Use a Download-only audit when you plan to complete your audit outside of Drata, but still want to download control evidence and audit data from Drata.
This option lets you create an audit, select evidence samples yourself, and generate downloadable evidence packages—without inviting an auditor to work directly in Drata.
When to use a Download-only audit
Use this audit type if:
Your auditor works outside of Drata
You need evidence packages for external audit tools or offline review
You want to control sample selection yourself
If you want auditors to request evidence and collaborate directly in Drata, use Conduct audit in Drata instead.
Prerequisites
You must have Admin or Information Security Lead permissions
Your framework and audit period must be defined before downloading evidence
Create a Download-only audit
Go to the Compliance > Audit page.
Select Create audit.
Choose Download only.
Note:
Conduct audit in Drata creates a collaborative audit with auditor participation
Download only lets you manage samples and downloads yourself
Configure audit details
When creating the audit, you’ll define:
Framework (for example, SOC 2, ISO 27001, HIPAA)
Audit period (start and end dates)
The audit period determines which evidence is eligible for review and download.
Select audit samples
Audit samples determine which evidence is included in your download.
When selecting samples:
Sample dates must fall within the audit period
Select the relevant personnel and assets
You can edit sample selections after the audit is created
Tip: Sample selection is typically done by auditors, but in a Download-only audit, you control this step.
Review and create the audit
Review the framework, audit period, and selected samples.
Select Finish.
Drata prepares your audit environment and begins generating the evidence packages.
Download control evidence
Evidence packages may take time to generate, especially for larger audits. You don’t need to stay on the page. Drata emails the audit creator when downloads are ready.
To download evidence
Open the audit.
In Audit resources, select Download or Request evidence for Control evidence.
Download the generated
.zipfile.
The evidence package includes:
All control evidence
Audit metadata and mappings
An interactive evidence manifest