Manual certification campaign

What a manual certification campaign really is

A manual certification campaign is not just an access review with a spreadsheet attached. It is a governance process where reviewers must inspect exported entitlements, decide whether access is still justified, and send approvals or removals back through humans rather than through an integrated workflow.

That distinction matters because the campaign is usually trying to answer a simple question, but doing it with a brittle operating model. The process can still produce a valid decision, yet the quality of that decision depends heavily on data freshness, reviewer discipline, and whether someone actually follows through on remediation.

Why manual campaigns become stale and noisy

Manual campaigns tend to degrade as the environment grows because access state changes faster than the review cycle. By the time reviewers open the spreadsheet, some entries are already obsolete, inherited, or tied to workflows that no longer reflect real business need.

They also create noise. Reviewers are forced to approve or reject long lists without enough context, which encourages rubber stamping, delayed action, and inconsistent decisions between teams. Over time, the campaign can become a documentation exercise instead of a control.

A related weakness is that manual methods often capture only the visible entitlement at a moment in time, not the business reason behind it. That makes it hard to distinguish appropriate standing access from access that should have been removed after a project, role change, or temporary exception ended.

Where manual certification fits in access governance

Even with its flaws, a manual certification campaign is still an access governance control. It is used when organizations need to demonstrate periodic review, validate who should retain access, or compensate for systems that do not yet expose clean review data through a governance platform.

In practice, it sits between entitlement discovery and remediation. The review tells you what should change, but the value depends on whether the result is acted on, tracked, and closed. Without that closed loop, the campaign records a judgment without changing exposure.

Manual review can also be the first place where inconsistent ownership becomes visible. If nobody knows who should certify a system, who owns a role, or which manager understands the entitlement, the campaign exposes a governance gap that is larger than the review itself.

How to think about scale, evidence, and control quality

The central problem with manual certification is not that humans are unreliable, it is that humans are expensive control points. As the number of identities, applications, and entitlements rises, review quality falls unless the process is narrowed to the riskiest access and supported by better context.

The strongest manual campaigns focus on material access rather than everything at once. That means privileged access, sensitive systems, dormant entitlements, and outlier permissions get more attention than low-risk routine access, because the purpose is not to review volume but to reduce meaningful exposure.

A useful campaign also needs traceable evidence. If reviewers cannot see why access exists, who requested it, when it was last used, and what will happen after revocation, the control becomes hard to defend and even harder to improve.

Risk and Threat Considerations

Manual certification campaigns create control risk when they are too slow, too broad, or too easy to rubber stamp. That leaves excessive access in place longer than intended and gives attackers more opportunity to exploit stale entitlements, orphaned permissions, or overlooked privileged access.

Failure mechanism: The review is based on stale exports and limited context, so reviewers approve access they cannot confidently validate or miss access that should be removed. Weak follow-up then leaves the bad decision in place.

Impact: Privilege creep, delayed deprovisioning, and prolonged exposure to account takeover, insider misuse, or lateral movement become more likely, especially in large environments with many recurring reviews.

Practitioner Guidance

Why practitioners should care: A manual certification campaign should be treated as a temporary or targeted control, not as the default operating model for recurring access governance. Its value depends on how well it is scoped, contextualised, and closed out.

Common misunderstanding: A completed spreadsheet does not equal effective certification. If the process does not remove access, retain evidence, and update the source of truth, the campaign has produced paperwork rather than governance.

Practitioner takeaway: The best manual campaigns are narrow, risk-focused, and tightly closed looped, because the goal is to reduce access that should not exist, not to maximize review volume.

Related resources from NHI Mgmt Group

• How can organisations reduce manual effort in access certification and evidence collection?
• When does automated access review reduce risk more than manual certification?
• Why do manual access request and certification processes break down in SaaS environments?
• How should security teams reduce manual effort in access certification campaigns?