Export compliance evidence

When an auditor asks “prove your team filed their time,” screenshots of a dashboard do not cut it. The evidence export produces a machine-readable compliance report for any period: per-person weekly status, plus the full stream of compliance events (reminders sent, deadlines missed, locks applied, exceptions granted) that shows the controls were actually operating.

Generate an export

1. Open Organization Settings → Configuration → Timesheets and find the Compliance evidence export panel.

2. Pick the from and to dates. A single export covers up to 90 days (about 13 weeks); for a longer period, run multiple exports back to back.

3. Choose the format:

   • CSV: one row per person per week, built for ingestion into GRC tools such as Vanta, Drata, or SecurityScorecard.
   • JSON: the full payload, including the audit event stream.

4. Select Generate. The file downloads immediately, named with the date range.

What each format contains

The CSV carries, per person per week: the week start, user id and email, role, expected hours, logged hours, compliance status, and the cost at risk with its currency.

The JSON adds structure an auditor can drill into: the period summary (unique users, total person-weeks, overall compliance percentage), a per-week breakdown with the same per-user detail, the chronological list of compliance audit events for the period, and the export’s own timestamp and author.

Note

Exporting evidence is itself an audited action. Every export writes its own audit entry recording who exported, what range, and in which format, so the chain of custody is complete end to end.

Give an auditor direct access

Instead of emailing files, you can hand an external auditor a read-only way to pull the same data themselves: an API token scoped to compliance reads only. A token with that scope can fetch evidence exports and nothing else; it cannot read projects, tasks, or members, and it cannot grant or revoke compliance exceptions. Exception management always requires a signed-in Owner or Admin.

Best practices

1. Match export cadence to audit cadence. Quarterly audits → quarterly exports. Continuous compliance (SOC 2 Type 2) → monthly exports stored in the GRC tool. Don’t over-export; each one is itself an audit event.
2. Use the read-only auditor token, not file email. Email exposes the file across many recipients and lacks revocation. A scoped token can be revoked when the engagement ends and traces every fetch.
3. Archive both CSV + JSON. CSV for GRC tools, JSON for the audit trail’s complete record. The JSON also contains the event stream — losing it loses the proof-of- controls evidence.
4. Name files consistently for archival. Default naming includes the date range, but for long-term storage, also include the org slug and the export-author’s role (e.g. acme-2026Q1-admin-export.csv).
5. Test the export before an audit starts. Run a test export, verify the data matches what you expect, and confirm GRC tool ingestion works. Don’t test for the first time under audit pressure.

Troubleshooting / common pitfalls

• Export rejected with “Date range too long”. 90-day max per export. Run multiple exports back-to-back for longer periods.
• CSV row count seems low. Exempt users + users with zero expected hours don’t appear in some report views. Verify against the dashboard’s expected user count.
• Cost-at-risk currency mismatch in CSV. Onplana exports each user’s row in their rate card’s native currency. The CSV includes a currency column per row. Convert in the GRC tool, not in Onplana.
• JSON event stream is empty. No compliance events fired in the period. This is normal for orgs with strong compliance practices; the empty stream is itself evidence.
• Auditor token can’t fetch. Check the token’s scope (must include compliance-read), the token’s expiry, and the org’s IP allowlist (if set).

How this combines with other features

• Evidence + Audit log. The JSON event stream is sourced from the audit log. Every compliance event is durable.
• Evidence + Hard lock. Hard-lock events appear in the event stream as lock-applied
  • lock-lifted pairs, with timestamps. See Enforce timesheets with a hard lock.
• Evidence + Exceptions. Exception grants and revokes appear in the event stream with reasons. See Grant compliance exceptions.
• Evidence + GRC tools. CSV is designed for Vanta, Drata, SecurityScorecard, and similar platforms. The schema is stable for ingestion.

Coming from another tool

Tool	Mapping
Spreadsheet evidence export	Onplana automates this
ServiceNow Audit Export	Direct concept
Microsoft Project Online	Lacks compliance-scoped exports
Custom integration	Onplana exposes scoped READ tokens for this
GRC platforms (Vanta, Drata)	Ingest the Onplana CSV directly

FAQs

Why is there a 90-day cap? It keeps each export bounded and fast. Quarterly audit periods fit in one file; for an annual review, run four exports and ingest them together.

Which events appear in the JSON audit stream? The timesheet compliance events for the period: reminders fired, deadlines missed, hard locks applied and lifted, escalation steps advanced, exceptions granted and revoked, and prior evidence exports.

Is there a PDF format? No, CSV and JSON only. GRC platforms consume those directly, and the JSON is self-describing enough to archive as-is.

Who can run an export? Owners and Admins by default (the compliance management permission), or any holder of a compliance-scoped read-only token.

Does the export include cost-at-risk in a single currency? No — each row is in its native rate-card currency. Convert in the target GRC tool or via your reporting pipeline.

Can I schedule exports automatically? Not natively today. A workflow + webhook can drive scheduled exports via the API. Or run them via cron with the auditor token.

Does export include compliance exception reasons? Yes, in the JSON event stream. Each exception grant carries the reason field as recorded.

Related

• Monitor timesheet compliance — the live dashboard
• Grant compliance exceptions — what appears in the evidence stream
• Read audit logs — source of evidence events