects both implementation and governance. You can filter controls on the Controls page to see which are Ready or not.

Adding evidence to an approved control changes its approval stage depending on where the update is made.

If all approvers are removed or leave the organization:

You can find these controls by filtering for:

It is crucial for organizations to both maintain and determine control readiness. With Drata, you can set up internal reviews and approvals for your controls, reducing complex processes and various tools.

Go to the Controls page and select your desired control. In the control drawer, verify that there is a Control Owner and select the Set up button next to REQUIRED APPROVALS.

The following image shows there are multiple approvers, and December 15, 2023 is the approval deadline.

You can add one or multiple approvers. If you add multiple approvers, only one approval is required. Next, select an approval deadline and select Save.

To add Required Approvals to multiple controls, go to the Controls page and select No approvals assigned under the Required approvals filter to select the desired controls. Ensure that each selected control has a control owner. If a control does not have a control owner, an error message will appear indicating which control needs a control owner.

To begin bulk adding control approvals, select Add approvals.

After selecting Save, the selected controls are located under Prepare for approvers instead of No approvals assigned.

Once a required approval for a control is set up, there are 4 different review stages the control can go through.

In the left sidebar of the Controls page, you can filter controls based on the desired review stage. If a control does not have a required approval, the control will be under the No approvals assigned filter.

During the Prepare for approvers stage, control owners prepare and manage the control information, mapping, and evidence for the approvers. Once the control is ready to be reviewed, any role with write access to the Control page, including the control owner, can select Send to approvers.

The approvers are notified and assigned the task of reviewing the control.

In the Needs approval stage, only approvers can approve or request changes.

You can add or remove approvers by selecting the edit icon.

When approvers request changes, they can select the evidence that needs to be updated and enter the request details. The reason for change request will be added into the internal notes section for that control, ensuring transparency and accountability.

After the approver sends the request, the control owner is notified, a Drata task is created, and the required approval status is updated to Changes requested.

These details are added to the internal notes section for that control.

For the review stage to be approved, the required approval must be approved and then the next approval deadline will be set. The following must occur for a control stage to be updated to Approved:

When the next approval deadline is set, 14 days prior to the approval deadline, the required approval stage changes to Needs approval and the approver is notified. The control will now move to Not Ready, given that it is not approved.

If the scheduled task fails to update the status, an event is created in Event Tracking to notify the control owner of the failed task.

Only approvers can submit a change request by selecting the Request changes button. After a change is requested, the control owner is notified.

Note: When you map an approved control that has required approvals to a policy, the control owners are notified, and the control's review status reverts to Prepare for approvers. To learn more, see Policy Center: Link your policies to your controls.

To delete an approval, select the edit icon in the Required Approvals section.

After selecting the Delete approval button, a confirmation modal will appear to ensure that this is the action you want to take.

After selecting Remove approval, the control will no longer require approval to be marked as Ready.

You can delete an approval even after it has been approved. Deleting an approval does not remove internal notes, Event Tracking history, or previous approval records.