Notifications
Clear all
Topic starter
25/06/2026 1:33 am
TL;DR: Access certification can be automated to reduce review fatigue, improve audit outcomes, and help teams revoke unneeded access across systems, data, and IT resources, especially when certifications span developers, third parties, and remote systems, according to SailPoint. Manual review cycles still create orphaned accounts and rubber-stamped approvals, so the control problem is governance quality, not just review volume.
NHIMG editorial — based on content published by SailPoint: Fundamentals of Access Certification and Compliance
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should security teams improve access certification without creating reviewer fatigue?
A: Security teams should reduce the number of low-value decisions each reviewer sees by grouping stable access, prioritising unusual or privileged entitlements, and pre-classifying items that rarely change.
Q: When does access certification fail as a control?
A: Access certification fails when reviewers cannot distinguish genuine business need from inherited or stale access, or when the process is so large that people approve by habit.
Q: What do organisations get wrong about access reviews?
A: Organisations often treat access reviews as a compliance formality rather than a governance decision.
Practitioner guidance
- Prioritise high-risk access first Sort certification queues so never-reviewed, recently changed, uncommon, and privileged entitlements are reviewed before standard low-risk access.
- Close the loop on revocations Require every certification campaign to produce a tracked removal workflow for entitlements that are not re-approved.
- Extend certification beyond employees Include third-party partners, developers, and system-connected accounts in the same governance model when they can retain access over time.
What's in the full article
SailPoint's full blog covers the operational detail this post intentionally leaves for the source:
- AI-driven recommendation logic used to prioritise review items and reduce reviewer burden
- Configuration-based workflow examples for access certification campaigns and remediation
- Reporting templates and dashboards mapped to compliance evidence needs
- Examples of how the product organizes never reviewed, uncommon, standard, and unchanged access
👉 Read SailPoint's blog on access certification automation and compliance →
Access certification fatigue: what IAM teams need to fix?
Explore further
25/06/2026 11:00 am
Access certification fails when review quality is treated as an administrative problem instead of a control problem. The article correctly points to audit failure and rubber-stamping, but the deeper issue is that certification only works when reviewers can distinguish justified access from inherited access. When entitlement volume grows faster than reviewer context, certification becomes a record of activity rather than a judgment on necessity. The implication is that identity governance teams must treat review design as a security control, not an audit afterthought.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: Who should be included in access certification programmes?
A: Access certification should include anyone or anything that can accumulate privilege over time, including employees, third-party partners, developers, and connected accounts. If an identity can retain access after the original business need changes, it belongs in the certification model. Scope should reflect access risk, not only organisational chart boundaries.
👉 Read our full editorial: Access certification automation is reshaping audit readiness
