title: Compliance Reporting category: Compliance Frameworks tags: compliance, reporting, evidence, audit, export priority: Normal

Compliance Reporting

IdentityCenter provides comprehensive reporting capabilities designed to satisfy both internal governance needs and external audit requirements. This article covers the available report types, export options, automated scheduling, and best practices for audit preparation.

Report Types

IdentityCenter includes five primary compliance report types, each serving a distinct audience and purpose:

Framework Compliance Summary

Provides a high-level view of your compliance posture across one or more active frameworks.

This report is ideal for executive stakeholders and board-level reporting where a summary view of compliance status is needed.

Policy Violation Report

Lists all active violations across selected policies, with filtering and grouping options.

Filters allow you to narrow results by framework, severity, status, date range, organizational unit, or specific policy.

Remediation Status Report

Tracks the progress of violation remediation efforts across your organization.

This report is critical for demonstrating to auditors that your organization actively addresses compliance gaps.

Access Review Completion Report

Summarizes the status and outcomes of access review campaigns tied to compliance requirements.

Access review reports are frequently required for SOX, HIPAA, and PCI-DSS audits to demonstrate periodic access certification.

Control Effectiveness Report

Evaluates how well each control is performing over time, helping you identify areas that need attention.

A high recurrence rate indicates a systemic issue that may require process changes rather than individual remediation.

Exporting Reports

All reports can be exported in multiple formats:

To export a report:

1. Navigate to the report in the Compliance Center or Reports section
2. Configure your filters (date range, framework, severity, etc.)
3. Click the Export button in the toolbar
4. Select the desired format
5. Choose whether to include charts and summary sections (Excel and PDF only)
6. The file downloads to your browser

Tip: For recurring audit needs, save your filter configuration as a report template. This ensures consistent reporting across audit periods.

Scheduling Automated Reports

IdentityCenter can generate compliance reports on a schedule and deliver them automatically via email.

Configuring a Scheduled Report

1. Navigate to Administration > Reports or the Compliance Center
2. Select the report type you want to schedule
3. Configure filters and parameters
4. Click Schedule Report
5. Set the schedule:

6. Configure delivery recipients (email addresses)
7. Select the export format (CSV, Excel, or PDF)
8. Save the schedule

Scheduled reports are processed by the background job scheduler and delivered as email attachments.

Evidence Collection for Auditors

When preparing for an external audit, you need to provide evidence that your controls are operating effectively. IdentityCenter simplifies this process by consolidating identity governance data into auditor-friendly formats.

What Auditors Typically Request

Building an Audit Evidence Package

To assemble a complete evidence package:

1. Define the audit period - Set your report date range to match the audit window (e.g., fiscal year)
2. Generate framework summary - Export the Framework Compliance Summary for each relevant framework
3. Export violation history - Include both open and resolved violations to show remediation activity
4. Include access review results - Export all campaigns completed during the audit period
5. Document exceptions - Export the exception register with business justifications
6. Attach policy definitions - Export your policy configurations to show what rules are being enforced
7. Include trend data - Show compliance score improvement over the audit period

Mapping IdentityCenter Data to Audit Requirements

Different frameworks emphasize different aspects of identity governance. Use the following mapping to ensure your reports address the right requirements:

Dashboard Metrics

The Compliance Center dashboard provides real-time metrics that summarize your compliance posture:

These metrics can be viewed for a specific framework or aggregated across all active frameworks.

Best Practices for Audit Preparation

1. Generate reports consistently - Run the same reports monthly so you have continuous evidence, not just point-in-time snapshots at audit time.

2. Archive historical data - Export and store compliance reports at the end of each reporting period. Auditors may request data spanning multiple years.

3. Automate wherever possible - Use scheduled reports to reduce the manual effort required during audit preparation.

4. Validate data accuracy - Before submitting reports to auditors, verify that the data matches your expectations. Cross-reference a sample of violations with the actual directory state.

5. Prepare a narrative - Reports alone do not tell the full story. Prepare a brief narrative explaining your compliance program, how IdentityCenter supports it, and how you handle exceptions.

6. Track remediation diligently - Auditors focus heavily on how you respond to findings. Demonstrate that violations are acknowledged, assigned, and resolved within defined timeframes.

7. Review exception register - Ensure all active exceptions have current justifications and have not expired. Expired exceptions with open violations are audit findings.

Next Steps

• Compliance Frameworks Overview - Understand the frameworks available in IdentityCenter
• Activating Compliance Frameworks - Activate and configure frameworks
• Policies Overview - Learn about the policy engine that drives compliance
• Access Reviews Overview - Conduct access review campaigns for compliance evidence
• Dashboard & Reporting - Explore the broader reporting capabilities