Category: Governance & Compliance

Reviewer

Also known as: Access Reviewer, Certifier, Access Certifier

Simply put

In identity governance, a reviewer is a person assigned to examine who has access to what and decide whether that access should be kept or removed. Reviewers are the people responsible for approving or revoking access during periodic access reviews. This is a governance responsibility, not a real-time control on whether someone can log in.

Formal definition

A reviewer is a role assigned within an identity governance and administration (IGA) process to make attest-or-revoke decisions during access certification campaigns and access reviews. Reviewers are typically line managers, resource or application owners, or role owners who evaluate whether a subject's granted entitlements, role memberships, or account privileges remain appropriate, often in support of least-privilege and segregation-of-duties objectives. The reviewer function is a lifecycle governance concern that operates on already-provisioned access and does not itself perform runtime enforcement; certification decisions may feed downstream deprovisioning or entitlement changes, but the actual revocation is generally carried out by provisioning workflows rather than by the reviewer directly. Specific reviewer capabilities, delegation options, and campaign scoping vary by IGA vendor and deployment configuration. Note: the general-purpose dictionary and platform sources in the evidence packet describe 'reviewer' in unrelated senses (for example, a critic or a product reviewer) and do not establish the IAM-specific meaning; that meaning is provided here as domain context rather than being drawn from the cited sources.

Why it matters

Access reviews depend on human judgment, and the reviewer is the person exercising that judgment. Automated systems can surface who holds which entitlements, but deciding whether a given grant is still appropriate, whether it reflects current job duties, honors least-privilege intent, or violates segregation-of-duties constraints, typically requires someone with business context. When that responsibility is assigned to the wrong person, or when reviewers rubber-stamp entitlements without genuine scrutiny, the entire certification campaign loses its assurance value even if it completes on schedule.

Reviewers are also central to how organizations demonstrate governance to auditors. Access certification campaigns produce an attestation record showing that a named individual examined specific access and made an attest-or-revoke decision. That record is only as credible as the reviewer's fitness for the task: a line manager who understands a subject's role, a resource owner who knows what an application's entitlements confer, or a role owner accountable for a role definition. Assigning reviewers who lack that context weakens the defensibility of the review, regardless of the tooling behind it.

It is important to keep the reviewer's role in its correct lane. A reviewer operates on already-provisioned access and makes governance decisions; the reviewer does not perform runtime enforcement and generally does not carry out the revocation directly. A revoke decision typically feeds downstream provisioning workflows that execute the change. Conflating the reviewer's attest-or-revoke decision with the act of removing access, or with real-time controls over whether someone can log in, leads to misplaced expectations about how quickly and reliably certification outcomes take effect.

Who it's relevant to

Identity governance leads

Governance leads design certification campaigns and decide who should be assigned as reviewer for each scope of access. They must match reviewers to the access they can meaningfully judge, managers to their reports, resource owners to their applications, role owners to their roles, and configure delegation so reviews reach someone with adequate context.

Line managers, resource owners, and role owners

These are the individuals most commonly assigned the reviewer function. They perform the actual attest-or-revoke evaluation, applying business knowledge to decide whether entitlements, role memberships, or account privileges remain appropriate in light of least-privilege and segregation-of-duties objectives.

Compliance officers and auditors

The reviewer's attestation record is a primary artifact for demonstrating that access was examined and decided upon by an accountable person. Compliance and audit stakeholders rely on the credibility of reviewer assignments and the integrity of recorded decisions when assessing the defensibility of a certification campaign.

IGA engineers and administrators

Engineers configure campaign scoping, reviewer assignment and delegation, and the flow of revoke decisions into downstream provisioning workflows. They should ensure reviewers understand that their decision drives, but does not itself execute, deprovisioning, and that available capabilities depend on the specific IGA platform and its configuration.

Inside Reviewer

Reviewer role

The person or entity assigned to evaluate and attest to the appropriateness of access granted to users during an access review or certification campaign. This is an identity governance and administration (IGA) function, distinct from runtime access enforcement.

Access certification scope

The defined set of entitlements, roles, group memberships, or accounts that the reviewer is responsible for examining within a given review cycle, typically bounded by organizational unit, application, or reviewer relationship to the subject.

Review decision (attestation)

The action the reviewer records for each item under review, commonly approve/certify, revoke/remove, or delegate/reassign, which drives downstream remediation such as deprovisioning.

Reviewer types

Common assignment models include manager-based review (the subject's direct manager), application or resource owner review, and role owner review. The appropriate type depends on the deployment and the entitlement being certified.

Delegation and reassignment

Mechanisms that let a reviewer transfer review responsibility to another qualified party, typically used to handle absence, workload, or lack of context about specific access.

Segregation of duties (SoD) consideration

An IGA control relevant to reviewers, intended to ensure the reviewer is not attesting to their own access and that toxic access combinations are surfaced during the review, depending on configuration.

Audit trail

The recorded evidence of reviewer decisions, timestamps, and justifications used to demonstrate compliance during audits. This supports certification requirements rather than performing real-time access enforcement.

Common questions

Answers to the questions practitioners most commonly ask about Reviewer.

Is a reviewer the same as the person who provisions or grants access?

No. In most IGA deployments the reviewer is responsible for attesting to whether existing access is appropriate during an access certification campaign, not for performing the provisioning or de-provisioning actions themselves. The reviewer makes a decision (typically approve or revoke), and the resulting change is usually carried out by a downstream fulfillment process or an administrator. Conflating the reviewer role with the provisioning role can itself create a segregation-of-duties concern, since the person judging whether access is correct generally should not be the same person who originally granted it.

Does a reviewer's approval verify that a user is who they claim to be at login?

No. Reviewer approval is an identity governance and administration function concerned with whether a principal should retain a given entitlement, not a runtime authentication check. Verifying who a principal is at sign-in is authentication, and determining what that principal may do at request time is authorization enforced by runtime components. A reviewer's certification decision influences what entitlements exist to be enforced later, but it does not itself authenticate anyone or perform real-time access enforcement.

Who should typically be assigned as the reviewer for a given access certification?

Assignment depends on the campaign design and the type of access being certified. Common patterns include the user's manager for people-centric reviews, an application or resource owner for entitlement-centric reviews, and a role owner for role membership reviews. Some deployments assign a data owner or a designated compliance stakeholder. The appropriate choice generally reflects who has enough context to judge whether the access is still justified, and organizations often combine reviewer types across different campaigns.

How should reviewer decisions be recorded to support an audit?

In most deployments the platform captures each decision (such as approve, revoke, or delegate), the reviewer identity, a timestamp, and often a justification or comment, retained as part of the campaign's audit trail. Whether comments are mandatory, how long records are retained, and what evidence is exported for auditors depend on configuration and organizational policy. Auditors typically look for a complete, tamper-evident record linking each entitlement to a reviewer decision within a defined campaign period.

What happens when a reviewer does not complete their assigned reviews?

Behavior varies by product and configuration. Common options include escalation to a backup reviewer or manager, reminder notifications, automatic delegation, or applying a configured default action when a campaign closes. Some organizations configure incomplete items to default to revoke and others to no change; the safer default from a least-privilege standpoint is often revocation, but this is a policy decision that should be set deliberately rather than assumed.

How can reviewer fatigue and rubber-stamping be mitigated in large campaigns?

Typical mitigations include narrowing scope so each reviewer sees only relevant entitlements, providing context and risk indicators to inform decisions, highlighting anomalous or high-risk access for focused attention, requiring justification for approvals of sensitive entitlements, and staggering campaigns to reduce volume per reviewer. The effectiveness of these controls depends on the platform's capabilities and how the campaign is configured; none fully eliminates the risk of low-quality attestations.

Common misconceptions

A reviewer certifying access is the same as enforcing access at runtime.

Reviewing is an IGA lifecycle activity, attesting that access is appropriate, and is separate from runtime enforcement performed by components such as a PDP and PEP. A reviewer's revoke decision typically triggers a downstream deprovisioning process; it does not itself block a request in real time.

The subject's manager is always the correct reviewer.

Manager-based review is common, but managers often lack context about specific application entitlements. Depending on the deployment, application owners, resource owners, or role owners may be more appropriate reviewers, and many programs combine reviewer types.

A reviewer approving access verifies the user's identity.

Certification attests to whether granted authorization is appropriate; it does not perform authentication or verify who the principal is. Identification and authentication are separate steps handled elsewhere in the identity system.

Best practices

Assign reviewers who have sufficient context to make an informed decision, pairing manager-based review with application or role owner review where entitlement-specific knowledge is required.

Configure segregation of duties controls so reviewers cannot certify their own access and so toxic access combinations are flagged during the review, subject to your platform's capabilities.

Present reviewers with clear, decision-ready context for each item (entitlement meaning, last-used data where available, and risk indicators) to reduce rubber-stamping.

Enable controlled delegation and reassignment so reviews are not stalled by absence, while preserving an audit trail of who ultimately made each decision.

Ensure revoke decisions feed into a defined remediation and deprovisioning workflow, and track completion rather than treating the review decision as the end state.

Retain a complete audit trail of reviewer decisions, justifications, and timestamps to support certification and compliance obligations.