Notifications
Clear all
Topic starter
11/07/2026 1:52 pm
TL;DR: Scalable compliance now depends on structured workflows, not just better interfaces, according to Drata. The New Drata Experience focuses on bulk import, configurable tables, OpenSearch search, AI-generated cloud tests, and Actionable Insights to reduce manual GRC work and speed audit-ready execution.
NHIMG editorial — based on content published by Drata: From Vision to Execution On Day 1, we introduced the New Drata Experience
Questions worth separating out
Q: How should security teams structure GRC data so automation works reliably?
A: Security teams should define a consistent schema for risks, controls, evidence, and ownership before scaling automation.
Q: When does GRC workflow automation create more noise than value?
A: Automation creates more noise than value when records are inconsistent, control mappings are unclear, or exceptions are not assigned to a named owner.
Q: What do teams get wrong about configurable compliance tables?
A: Teams often treat configurable tables as cosmetic, when they actually shape review quality and speed.
Practitioner guidance
- Standardise GRC data schemas before enabling bulk import Define required fields, accepted values, and validation checks for risks, controls, personnel evidence, and vendor records before allowing CSV or XLSX imports into production workflows.
- Lock in review-friendly table configurations Configure pinned columns, saved filters, and row density defaults around the tasks your analysts perform most often so they do not rebuild the workspace for every review cycle.
- Govern AI-assisted test generation like any other control source Require documented mapping review, auditor validation, and ownership for every automatically generated test before it is accepted into your baseline assurance set.
What's in the full article
Drata's full post covers the operational detail this analysis intentionally leaves for the source:
- Step-by-step examples of bulk importing risks, controls, and personnel training evidence into the platform.
- Specific table configuration options, including saved filters, pinned columns, and row density preferences.
- The structure of the AI-generated cloud test library, including how tests were mapped and validated.
- Examples of Actionable Insights outputs, including pass-to-fail events and remediation trends.
👉 Read Drata's analysis of the New Drata Experience and GRC workflow scale →
GRC workflow redesign: what it means for audit-ready teams?
Explore further
11/07/2026 2:03 pm
GRC workflow sprawl has become a governance problem in its own right. When teams rely on repeated table setup, manual imports, and fragmented search to run compliance work, the tooling begins to dictate the quality of the control programme. That creates avoidable variance in evidence handling and review cycles. The field should treat workflow design as part of control design, not as a cosmetic layer.
A question worth separating out:
Q: Who is accountable when AI-generated compliance tests are used in audits?
A: The organisation remains accountable for the quality, scope, and mapping of any AI-generated compliance test. Human reviewers must confirm that each test matches the intended control objective, is appropriate for the environment, and is documented well enough for audit scrutiny. Automation changes effort, not responsibility.
👉 Read our full editorial: GRC workflow redesign is becoming a control problem, not a UI issue
