The access review nobody dreads

Ask a manager to certify four hundred entitlements in a spreadsheet and you'll get four hundred approvals in eleven minutes. A review that approves everything verifies nothing, and a sterner reviewer won't change that. What helps is a smaller queue of riskier items, each one explained. A certification campaigndefinitionA scheduled review in which managers or owners confirm, person by person, whether each one should keep the access they hold. fails as a design problem long before it fails as a compliance problem.

Auditors have noticed. They now routinely write up approval rates above 98% with median decision times under two seconds, since that's evidence the control exists only on paper. We'd make three changes to turn the quarterly ordeal into a control that holds.

Reviewers approve everything because the campaign gives them no basis to do anything else. A raw entitlementdefinitionA specific permission or access right a person holds in a system, such as the ability to post journal entries in a finance app. name such as SAP_FI_GL_DISP_014 carries no meaning to the manager certifying it, so the rational move is bulk approval. Before any scoring, the campaign has to translate: what the entitlement grants in business terms, when it was last used, and whether it collides with anything else the person holds. If your identity data can’t answer those three questions, fix the data first. A certification built on entitlement sprawl and orphaned accounts just launders bad data into signed attestations.

Most access in a healthy organization is boring: birthright entitlements, unchanged since the last campaign, matching the peer group. Certify it by policy and get it out of the human queue. What reaches a reviewer should be the exceptions, ranked. Segregation of dutiesdefinitionA rule that no one person should hold two powers that together allow fraud, such as creating a vendor and approving payment to it. (SoD) conflicts come first: the create-vendor-and-pay-vendor combinations that fraud audits exist for. Then come dormant access unused in 90+ days, peer-group outliersdefinitionPeople holding an entitlement that almost nobody else in their role has. That alone makes them worth a closer look. holding entitlements almost nobody in their role holds, privileged accounts, and access that survived a recent transfer. A reviewer facing twelve ranked items with plain-language reasons makes twelve real decisions. A reviewer facing four hundred flat rows makes one decision, four hundred times.

The SoD model underneath deserves real engineering, because role-level rules miss most real conflicts. “Accounts payable clerk cannot also be vendor admin” sounds rigorous until you find the conflict living inside one role, granted by two entitlements nobody mapped. Model the rules at entitlement level, run them preventively at request time so toxic combinations are refused before they exist, and detectively at certification so the ones that slipped through arrive at the top of the queue with the conflict spelled out. The same event-driven thinking shrinks the campaigns themselves: a transfer between departments should trigger a targeted micro-certificationdefinitionA small, targeted review set off by an event, a department transfer for example, that covers just the access the person kept. of the access the mover kept (five items, one reviewer, this week) instead of waiting for quarter-end to notice the finance analyst who still holds their old HR entitlements.

# q3 certification: scoped by risk, not org chart
campaign: q3-user-access-review
auto_certify: low-risk · unchanged · peer-aligned  // 82% of items
queue[1]: sod_conflict → create_vendor + approve_payment
queue[2]: dormant_90d · peer_outlier · post_transfer
revoke_action: auto-deprovision + closure check
✓ median reviewer time: minutes · evidence: continuous

A revocation decision that ends in a ticket is a wish. Auditors have learned to sample for exactly this gap, tracing certified revocations to target systems where the access is still alive. So the campaign has to drive deprovisioning automatically and then check the access is actually gone, with the confirmation logged next to the decision. People call that closed-loop remediationdefinitionRevoking access automatically and then checking the target system to confirm it is really gone, with that confirmation recorded.. Do it and the evidence auditors want comes for free, since you already know who reviewed what on which signals and what was revoked, and you can prove it stayed revoked. In our identity governance engagements the audit conversation shrinks to an export because the campaign has been emitting its own proof all along. Nobody books a preparation meeting or goes hunting for screenshots. The review nobody dreads is the one that documents itself.