Access Certifications Are a Governance Control, Not a Compliance Checkbox

A quarterly access certification is, on paper, a control: someone with authority reviews access and confirms it’s still appropriate. In practice, a certification campaign built around raw entitlement lists and no context produces the same outcome every cycle — reviewers approve everything, because they have no real basis to do otherwise. That’s not a control; it’s an audit trail that a review happened, which is a different and much weaker thing.

Why reviewers approve everything

Put yourself in a line manager’s position, given a list of forty entitlement codes for someone on their team and asked to confirm each one is still needed. They don’t know what most of those entitlements do, they have no idea when the access was last used, and they have a day job. The rational response, given no other information, is to approve the list and move on. This isn’t a training problem or a diligence problem — it’s what happens when a review is designed without giving the reviewer anything to actually evaluate.

What changes the outcome

A few things I’ve found actually change reviewer behavior, rather than just changing the interface:

• Role-based summaries instead of raw entitlements. “Has the Accounts Payable Clerk role” is something a manager can evaluate; a list of technical entitlement codes isn’t.
• Usage and recency data. Access that hasn’t been used in six months is a meaningfully different review decision than access used daily — and most reviewers will act differently on that information if it’s presented alongside the access itself.
• Risk-tiered cadence. Reviewing privileged or high-risk access monthly and standard access quarterly, rather than treating every certification the same, focuses reviewer attention where it actually matters and reduces the fatigue that makes rubber-stamping the default for everything else.
• A visible consequence for the review. If a reviewer revokes access, they need to trust that it actually gets revoked, promptly, through the same lifecycle engine that handles JML — otherwise the certification is disconnected from any real outcome and reviewers learn that their decisions don’t matter.

Compliance evidence is a byproduct, not the goal

SOX and GDPR both require evidence that access is periodically reviewed, and it’s tempting to design the certification process around producing that evidence — a defensible audit trail — rather than around producing a genuine access decision. The two aren’t the same design target. A campaign built to satisfy an auditor’s checklist can technically comply while still leaving access unexamined; building it as a real control that happens to also produce audit evidence gets you both.

The takeaway

The certification interface and cadence are design decisions with real consequences for whether the control works or is theater. If a certification campaign is producing a 99% approval rate, that’s not usually a sign the access was fine — it’s a sign the review wasn’t designed to be evaluable.