How should organisations reduce certification fatigue in large IGA campaigns?

Break campaigns into smaller risk-based review sets, prioritise privileged and unusual access, and improve entitlement context before asking humans to decide. Certification fatigue is usually a design problem, not a reviewer problem. If managers are asked to judge thousands of items without clear ownership or purpose, rubber stamping becomes the default outcome.

Why This Matters for Security Teams

certification fatigue turns access reviews into a compliance ritual rather than a control. In large IGA campaigns, reviewers are often asked to validate thousands of entitlements with limited context, weak ownership data, and little sense of business impact. That produces the same failure mode seen in overgrown NIST Cybersecurity Framework 2.0 programs: lots of activity, weak assurance.

The practical issue is not that managers are unwilling to help. It is that human attention is finite, while entitlement graphs are usually noisy, stale, and poorly explained. When access packages include dormant accounts, inherited permissions, and shared service identities, reviewers cannot reliably tell what is normal from what is risky. That is why reduction strategies should start with scope design, not reminder emails. The most useful campaigns feel like decisions, not homework. NHIMG’s Ultimate Guide to NHIs — What are Non-Human Identities is a useful reminder that identity sprawl is often the root condition behind poor review quality. In practice, many security teams encounter rubber-stamping only after managers have already been flooded with thousands of low-context items.

How It Works in Practice

Reducing certification fatigue means making each review narrower, more relevant, and easier to decide. Start by segmenting campaigns into risk-based review sets: privileged access first, then externally exposed systems, then high-change or unusual entitlements, and only then the long tail of routine access. That sequencing matters because human reviewers are best at judging exceptions, not bulk inventories.

Good campaigns also improve entitlement context before the review starts. For each item, show the last use date, entitlement source, approver, owner, associated application, business function, and whether the access is inherited, direct, or shared. If a reviewer cannot understand why an entitlement exists, the control has already failed.

• Use business-purpose labels so reviewers see why access exists, not just what it is called.
• Pre-filter obvious low-risk items such as inactive accounts, expired access, and duplicated entitlements.
• Escalate privileged, toxic, or unusual combinations to smaller specialist reviewers.
• Use exceptions for outliers, not full-portfolio review for every user.

There is also a strong case for workflow redesign. Current guidance suggests shorter review windows, fewer items per reviewer, automated pre-approval of unchanged low-risk access, and manager feedback loops after each campaign. The NIST Cybersecurity Framework 2.0 supports this kind of risk-based operational improvement, while NHIMG’s Sisense breach research reinforces why entitlement context and ownership clarity matter when access is challenged after the fact. These controls tend to break down when entitlement data is fragmented across multiple systems because reviewers then certify metadata quality rather than actual access risk.

Common Variations and Edge Cases

Tighter certification scope often increases operational overhead, requiring organisations to balance reviewer effort against coverage breadth. That tradeoff is unavoidable, especially in enterprises with many business units, shared services, and outsourced administration.

One common edge case is when access data is incomplete. If owners, business justification, or usage history are missing, the campaign becomes a manual investigation exercise. Best practice is evolving here, but current guidance suggests pausing full-scale recertification until the entitlement catalogue is enriched enough to support meaningful decisions.

Another variation is delegated or multi-level review. Large organisations often use line managers for ordinary access and application or control owners for privileged access. That works only if decision rights are explicit; otherwise items bounce between reviewers and fatigue increases. A smaller campaign with precise reviewers is usually better than a broad campaign with vague accountability.

Finally, some teams assume automation can eliminate fatigue entirely. It cannot. Automation can suppress unchanged low-risk access, group similar items, and detect exceptions, but human judgment is still needed for unusual privilege, segregation-of-duties conflicts, and business-critical systems. The key is to reserve reviewer attention for decisions that actually change risk.

Related resources from NHI Mgmt Group

• How can organisations reduce the blast radius of compromised agent identities?
• How do organisations reduce the dwell time of exposed credentials at scale?
• Why do certification campaigns slow down in large organisations?
• How should organisations reduce certification fatigue in IAM programmes?