Access certification checks whether existing access should remain in place, while provisioning grants or removes access in the source system. A strong program links the two so that review decisions trigger real entitlement changes and the result is validated for audit evidence.
What each control stage is responsible for
Access certification is a review decision: it asks whether a user, role, app, or service should still have a given entitlement. Provisioning is an execution action: it creates, updates, or removes that access in the system of record or target application. The distinction matters because review without follow-through leaves risk in place, while provisioning without review can turn process into blind accumulation.
In mature programs, certification is the governance checkpoint and provisioning is the entitlement change. That is why access review outcomes should flow into lifecycle workflows, not remain as comments or spreadsheet decisions. IAM and IGA Basics is a useful reference when you want the broader relationship between governance, entitlements, and lifecycle control.
For that same reason, teams often treat certification as evidence of need and provisioning as evidence of enforcement. If the source system is not changed, the certification result is incomplete; if access is changed without a documented entitlement decision, the provisioning action lacks governance context.
Why the two are often confused in practice
They are both part of identity governance, so they are easy to blur together, especially in access review campaigns. Certification is about attestation, recertification, and exception handling. Provisioning is about joiner, mover, and leaver execution, plus ongoing entitlement changes after a role change, manager change, or access request.
The confusion usually appears when organisations rely on review tools that look authoritative but do not connect to downstream change workflows. A reviewer may approve removal, but unless the workflow reaches the target system, the access still exists. Access Review Checklist is relevant where you need the operational detail behind review scope, evidence, and follow-up.
Provisioning can also happen for reasons that have nothing to do with a certification cycle, such as onboarding, role changes, or emergency access. That is why certification should be seen as one control input to provisioning, not a synonym for it.
What changes when review and provisioning are tied together
The important design choice is whether access review decisions automatically trigger entitlement changes, or whether the two processes remain separate and manually reconciled. When they are linked, you get a closed loop: review, execute, verify, and retain evidence. When they are not linked, organisations often end up with rubber-stamped reviews, stale access, and weak auditability.
That closed loop becomes even more important when the reviewed access includes privileged accounts, shared accounts, or machine identities that can keep working long after a human owner thinks they have been removed. Joiner-Mover-Leaver (JML) Guide is a practical reference for the provisioning side of that lifecycle, especially where access must be revoked or adjusted as people and systems change.
Good programs also validate the outcome, not just the ticket closure. That means checking that the entitlement really disappeared from the target system, that the change is attributable to the review decision, and that the record is good enough for audit or incident investigation.
Risk and Threat Considerations
When certification and provisioning are separated, the main risk is entitlement drift: access that was formally questioned but never actually removed, or access that was added and never reconciled. The same gap can leave excessive privilege in place long after the business reason has ended.
Failure mechanism: A reviewer approves removal, but the provisioning workflow fails, is delayed, or never reaches the target system, so the entitlement remains active.
Impact: Unnecessary access persists, audit evidence becomes weak, and attackers or insiders may retain a path to sensitive systems through stale entitlements.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Governed review-to-change lifecycle for accounts and entitlements. |
| AC-6 — Least Privilege | Access certification and provisioning both shape whether excess privilege persists. | |
| AU-6 — Audit Review, Analysis, and Reporting | Audit evidence depends on linking review decisions to executed entitlement changes. | |
| Recommendation — Link certification decisions to account changes and verify completion. Remove unnecessary access and revalidate entitlement necessity. Retain evidence that review outcomes were enforced and traceable. | ||
| CIS Controls v8 | CIS-5 — Account Management | Directly addresses provisioning, access review, and removal of stale accounts. |
| Recommendation — Inventory accounts, review access, and remove unneeded entitlements promptly. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Separates access governance decisions from technical enforcement of access changes. |
| Recommendation — Define who approves access and ensure approved changes are implemented. | ||
Practitioner Guidance
What to verify: Do not trust a certification result until you can see the downstream entitlement change in the source or target system, plus a timestamped record that links the decision to the actual modification.
Decision rule: If the review outcome cannot drive provisioning automatically, treat the process as higher risk and require a reconciliation step before you close the campaign. If the access is privileged or high impact, manual closure without verification is usually the wrong trade-off.
What good looks like: The review decision, the provisioning action, and the evidence trail all line up, so you can prove both governance intent and technical enforcement. That alignment is what turns access certification from a paper exercise into a control.
Practitioner takeaway: Certification answers the question “should this access stay?”, while provisioning answers “did the system actually change?”, and strong governance requires both answers to be true at the same time.
Related resources from NHI Mgmt Group
- Guide: Access Reviews and Certification Guide
- Who is accountable when ERP user provisioning and access certification fail audit or privacy requirements?
- Why do non-human identities make access certification harder than human identities?
- When does continuous monitoring matter more than access certification?
- What is the difference between access certification and continuous monitoring in ERP security?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org