Glossary
Attestation
An attestation is a written statement by a named person that something is true, kept as a record: "I reviewed this list and it is right".
Three meanings
- A statement by a responsible person. “I reviewed this and it is correct.” This is the meaning on this page.
- An auditor’s engagement. In accounting, an attestation engagement is the work of an independent accountant who reports on controls. A SOC 2 report is the result, under the AICPA’s attestation standards. It is not the same as the first meaning.
- A machine’s statement about itself. In software, a build attestation says which workflow run and which commit produced a file. Acciew’s collector releases carry one. It is about the files, not about a review.
Why it matters in an access review
Without an attestation, a review is a list of decisions that nobody stands behind. At the end of a review, the person who owns it and the person who approves it each state that it was done. That ties a name to the result, and it asks them to read the result before they say so. The guide to the whole process says where it fits.
How Acciew uses it
After an administrator finalizes a review, they can record two attestations: one for the owner and one for the approver. For each, the administrator types a name next to fixed words. It is a typed name, not a signature, and nothing checks who is behind it. A review that was finalized with undecided accesses cannot be attested. Both attestations are written to the log of what was done, and the evidence pack then reads “finalized and attested”.
An example
A security lead finishes a review. Every access has a decision, and the rejected ones have been removed. The owner of the review and the approver each have their name recorded against the fixed words. The pack now carries two statements, with dates.
Common mistakes
- Taking a typed name for a signature.
- Attesting before the removals are done.
- Attesting a list that is not the whole population.
- Letting someone attest for a review of their own access.
Related: evidence pack, access certification.