Glossary
Access certification
Access certification is another name for a user access review: someone with authority confirms, item by item, that access is still right.
Same activity, several names
People say user access review, access review, access certification, access recertification and entitlement review. They mean the same activity: a list of who has access to what, a decision on every item, and a record. The words differ by habit. Auditors often write “user access review”. Identity governance products tend to say “certification”. Okta and SailPoint call a round of reviews a certification campaign (Okta, SailPoint): one round with its own scope, reviewers and timeline. “Recertification” only adds that the check repeats. The access certification guide goes through the names and how to run a round.
Three things that share the word
The word certification is also used for a credential an organization earns, such as certification against ISO/IEC 27001. Access certification is not that. It is something your organization does, not a badge it receives.
The same goes for attestation. In auditing, an attestation engagement is the work of an independent accountant who reports on controls, and a SOC 2 report is the result. The AICPA’s attestation standards govern that work. When a reviewer or a manager “attests” at the end of an access certification, they are making their own statement, which is a different thing again. See attestation.
So there are three: a credential an organization holds, a statement a reviewer makes, and a report an auditor writes. A reviewer who certifies an item is saying “I looked and this is right”. It does not mean the access is safe, and it does not make the organization certified.
An example
A finance team runs a certification each quarter. Every manager gets the list of accounts in their team, with the roles each one holds. They certify the ones that are right, revoke one that is not, and write a note on it. An administrator then removes the revoked access.