Topic starter
22/07/2026 4:37 pm
TL;DR: Access certification can confirm whether a user’s role justifies access, but it cannot prove that the customers whose data is being accessed consented to the processing, according to OpenIAM. In regulated environments, that creates an architectural accountability gap between IGA and CIAM that certification alone cannot close.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “Your Access Review Process Has a Consent-Shaped Hole in It — and Auditors Are Starting to Notice”.
Key questions
Q: What breaks when access certification is used to prove consent authorization?
A: It breaks because certification and consent answer different questions.
Q: Why do separate IGA and CIAM platforms create audit risk for customer data access?
A: Because the records are split across two control planes.
Q: How do you know if access reviews are actually covering regulated data use?
A: Check whether the certification workflow can display the current consent scope for the specific customer data being reviewed.
Practitioner guidance
- Map the consent boundary into access reviews Identify every certification campaign that includes customer personal data and verify whether the reviewer can see the current processing purpose and consent scope for that dataset.
- Separate role approval from lawful processing evidence Document which controls prove entitlement and which controls prove consent-authorized processing, then stop using one as a substitute for the other in audit evidence.
- Test the certification workflow against a real regulated dataset Pick one customer-data entitlement and ask whether the workflow can show that the access falls within current consent state at the moment of review.
Bottom line: Access certification is necessary for entitlement governance, but it does not prove that customer data processing is consent-authorised.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:42 pm
Access certification is a role control, not a processing-law control: That distinction becomes decisive once customer personal data enters the environment. Access reviews can prove that a user still needs an entitlement, but they cannot prove that the data being touched is within the consent boundary for the processing purpose. The implication is that regulated enterprises should stop treating certification as a proxy for lawful access.
A question worth separating out:
Q: When should organisations treat consent as part of access governance?
A: They should do so whenever internal users can reach customer personal data and the organisation is operating under GDPR, financial services oversight, or similar regulated conditions. In those cases, access governance is incomplete unless the consent state that governs the underlying data processing is part of the control evidence.
👉 Read our full editorial: Access review misses consent governance in regulated data access