What evidence do auditors expect from automated access certifications?

What auditors actually look for in an access certification record

Auditors are usually not trying to see whether a review was “done” in the abstract. They want evidence that the certification campaign had a defined scope, that the reviewer made an explicit decision, and that each decision can be traced to the entitlement being tested. For an access review and certification process, the record has to show more than a dashboard completion state.

The core evidence is the review artifact itself: who was reviewed, what access was in scope, who approved or rejected it, when the decision was made, and whether any exceptions were recorded. If the campaign covered privileged, application, or service access, auditors will usually expect the review to identify those entitlements clearly enough that a control tester can reconstruct the exact population from the system of record or identity governance workflow.

Good evidence also preserves the link between decision and outcome. That means unresolved removals should not disappear into a status summary, they should show the remediation owner, the due date, the completion date, and any approved exception or compensating control. Where organizations use an IGA tool, auditors often prefer evidence that the review was not just initiated and signed off, but closed through a governed workflow with escalation and follow-up.

How automation helps, and where it can fail audit testing

Automation is useful when it preserves lineage. A machine-generated review is only audit-worthy if it still shows the reviewer, the reviewed entitlement, the decision timestamp, the reviewer’s rationale when required, and the disposition of any unresolved items. In practice, that often means the review record must remain searchable, exportable, and immutable enough to survive a sampling exercise across campaigns and periods. Auditors care less about the tool name than whether the evidence can be reproduced on demand.

Automation fails audit testing when it turns review activity into a detached status label such as “approved” or “completed” without preserving the underlying objects. A reviewer’s bulk approval is weak evidence if the system cannot demonstrate what was actually examined. The same problem appears when remediation is handled outside the workflow and no longer maps back to the original entitlement. A review is strongest when the evidence shows both the certification decision and the lifecycle state of the access after the decision.

For recurring campaigns, auditors also look for consistency. If one quarter’s certifications include comments, exceptions, and tickets but the next quarter only contains aggregate completion counts, the control will look brittle even if the campaign technically ran. Strong evidence is repeatable across campaigns, reviewers, systems, and review types, including exceptions handling for non-remediated access. That is why many teams treat audit evidence for access governance as a workflow design problem, not a reporting problem.

What to retain so the control can be tested end to end

The most useful audit pack usually contains a small set of repeatable artifacts: the campaign scope or policy rule that generated the review, the population of entitlements or identities reviewed, the reviewer assignment, the individual decisions, the exception trail, and the remediation evidence for items not approved. If the review is risk-based, retain the rule or logic used to target the population so an auditor can see why some access was reviewed and some was not.

It also helps to retain evidence of control operation around the review itself, such as notifications sent, reminders, overdue escalations, and closure confirmation. These are not decorative extras. They show that the campaign was not just opened, but managed to completion, and that unresolved access was tracked through to removal, reapproval, or formal acceptance. A review program becomes much harder to defend when the evidence lives in email threads instead of a controlled record.

For mixed environments, the review record should be clear enough to distinguish human user access from service, application, or shared entitlements when those are in scope. Auditors do not need every implementation detail, but they do need enough structure to confirm that the same control logic was applied consistently to the entitlement population being certified. When access governance touches many systems, identity visibility can make that traceability much easier to prove.

Risk and Threat Considerations

Weak certification evidence creates a real control gap because the organization may be unable to prove that excess access was reviewed, challenged, or removed. The risk is not only audit failure, it is also that stale or overprivileged access remains in place while the control appears to be operating. In high-volume environments, that can turn into repeated rubber-stamping with little actual risk reduction.

Failure mechanism: Automation hides the decision trail, the entitlement context, or the remediation outcome, so the certification record no longer supports independent testing of the control.

Impact: Auditors may rate the control ineffective or partially effective, and the organization may retain unauthorized or excessive access without a defensible record of review or removal.

Practitioner Guidance

What to verify: Before relying on an automated certification, verify that each record can be traced from campaign to entitlement to reviewer decision to remediation status. If you cannot reconstruct that chain from exported evidence, the control is too weak for audit use.

Common mistake: Treating completion metrics as proof of review quality. A high completion rate does not help if the system cannot show what was reviewed, which decision was made, and whether unresolved items were actually closed.

What good looks like: An auditor can sample any certified access item and see the exact entitlement, reviewer, date, decision, exception note if present, and the final disposition of any follow-up task without chasing screenshots or email.

Practitioner takeaway: Automate the workflow, but preserve the evidence chain, because auditors judge access certifications by traceability and closure, not by whether the campaign merely finished.

Related resources from NHI Mgmt Group

• What evidence should auditors expect from privileged access controls?
• Who should be accountable when risky access is disabled, and what evidence should auditors expect to see?
• What should auditors expect when access evidence lives in spreadsheets?
• How should security teams run access reviews for non-human identities?