The Certification Campaign That Certified Everything
A logistics company runs quarterly access certifications. Last quarter, 1,200 entitlements were reviewed across 300 managers. The campaign closed with a 99.4% 'approve' rate and an average decision time of 4 seconds per item. An internal auditor sampled 40 approved items and found 9 that were clearly inappropriate-including a warehouse supervisor with finance-system access and two users retaining access to a decommissioned billing platform. Managers reported that the campaign arrived during peak season and that the interface defaulted to 'approve' with a 'select all' button. The auditor's draft finding says the control is 'not operating effectively.' Management wants to dispute the finding, arguing that certifications are inherently a management judgment and that the sample is small.
1. Assess management's dispute. Is the auditor's finding defensible? What evidence supports each side?
Read the worked answer
The auditor's finding is defensible and management's dispute is weak, for several reasons:
- The 4-second average and 99.4% approval rate are themselves evidence of ineffectiveness. A genuine review of 1,200 entitlements cannot be completed in seconds per item with near-universal approval. These metrics indicate rubber-stamping, not judgment.
- The sample, while small, is not the whole case. Nine clearly inappropriate approvals out of 40-including access to a decommissioned system-is a high error rate, and the specific examples are unambiguous. The auditor is not relying on the sample alone; the process design (default-approve, select-all, peak-season timing) corroborates it.
- Management's 'inherent judgment' argument cuts against them. If certifications are judgment, then a process that discourages judgment (defaults, bulk approve, time pressure) fails to operate as designed. The control's purpose is to remove inappropriate access; a 99.4% approval rate with known-bad items means it is not doing that.
Where management has a fair point: a small sample alone would be thin, and the finding should be framed around process design and observed error rate together. But the finding stands.
2. Propose a remediation plan that would let management credibly claim the control is effective next quarter.
Read the worked answer
Remediation should target design, timing, and evidence:
Design changes:
- Remove default-approve and 'select all'; require an explicit decision per item.
- Add risk-based scoping: prioritize privileged, finance, and orphaned entitlements; de-scope low-risk items or review them less frequently.
- Surface context to reviewers: last-login date, manager relationship, role justification, and flags for decommissioned systems.
- Route items to reviewers who can actually attest (resource owners for sensitive systems), not just line managers.
Timing: move the campaign out of peak season, or split it so high-risk reviews happen at a calmer time.
Evidence and measurement:
- Track decision time, approval rate, revocation rate, and post-review audit sample error rate.
- Run a pre-close sample audit and remediate before the campaign closes.
- Automatically revoke access to decommissioned systems regardless of certification outcome-those should never depend on a reviewer.
Governance: report metrics to the audit committee quarterly so effectiveness is demonstrated, not asserted. Management should also accept the finding rather than dispute it; disputing a well-evidenced finding damages credibility more than the finding itself.