What is the difference between access review and recertification?

How access review and recertification differ in practice

Access review is the broader activity: you inventory who has access, compare it with current business need, and identify anything excessive, stale, or unowned. Recertification is the approval action inside that process, where a manager, owner, or delegate formally confirms, changes, or removes specific entitlements. The distinction matters because one is the review workflow, while the other is the certification decision.

That difference is easiest to see in organisations that run periodic campaigns. A review can surface dormant accounts, role drift, and unneeded access, while recertification creates the auditable decision record for each entitlement. For machine and service access, the same logic applies to identity and access governance, but the reviewer must understand the technical blast radius of the entitlement being attested.

Why the two terms are often conflated

People often use the terms interchangeably because many platforms label the whole campaign as “certification” even when the workflow starts as a review. In practice, that shorthand hides an important control distinction: the review is the control activity, and recertification is the attestation output. If teams only track whether a campaign was completed, they may miss whether every item was actually challenged, adjusted, or revoked.

The confusion also appears when organisations rely on a single checkbox-style approval. A reviewer can approve everything without really re-evaluating necessity, which turns recertification into rubber stamping. Stronger programmes combine scope, context, and ownership so that the reviewer can make a meaningful decision rather than a ceremonial one. Access review and certification design matters because the review should be structured to remove access, not merely confirm it.

What changes when NHIs are included

For NHIs, access review is not just about people accounts. It should include service accounts, API keys, tokens, certificates, and any delegated access path that can still authenticate or authorise actions. That widens the ownership problem: if the technical owner cannot explain why the entitlement exists, the review has to route through a business owner or accountable service owner who can make the decision.

This is where lifecycle discipline becomes essential. A service account or token can remain valid long after the system it supports has changed, which makes recertification a governance checkpoint for stale machine access as much as for human access. NHI lifecycle management and access review are tightly linked because review outcomes should feed offboarding, rotation, and entitlement cleanup rather than sit in a report.

Risk and Threat Considerations

When review and recertification are weak, the main risk is access creep: entitlements survive after role changes, project ends, or system retirement. For NHIs, that can leave long-lived secrets, stale service accounts, and overprivileged tokens available for misuse, lateral movement, or unintended system changes.

Failure mechanism: The process becomes a paper exercise, reviewers approve without context, and no one closes the loop on revoked or reduced access.

Impact: Excess access persists, audit evidence becomes weak, and a compromised or forgotten identity can keep operating with more authority than it should have.

Practitioner Guidance

What to prioritise: Separate the campaign design from the approval event. If the workflow cannot show which items were removed, reduced, or accepted as exceptions, the review has not delivered governance value.

What to verify: Check that each reviewed identity has a clear owner, a current business justification, and a defined decision path for removal. For NHIs, verify that the owner understands whether the entitlement is a service credential, an API token, a certificate, or an inherited role.

Common mistake: Treating recertification as the whole control and ignoring the upstream review scope. That usually produces broad approvals, low signal, and little real reduction in excess access.

Practitioner takeaway: Use access review to find and challenge unnecessary access, and use recertification to create the accountable decision that removes or justifies it.

Related resources from NHI Mgmt Group

• Who should own recertification and access review decisions in an IGA programme?
• Why do AI agents make access review and recertification less effective?
• How should identity governance teams use analytics to improve recertification and access review decisions?
• Why do NHIs need separate access review campaigns instead of human recertification workflows?