ANUGAL UAC SERIES · 1 OF 6 · PILLAR GUIDE
What Is User Access Certification? A Plain-Language Guide
Ninety percent of large organizations reported an identity-related incident in the past year, per the Identity Defined Security Alliance's 2024 study of companies with over 1,000 employees. The control designed to catch a share of that risk already sits in your calendar: the user access review. Most enterprises run it in a spreadsheet, and that is where it dies.
This guide explains user access certification in plain language: what it is, why auditors demand it, why the spreadsheet version fails, and what a governed review looks like.
THE SHORT ANSWER
User access certification is the periodic, evidenced review where managers and application owners confirm or revoke every user's access to systems and data. Regulations from SOX to GDPR expect it. Done in spreadsheets, it produces rubber-stamped approvals and unexecuted revocations. Done as a governed workflow, it captures, enforces, and evidences every decision automatically.
Why auditors keep asking about access reviews
Picture audit fieldwork at a 10,000-person enterprise. The request list includes one line that sounds simple: show us who reviewed access to the finance systems this year, what they decided, and what happened to the revoked access. Now consider the scale. Ten thousand identities across 150 applications create more than one million user-to-entitlement records, and an accountable owner must stand behind every decision.
The expectation is not one regulator's quirk. Periodic access review supports compliance programs across SOX, GDPR, HIPAA, PCI-DSS, NIS2, GxP, and RBI mandates. And audit practitioners keep reporting the same pattern: access controls, including provisioning, segregation of duties, and access reviews, sit among the highest-risk ITGC areas, with findings that trace back to undocumented reviews and missing evidence.
Access certification is where auditors look first, because every other control depends on who holds access.
So the review happens. The question is whether it means anything.
Why the spreadsheet version fails
Most organizations still run certifications through spreadsheets, email chains, and manual follow-ups. The outcome is predictable, and it fails in four specific ways.
| Failure | What it looks like | Who feels it |
|---|---|---|
| Low completion | Reviewers ignore the email; the campaign closes with gaps nobody records | IT Risk and Compliance |
| Rubber-stamped approvals | Hundreds of rows, zero context, approve-all before the deadline | CISO |
| Revocations never executed | The cell says revoke; the access stays live for months | Head of IAM |
| Evidence built after the fact | Screenshots and email archaeology assembled before the audit | CFO and audit owners |
A spreadsheet proves a review happened; it cannot prove the review meant anything.
What replaces it is not a bigger spreadsheet. It is a different shape of control.
What does a governed certification look like?
A governed certification is one workflow from scope to evidence. It runs in six moves.
- Scope the campaign. By application, department, role, or risk tier, with recurring schedules so reviews track business change instead of audit season.
- Assign by ownership. Managers certify their people; application owners certify their systems. Accountability is built into the assignment.
- Review with context. Reviewers work a dedicated queue showing every role per user with full access context at decision time, and submit user by user so progress stays trackable.
- Chase automatically. Reminders and escalation handle non-responsive reviewers; completion stops depending on someone's follow-up email.
- Enforce on Complete. Closing the campaign triggers deprovisioning requests for every revoked access, with no manual execution step.
- Evidence as a by-product. Every decision logs with timestamp, reviewer, and rationale, so audit evidence exists the moment the decision does.
In a governed review, the decision and the enforcement are the same motion.
Where AI changes the reviewer's job
The newest shift is agentic: policy-bound AI that prioritizes risk, recommends certify-or-revoke based on peer groups and usage, flags dormant and excess access, and surfaces segregation-of-duties conflicts inside the review itself. Per Anugal's UAC materials, auto-approving birthright and standard role-aligned access under policy cuts approval volume 20 to 30 percent, so humans see the decisions worth judgment.
AI does not replace the reviewer; it shrinks the pile to the decisions worth a human's judgment.
Part 5 of this series covers the operating modes and guardrails in depth.
The Access Review Health Check: 6 questions
Six questions separate a control from a ceremony.
THE ACCESS REVIEW HEALTH CHECK
- Do you know the last campaign's completion rate without asking anyone?
- Did any reviewer revoke anything in the last two campaigns?
- Do reviewers see role context and access history at decision time?
- Do segregation-of-duties conflicts surface inside the review itself?
- Do revocations execute automatically once the campaign completes?
- Could you hand an auditor full evidence for one user within an hour?
Four or more no answers means your certification is a formality. Formalities become findings.
Mistakes that keep certifications weak
- Treating reviews as an audit-season event. Risk accrues between events; movers accumulate access the calendar never catches. Part 3 covers this in detail.
- Measuring completion instead of decisions. A campaign at 100 percent completion with zero revocations is a ceremony with a certificate.
- Emailing spreadsheets and calling it a workflow. No context, no enforcement, no evidence; three gaps in one attachment.
Frequently asked questions
What is user access certification?
A recurring, evidenced review in which accountable owners confirm or revoke each user's access to applications and data. It exists to keep access aligned with current job needs and to prove that alignment to auditors, with every decision recorded and every revocation enforced.
How often should access reviews run?
Quarterly is common in regulated environments, and higher-risk systems justify more frequent cycles. Stronger programs add event-driven reviews on role and organizational change, so the schedule follows risk rather than the calendar alone. Recurring campaign schedules keep access aligned continuously.
Who should review access?
Ownership decides it: managers certify the people who report to them, and application owners certify access within their systems. Split accountability this way and every entitlement has exactly one person who answers for it, which is precisely what an auditor asks.
What is rubber-stamping in access reviews?
Approving access without genuine scrutiny, usually because reviewers face hundreds of technical entitlements with no context and a deadline. It converts a preventive control into paperwork. Part 2 of this series explains why it happens and how risk filtering ends it.
How Anugal solves it
Run the six-question health check above against Anugal UAC and here is what answers back.
HOW ANUGAL SOLVES IT
- Campaigns scoped your way. By system, department, role, or risk tier, on recurring schedules, with ownership-based assignment to managers and application owners.
- Reviews with context, not rows. A dedicated queue shows every role per user with full access context; per-user submit keeps large campaigns trackable; reminders and escalation drive completion.
- Decisions that enforce themselves. Campaign Complete triggers automatic deprovisioning requests for all revoked access, with no manual execution step.
- Evidence as a by-product. Every decision logs with timestamp, reviewer, and rationale; audit-ready evidence generates continuously, not before audits.
- AI where it earns its place. Risk prioritization, certify-or-revoke recommendations, dormant-access detection, and SoD awareness inside the review, with one-tap approvals in Microsoft Teams (per Anugal's UAC materials).
One honest note: the health check is vendor-neutral by design. Run it against every platform you evaluate, ours included.
About Anugal. Anugal is the Agentic Identity Governance and Administration platform from Business Core Solutions (BCS). It orchestrates identity lifecycle, access requests, certifications, and risk governance across the enterprise, with 350+ integrations through SCIM 2.0, REST APIs, OData, SOAP, SAP ABAP, and SQL.
SEE IT ON YOUR OWN CAMPAIGN DATA
Bring one recent certification export and we will show you what Anugal UAC surfaces in it: the risk, the rubber-stamps, and the revocations that never executed.
hello@businesscoresolutions.com
Next in this series is live: Rubber-Stamped Access Reviews: Why It Happens and the Fix
