Should organisations prioritise role modelling or recertification first?

Why sequencing depends on whether the problem is structure or throughput

role modelling and recertification solve different bottlenecks, so the right sequence depends on what is breaking down first. If entitlement data is noisy, duplicated, or impossible to interpret, recertification becomes a sorting exercise instead of a control. If the role model is already coherent, the faster win is usually to improve review workflow, reviewer quality, and deprovisioning discipline.

A useful way to think about it is that role modelling reduces complexity before the review begins, while recertification validates or removes access after the fact. When organisations try to accelerate reviews without fixing a fragmented entitlement structure, they often just review bad data faster. When they redesign roles without a reliable review cycle, they can end up with a cleaner model that still does not get enforced.

For that reason, the first question is not “which control is better?” but “which one is currently constraining the other?” If one-off entitlements, inherited access, or inconsistent naming are dominating the estate, structure is the limiting factor. If roles are already stable and the issue is review fatigue, stale approvals, or slow removal of access, the review process is the higher-value target.

How a mature role model changes recertification quality

Well-designed roles make certification campaigns smaller, clearer, and easier to action. They give reviewers a sensible baseline, make exceptions easier to spot, and reduce the number of ad hoc entitlements that must be justified one by one. That is why role design often has an outsized effect on both accuracy and speed, even though the actual review control sits later in the lifecycle. See the Role Mining and Role Design Guide for a practical approach to building a manageable role model.

This is especially important where reviews are overloaded by entitlement noise. A role model that distinguishes business roles, application roles, and exception access helps reviewers decide whether an item is normal, temporary, or truly risky. It also makes it easier to separate access that should be absorbed into a role from access that should be removed outright.

Recertification, in turn, gives the role model feedback. If the same exceptions keep appearing in every campaign, that is a sign the role design is incomplete or outdated. Treat repeated exceptions as a design defect, not just a review nuisance.

When recertification should come first

There are cases where better review execution should come first. If the organisation already has a stable role catalogue but approvals are rubber-stamped, offboarding is inconsistent, or reviewers lack context, then the fastest reduction in exposure usually comes from fixing the review and removal process. A cleaner workflow can quickly reduce dormant access even before the role model is reworked.

That same logic applies when access reviews are meant to compensate for a weak operational discipline. If roles are broadly sound but stale access persists because reviews do not trigger action, then improving closure, escalation, and evidence of removal matters more than redesigning roles. In that situation, better recertification can produce immediate risk reduction while longer-term role rationalisation continues.

Access review and certification guidance is most useful here because it focuses on removing access, not just collecting approvals. The Access Reviews and Certification Guide is a good reference for campaigns that need to cut volume, add context, and close the loop on remediation.

Risk and Threat Considerations

Poor sequencing creates two common failure modes: overinvesting in role design while recertification remains ineffective, or scaling reviews over a chaotic entitlement base until fatigue makes the control meaningless. In both cases, the control can look mature on paper while excessive access, stale access, or repeated exceptions continue to accumulate.

Failure mechanism: Fragmented roles increase review volume and ambiguity, which encourages rubber-stamping; weak recertification then fails to remove unused or inappropriate access, allowing privilege creep to persist.

Impact: The organisation ends up with slower reviews, weaker accountability, and a larger attack surface, especially where excessive access can be used for fraud, lateral movement, or misuse of privileged accounts.

Practitioner Guidance

What to prioritise: Start with the bottleneck that most directly increases review cost or control failure. If reviewers cannot tell what access is normal, stabilise the role model first; if they can tell, but nothing gets removed, fix the review and offboarding workflow first.

What to verify: Before changing sequence, check whether most exceptions are true business exceptions or artefacts of bad role structure. Also verify whether completed reviews actually result in removal, because a high completion rate without remediation is a weak signal.

Common mistake: Treating role modelling and recertification as separate programmes. In practice, each should feed the other, because recurring review exceptions are often the fastest way to find broken roles, and recurring role exceptions are often the fastest way to find weak governance.

Practitioner takeaway: Sequence should follow the dominant failure mode, not organisational preference: clean up structure first when review noise is the main problem, and strengthen review execution first when access is already understandable but not being removed.

Related resources from NHI Mgmt Group

• Should organisations prioritise external exposure or internal credential governance first?
• Should organisations prioritise role redesign or certification automation first?
• Should organisations prioritise secrets governance or role cleanup first in Salesforce?
• Should organisations prioritise automation or policy modelling first in IGA?