What should organisations do when continuous access control and manual recertification conflict?

Why runtime control should override stale recertification decisions

Manual recertification and continuous access control solve different problems. Recertification is a governance checkpoint, while continuous controls are the enforcement layer that sees current context, such as risk, session state, device posture, and policy drift. When they conflict, organisations should treat the runtime decision as the operative one for high-risk access, because it reflects the state that actually exists now.

This is especially important where access is time-sensitive, privilege-bearing, or tied to privileged workflows. A periodic review can confirm that the entitlement was once approved, but it cannot prove that the same access is still safe after a role change, incident, system change, or control failure.

For a broader identity-governance view, IAM and IGA basics help distinguish governance decisions from enforcement decisions, which is exactly the tension in this question.

How to use recertification without making it the only control

Recertification should validate policy intent, ownership, and reviewer accountability. It is good at catching structural issues such as excessive entitlements, missing owners, and roles that no longer match business need. It is not a substitute for a control that can stop access in real time when conditions change.

The practical design pattern is to let recertification confirm whether the access model is still defensible, then let continuous controls decide whether the access may remain active at the moment of use. That approach keeps the review process meaningful without freezing the control posture at the last campaign date.

For teams building access-review programs, Access Reviews and Certification Guide is useful because it focuses on reviews that remove access, not just document it. If role structure is part of the problem, Role Mining and Role Design Guide helps reduce the chance that reviews are perpetuating a bad model rather than correcting it.

What good decision-making looks like when the two controls disagree

When recertification and runtime policy diverge, organisations should not ask which control is more administratively convenient. They should ask which control is closer to the current risk state and which one is responsible for preventing harm right now. For high-risk access, the continuous decision should normally prevail until the discrepancy is investigated and resolved.

The exception handling matters. If the runtime system is denying access that a reviewer later approved, that can indicate a valid change in risk, a stale entitlement, or a policy gap. If the runtime system is allowing access that a reviewer rejected, that is a stronger indicator of control failure and should be escalated quickly because the access is already active.

Where continuous controls are in use, Zero Trust Identity Guide is a strong companion because it frames access as a dynamic decision rather than a one-time approval. For broader control design, Authorisation Models Guide is helpful when the conflict comes from policy rules that are too coarse for current context.

Risk and Threat Considerations

When organisations let manual recertification overrule continuous access controls, the main risk is stale approval. That creates a window where access remains active even after context has changed, which increases the chance of excessive privilege, inappropriate persistence, or abuse of trust in a privileged session.

Failure mechanism: The review process reflects an older state, while the runtime control reflects current conditions. If the older approval is treated as authoritative, a revoked, risky, or now-inappropriate entitlement can stay live until the next campaign.

Impact: Attackers and insiders gain a larger abuse window, and defenders lose the benefit of dynamic containment. In high-risk environments, that can turn a governance artifact into a false sense of safety.

Practitioner Guidance

Decision rule: If the access can materially affect production systems, sensitive data, privileged workflows, or downstream automation, treat continuous denial or step-up enforcement as the binding control until the discrepancy is investigated. Use recertification to validate ownership and policy, not to reopen access that runtime controls have already judged unsafe.

What to verify: Confirm that reviewers understand they are certifying business justification, not overriding an active risk signal. Also verify that exception handling, escalation paths, and logging make it obvious when governance and enforcement disagree.

Practitioner takeaway: The safest operating model is to make recertification accountable for policy truth and continuous control accountable for present-tense risk, then ensure the latter wins whenever the two diverge on high-risk access.

Related resources from NHI Mgmt Group

• How should organisations replace manual access recertification with continuous policy-driven authorization?
• Why does group-based access control matter when organisations are trying to reduce manual access administration?
• When should organisations move from manual recertification to automated access reviews?
• How should organisations reduce access risk when privileged accounts are still managed with manual recertification processes?