Topic starter
05/10/2026 6:49 pm
TL;DR: Nexis says its 11 Nov 2026 lunch-and-learn shows how recertification campaigns can use a customizable third decision path instead of only approve or remove, with follow-up workflow branching configured live in the platform. That matters because rigid certification outcomes can obscure real governance intent and force teams into false binary decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Nexis: “Flexible Recertification Decisions: Beyond Approve or Reject”.
Questions worth separating out
Q: How should teams design recertification campaigns when approve or reject is not enough?
A: Design the campaign around the decisions reviewers actually make, not around a forced binary.
Q: What breaks when recertification workflows only allow approve or remove?
A: They collapse nuanced governance into a false binary, which can distort audit trails and produce misleading certification evidence.
Practitioner guidance
- Define a third recertification outcome Document the real cases where reviewers need something other than approve or remove, then map those cases to one explicit workflow state.
- Separate decision state from downstream action Record the reviewer decision and the follow-up process as different elements so audit evidence does not blur intent and execution.
- Limit the third option to a narrow use case Give the custom state a clear purpose, such as exception handling or additional validation, and avoid using it as a generic holding pen.
What to expect at the briefing
Nexis's full Lunch & Learn covers the operational detail this post intentionally leaves for the source:
- A live setup of a customizable third recertification decision in the NEXIS Platform
- Workflow branching details showing how the third option gets its own follow-up process
- A practical use case for applying the third state in IAM and GRC campaigns
- Short live demonstration context from the NEXIS Hacks lunch-and-learn format
👉 Read Nexis's Lunch & Learn on flexible recertification decisions →
Recertification campaigns: what does a third option change for IAM?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
05/10/2026 6:49 pm
Flexible recertification is a governance model, not just a workflow convenience. Binary certify-or-remove logic assumes every access review can be reduced to a final yes or no at the moment of review. Real IAM and GRC programmes often need a third state for deferral, exception handling, or additional validation, and that state should be visible in the control record. The practitioner conclusion is that certification design must reflect governance reality, not reporting simplicity.
A question worth separating out:
Q: Should IAM and GRC teams use a third recertification state for every campaign?
A: No. Use it only where the governance decision genuinely needs a separate path and a distinct operational follow-up. If the extra state is not tied to a specific outcome, it adds complexity without improving recertification quality or accountability.
👉 Read our full editorial: Flexible recertification decisions beyond approve or reject