Internal audits in Audit Hub allow you to plan, run, and manage internal audits directly in Drata using the same workflow used for external audits. This keeps audit requests, evidence, and collaboration in one place and eliminates the need to export to spreadsheets or use a separate tool.
With internal audits, you can:
Create an internal audit from the Audit Hub wizard.
Assign Internal Auditors from your synced user directory.
Manage requests and evidence using the same workflow as external audits.
Clearly distinguish internal audits from external audits at a glance.
Required Drata roles: Drata Admin; Internal Auditor
Roles and permissions
Drata Admin
Creates internal audits.
Assigns Internal Auditors.
Manages audit configuration.
Uploads and manages evidence.
Internal Auditor
Has access only to internal audits they are assigned to.
Can create and manage requests within those audits.
Can collaborate in the Messages panel the same way an external auditor would in an external audit.
Can view evidence attached to requests.
Cannot upload or delete evidence in this phase.
Create an internal audit
In the left navigation, go to Compliance, then select Audits.
Select Create audit.
Under Audit type, select Internal audit and Conduct audit in Drata
Under Audit details:
Select the Framework.
Set the Audit period.
Select Continue.
On the Assign internal auditors step:
Select one or more users to assign.
Only users synced through your identity provider (IDP) appear as options for Internal Auditors.
If you select Add new auditor, you can add only auditors outside your organization. Internal personnel must be selected from your IDP-synced users.
When finished, select Continue.
On the Review step, confirm:
Audit type: Internal
Framework
Audit period
Assigned internal auditors (names and email addresses)
Select Continue to create the audit.
After creation, the audit appears on the Audits list as a card labeled Internal audit under the framework name.
Select Start audit or Open audit to begin working through requests.
Manage an internal audit
Internal audits reuse the existing request list, Messages panel, and evidence workflow from external audits.
During the audit:
Internal Auditors create and manage requests within audits they are assigned to.
Admins and other authorized users upload evidence to requests.
Internal Auditors review evidence and collaborate in the Messages panel.
Internal Auditors cannot upload or delete evidence in this phase.
Internal audits are labeled as Internal on audit cards and in the audit header so you can easily distinguish them from external audits.