Using Vanta's Internal Audit Option for Self-Audits Before External Audits: Tips and Insights

·Jun 10, 2026 02:32 PM·

Hi everyone! Is anyone using the "internal" option when creating an audit in Vanta to perform a self-audit prior to your external audit? I would love to know how you are utilizing this option as well as any documentation or process tips you can share. I am working on not only looking at our audit through my GRC eyes, but also through the lens of an auditor. Thank you!

👀2

6 comments

· Sorted by Oldest

Jacob G.
·
·
Hey Olena A. April J. Roze S. Samuel M.! Wanted to bring some of you into this discussion as I saw in your intros you mentioned using Vanta for audit readiness. Do you have any experience using the internal option that would potentially shed some more light for Katrina D.? If you don't, thats okay too! But wanted to make sure I included you in the conversation 🙂
April J.
·
·
Haven't done that, but it sounds like a really great idea. What I've found is that our auditors end up creating a lot of their own custom evidence requests in Vanta and there are seemingly a lot of overlaps...so it might be useful post-audit to review the delta with an auditor and see if you can better prepare for next go-round. I might use the internal audit for upcoming ISO 42001 readiness assessment though!
2
1
2
Olena A.
·
·
Jacob G. Apologies for the delay in responding - I’ve been very busy recently, but I am back now and will answer all the questions where I was tagged
Olena A.
·
·
Regarding the internal audit - I did not create it because it is kind of pointless when we have just one framework, and the tests and documents are already in place, so I can just see the status, and remediate the issues on an ongoing basis, rather than do it once within the scope of internal audit. I understand that when internal audit is a compliance requirement (e.g. for SOX or ISO), it can be useful to have a snapshot and documented record that internal audit was conducted, but for SOC 2, we use ongoing compliance monitoring control instead of a point-in-time audit. What I would find useful is that if we could create an internal audit project that is not tied to any exact frameworks, and can run it on an ad-hoc basis when we want to audit some process/operation/product, if that makes sense
Katrina D.
·
·
Thank you Olena A. for your response. My hang up now is that when you create an internal audit you do not have the option to mark items as complete. I want to basically mimic the external audit. I also use our ongoing compliance monitoring in Vanta instead of a point-in-time audit. This would be mainly a pre-audit prep item or if we are doing a gap analysis for a new framework.
Jacob G.
·
·
hey Olena A. no worries at all! Whenever you have the time to pop in, feel free. Thank you for offering your POV here. 🙇

Using Vanta's Internal Audit Option for Self-Audits Before External Audits: Tips and Insights | Vanta Community

Jacob G.
·
·
Hey Olena A. April J. Roze S. Samuel M.! Wanted to bring some of you into this discussion as I saw in your intros you mentioned using Vanta for audit readiness. Do you have any experience using the internal option that would potentially shed some more light for Katrina D.? If you don't, thats okay too! But wanted to make sure I included you in the conversation 🙂
April J.
·
·
Haven't done that, but it sounds like a really great idea. What I've found is that our auditors end up creating a lot of their own custom evidence requests in Vanta and there are seemingly a lot of overlaps...so it might be useful post-audit to review the delta with an auditor and see if you can better prepare for next go-round. I might use the internal audit for upcoming ISO 42001 readiness assessment though!
2
1
2
Olena A.
·
·
Jacob G. Apologies for the delay in responding - I’ve been very busy recently, but I am back now and will answer all the questions where I was tagged
Olena A.
·
·
Regarding the internal audit - I did not create it because it is kind of pointless when we have just one framework, and the tests and documents are already in place, so I can just see the status, and remediate the issues on an ongoing basis, rather than do it once within the scope of internal audit. I understand that when internal audit is a compliance requirement (e.g. for SOX or ISO), it can be useful to have a snapshot and documented record that internal audit was conducted, but for SOC 2, we use ongoing compliance monitoring control instead of a point-in-time audit. What I would find useful is that if we could create an internal audit project that is not tied to any exact frameworks, and can run it on an ad-hoc basis when we want to audit some process/operation/product, if that makes sense
Katrina D.
·
·
Thank you Olena A. for your response. My hang up now is that when you create an internal audit you do not have the option to mark items as complete. I want to basically mimic the external audit. I also use our ongoing compliance monitoring in Vanta instead of a point-in-time audit. This would be mainly a pre-audit prep item or if we are doing a gap analysis for a new framework.
Jacob G.
·
·
hey Olena A. no worries at all! Whenever you have the time to pop in, feel free. Thank you for offering your POV here. 🙇