Skip to main content
Identity Authority
Category: Governance & Compliance

Access Certification Evidence

Also known as: Access Review Evidence, Certification Evidence
Simply put

Access certification evidence is the documentation an organization keeps to prove that it actually reviewed and confirmed who has access to its systems. It typically includes records of the review process and the sign-offs from the people responsible for approving that access. Auditors use this evidence to verify that access controls are genuinely operating rather than merely defined on paper.

Formal definition

Access certification evidence comprises the artifacts produced by an access certification (access review) campaign that demonstrate the control was performed and operating as intended. Access certification is a formal IGA process in which designated reviewers, commonly managers, resource owners, or independent auditors, validate whether users' existing access rights remain necessary and appropriate to their roles. The resulting evidence typically includes documentation of a formal review process and signed attestations from reviewers, and serves as certification evidence that required controls are actually operating for audit and compliance purposes. This is a governance and lifecycle concern focused on periodic validation of standing entitlements; it is distinct from runtime authorization enforcement (for example PDP/PEP decisions and token validation), which is out of scope for this term. The specific evidence artifacts, retention practices, and reviewer roles vary by deployment, vendor tooling, and the applicable regulatory framework.

Why it matters

Access certification evidence is what separates a control that genuinely operates from one that merely exists on paper. Many organizations define access review policies and configure certification campaigns, but auditors and regulators are concerned with whether those reviews actually occurred and produced defensible outcomes. Without retained evidence, documentation of a formal review process and signed attestations from reviewers, an organization cannot demonstrate that standing entitlements were validated, even if the underlying reviews were performed. In this sense, the evidence is the audit-facing product of the certification process, not an incidental byproduct.

This matters because access certification addresses a specific governance risk: entitlement accumulation over time. As users change roles, join projects, or take on temporary responsibilities, they tend to retain access that is no longer necessary or appropriate. Periodic certification is the mechanism by which managers, resource owners, or independent auditors reconfirm that existing access remains warranted, and the evidence records who made that determination and when. For cybersecurity regulations, certification evidence is typically the documentation used to prove that required controls are actually operating.

Because certification is a governance and lifecycle concern rather than a runtime enforcement mechanism, its evidence answers a different question than authorization logs do. Runtime enforcement records show what access decisions a system made in the moment; certification evidence shows that a human review deliberately validated whether standing access should continue to exist at all. Auditors depend on this distinction, and gaps in certification evidence are commonly what surface during compliance assessments, depending on the applicable regulatory framework.

Who it's relevant to

Identity governance leads
Those responsible for designing and running certification campaigns need to ensure that the process not only completes but produces retained, defensible evidence. This includes deciding which reviewer roles apply, how attestations are captured, and how evidence is stored to satisfy audit requirements, all of which vary by tooling and regulatory framework.
Compliance officers and auditors
Auditors rely on certification evidence to verify that access controls are genuinely operating rather than merely defined. They typically look for documentation of a formal review process and signed attestations, and gaps in this evidence are commonly what surface during compliance assessments.
Managers and resource owners
As the designated reviewers in many campaigns, managers and resource owners validate whether users' existing access remains necessary and appropriate to their roles. Their sign-offs constitute the signed attestations that form a core part of the evidence record.
IAM engineers and administrators
Those operating IGA platforms are responsible for configuring campaigns so that the review workflow generates and retains the required evidence artifacts. They should be mindful that certification is a governance and lifecycle concern distinct from runtime enforcement, and that retention practices depend on deployment and applicable regulations.

Inside Access Certification Evidence

Reviewer Decision Records
Documented outcomes of each certification decision (typically approve, revoke, or delegate) captured per reviewed access item, along with the identity of the reviewer who made the decision and the timestamp. These records demonstrate that a human or automated reviewer actively evaluated the access rather than allowing it to persist by default.
Access Snapshot
A point-in-time capture of the entitlements, group memberships, roles, or fine-grained permissions that were presented for review. This establishes what state of access existed at the moment of certification, which is distinct from the current runtime state of the access control system.
Reviewer Attribution and Scope
Information identifying who was assigned as the responsible reviewer (for example a line manager, application owner, or role owner) and the population of identities or entitlements within their review scope. This supports accountability and, depending on configuration, segregation of duties checks so that individuals do not certify their own access.
Remediation and Fulfillment Trail
Records linking a revoke decision to the downstream deprovisioning action that removed the access. Because certification is an IGA lifecycle activity rather than runtime enforcement, evidence of fulfillment typically shows whether and when the requested change was actually applied in the target system.
Campaign Metadata
Context about the certification campaign itself, such as its purpose, defined scope, start and end dates, and the policy or control it supports (for example a periodic access review required for compliance). This frames why the review occurred and against what criteria.
Supporting Context Attributes
Additional data surfaced to inform reviewer decisions, which may include last login or usage indicators, entitlement descriptions, risk ratings, or prior decision history, depending on the platform and configuration. These attributes support the decision but do not by themselves constitute the certification outcome.

Common questions

Answers to the questions practitioners most commonly ask about Access Certification Evidence.

Does access certification evidence prove that access was correctly enforced at runtime?
No. Access certification evidence is an identity governance and administration (IGA) artifact documenting that a reviewer examined and made a decision (approve or revoke) about a principal's granted access during a certification campaign. It attests to a governance review, not to runtime enforcement. Whether access was actually enforced correctly is a separate concern handled by runtime components such as the PEP and PDP, and validated through enforcement logs rather than certification records. Treating certification evidence as proof of enforcement conflates lifecycle governance with real-time access control.
Is a reviewer approving an access item the same as verifying that the underlying entitlement is properly configured or free of segregation-of-duties conflicts?
Not inherently. A reviewer's approval typically records that the reviewer accepted the appropriateness of the access as presented to them. It does not, by itself, guarantee that the entitlement is correctly configured, that role definitions are accurate, or that no segregation-of-duties (SoD) conflicts exist. SoD analysis is a related but distinct governance function; depending on configuration, some IGA platforms surface SoD violations within the certification interface to inform the reviewer, but the certification decision and the SoD control are separate mechanisms and should not be assumed to be the same evidence.
What fields should access certification evidence typically capture to be defensible in an audit?
In most deployments, defensible certification evidence captures the reviewed principal (identity), the specific entitlement or access item under review, the reviewer identity, the decision (approve, revoke, or delegate), a timestamp, and the campaign or review cycle context. Many organizations also retain justification or comments, the reviewer's relationship to the principal (for example manager or resource owner), and any subsequent remediation actions taken on revocations. Exact available fields vary by IGA vendor and configuration; confirm what your platform records and exports.
How should evidence of revocation decisions be linked to actual deprovisioning actions?
A revocation decision recorded during certification is a governance outcome; the corresponding removal of access is a separate provisioning action. To make evidence complete, most implementations correlate the certification revocation record with the downstream deprovisioning event, ideally capturing the deprovisioning timestamp, target system, and success or failure status. Where provisioning is automated through connectors or SCIM, this linkage can often be captured programmatically; where deprovisioning is manual, organizations typically need a tracking mechanism to demonstrate closure between the decision and the enforced change. The gap between decision and completed removal is a common audit finding.
How long should access certification evidence be retained?
Retention periods depend on applicable regulatory, contractual, and internal audit requirements rather than any single standard, so there is no universal figure. Organizations typically align certification evidence retention with the audit cycle and the retention policy governing other access governance artifacts. Confirm requirements with your compliance function, and verify that your IGA platform's export and archival capabilities preserve the necessary fields for the full retention window, since some platforms may purge or truncate historical campaign detail depending on configuration.
Can rubber-stamping be detected from certification evidence, and how?
Certification evidence can support detection of low-quality reviews, but only through analysis rather than the individual records alone. Common signals include very short decision-to-review intervals, uniform bulk-approval of all items in a campaign, and consistently absent justifications. Some IGA platforms provide reviewer behavior metrics or flag bulk actions, though availability and definitions vary by vendor and configuration. Detecting rubber-stamping is an analytical overlay on the evidence; the raw approval records by themselves do not distinguish a considered decision from a perfunctory one, so organizations often supplement evidence with review-quality controls.

Common misconceptions

Access certification evidence proves what access a user currently has.
The evidence reflects a point-in-time snapshot of access as it existed during the campaign and the decisions made against it. Runtime access can change after certification through separate provisioning or enforcement activity, so certification evidence should not be treated as an authoritative real-time record of current entitlements.
A completed certification decision means the access was actually changed in the target system.
A revoke or approve decision is a governance outcome, not an enforcement action. Whether a revocation was fulfilled depends on downstream deprovisioning, which may succeed, fail, or lag. Complete evidence typically links the decision to a remediation and fulfillment trail rather than assuming the change took effect.
Certification evidence demonstrates that a user's authentication or access was appropriate.
Certification is an authorization governance activity that reviews whether granted permissions remain appropriate; it is distinct from authentication. The evidence does not verify how or whether a principal authenticated, and it addresses what a principal may do rather than who a principal is.

Best practices

Capture the access snapshot together with each reviewer decision and timestamp so evidence unambiguously ties a specific decision to the exact entitlement state that was reviewed.
Link every revoke decision to its downstream remediation record, and retain evidence of whether the deprovisioning actually completed rather than assuming the decision was fulfilled.
Enforce and record reviewer attribution and scope, and where configuration supports it apply segregation of duties so reviewers cannot certify their own access.
Preserve campaign metadata, including scope, dates, and the policy or control being satisfied, so auditors can understand why the review occurred and against what criteria decisions were made.
Retain certification evidence for the period required by the applicable compliance or audit obligation, and store it in a tamper-evident manner appropriate to your governance requirements.
Surface supporting context attributes such as usage indicators and entitlement descriptions to reviewers, but keep them clearly separate from the recorded decision so the evidence distinguishes inputs from outcomes.
Promotional banner highlighting failures found in PCI audits and how to spot the gaps