What goes in an IT compliance dashboard in Metabase?

An IT compliance dashboard tracks control attestation across frameworks — pass rates, evidence freshness, exceptions with owners, audit-finding burndown, and access reviews. It's the audit-cycle companion to the compliance posture dashboard: that page shows what your security platform's monitors see; this one shows what your auditor will ask about. Metabase builds it from GRC exports or a controls table in your warehouse.

What does an IT compliance dashboard look like?

Here’s the layout this guide builds. The attestation headline sits at the top — controls monitored, failing, exceptions, overdue evidence, open findings — so the weekly review opens on one row; controls and evidence come next because pass rate and freshness are what slip between audits; the bottom section tracks the audit cycle itself: finding burndown, access-review progress, and the exception table the review meeting walks through.

Which cards belong on an IT compliance dashboard?

The eight below cover the three questions an audit cycle turns on: are the controls passing, is the evidence current, and are the known gaps being worked down?

• Overall control pass rate — latest test result across all active controls (gauge)
• Control pass rate by framework — SOC 2, ISO 27001, PCI DSS, HIPAA side by side (row)
• Failing controls by domain — where the gaps cluster (bar)
• Evidence status by framework — current, due within 30 days, overdue (stacked bar)
• Audit-finding burndown — open findings per week since the last audit (line)
• Access reviews completed — this quarter’s reviews against the due count (progress)
• Open exceptions by age — under 30 through over 90 days (row)
• Open exceptions by owner — the worklist, with control, framework, age, and expiry (table)

What data does the dashboard need?

• A controls table — control_id, name, domain, owner, active — plus a control_framework_map linking each control to the frameworks it satisfies.
• control_tests with control_id, tested_at, and status — the latest row per control drives every pass-rate card.
• An evidence table with collected_at and a per-item refresh_days cadence, for the freshness buckets.
• exceptions with owner, opened_at, expires_at, and the control they cover; findings with opened_at and closed_at for the burndown.
• Access-review records per quarter — system, reviewer, due_at, completed_at — for the progress card.

How do you build it?

1. Export control and evidence state from your GRC platform daily — Drata and Vanta both have APIs, and a spreadsheet-based program can load its sheets into the warehouse as-is.
2. Model “current status” once: a view that takes the latest test per control and joins the framework map, so every pass-rate card shares one definition.
3. Compute evidence freshness as now() - collected_at against each item’s cadence, bucketed into current / due soon / overdue.
4. Build the exception and finding cards from their own tables — age buckets for exceptions, weekly open-count for the finding burndown — and keep “exception” strictly separate from “failing control.”
5. Add filters for framework, control owner, and date range; subscribe control owners to a weekly digest so the exception table arrives in their inbox before the review meeting.

Example card SQL

SELECT
f.framework,
COUNT(DISTINCT c.control_id)                          AS controls,
COUNT(DISTINCT c.control_id)
  FILTER (WHERE t.status = 'fail')                    AS failing_controls,
ROUND(
  100.0 * COUNT(DISTINCT c.control_id)
            FILTER (WHERE t.status = 'pass')
    / NULLIF(COUNT(DISTINCT c.control_id), 0), 1
)                                                     AS pass_rate_pct,
COUNT(e.evidence_id)
  FILTER (WHERE e.collected_at
            < now() - (e.refresh_days || ' days')::interval)
                                                      AS evidence_overdue
FROM controls c
JOIN control_framework_map f USING (control_id)
LEFT JOIN LATERAL (
SELECT status
FROM control_tests
WHERE control_id = c.control_id
ORDER BY tested_at DESC
LIMIT 1
) t ON true
LEFT JOIN evidence e USING (control_id)
WHERE c.active
GROUP BY f.framework
ORDER BY pass_rate_pct ASC;

Related

Metrics

Integrations

Dashboards

FAQ