First Access Certification Campaign Produces Rubber-Stamping
A healthcare group has 6,000 workforce users, 1,200 privileged users, and 2,800 privileged accounts across on-premises PAM and cloud platforms. It uses CyberArk Identity for SSO and MFA and CyberArk Identity Governance for access certifications. The first quarterly campaign covered all 6,000 users and generated 14,000 review tasks. About 40% were approved in under three seconds, which strongly suggests rubber-stamping. Audit found 380 orphan accounts with no matching HR record and 90 toxic combinations, including users who can both create accounts and grant domain administrator rights. The HR feed is updated every two weeks, and terminations are sometimes processed late. The CISO wants the next campaign to be defensible and wants toxic combinations prevented, not just reported.
1. How should the next certification campaign be scoped, and what data-quality fixes must happen before it starts?
Read the worked answer
The next campaign should be risk-based, not population-based. Certifying all 6,000 users creates review fatigue and produces exactly the three-second approvals the audit found. Scope the campaign to privileged users, users with access to sensitive clinical and financial applications, and users with toxic combinations. Use manager certification for business roles and application-owner certification for high-risk resources. A smaller, well-defined population is more defensible than a large one with no evidence of real review.
Before the campaign, fix the identity data. The HR feed should be daily or near-real-time, and leavers should be disabled in the identity source before access review tasks are generated. Resolve the 380 orphan accounts: either attach them to a valid identity or disable them. If the HR data is two weeks stale, reviewers will be asked to certify access for people who have already left, which destroys confidence in the campaign.
Also add reviewer guidance: what the entitlement grants, why it is risky, and what the recommended action is. A reviewer who understands the question is more likely to answer it properly.
2. Design a control that prevents toxic combinations rather than only detecting them after the fact.
Read the worked answer
Prevention requires policy at the point of request, not just a quarterly report. Define separation-of-duties rules in Identity Governance for the combinations that matter, such as create-account plus grant-admin, or vendor-management plus payment-approval. When a user requests an entitlement that would create a toxic combination, the request should be blocked or routed to a risk review with a documented business justification. The rule should be expressed in terms of entitlements and roles, not job titles, so it remains valid when people change jobs.
For privileged access, reduce standing access. Use just-in-time elevation and time-bound roles so the combination exists only during an approved window. In PAM, use dual control or exclusive access for the highest-risk accounts, which prevents a single user from completing both halves of a toxic action.
The control also needs an exception process with an expiry date and a compensating control. Detection remains useful for drift and for access granted outside the request workflow, but it should be the safety net, not the primary control.
3. HR, Identity Governance, and PAM disagree about who should be authoritative for identity and entitlements. How would you resolve the source-of-truth conflict?
Read the worked answer
Assign authority by data type, not by system preference. HR is authoritative for identity lifecycle: who is an employee, their manager, department, and termination date. Identity Governance is authoritative for access entitlements and certification decisions: who has what access and who approved it. PAM is authoritative for privileged account credentials and sessions, but it should not be the master of a person's identity.
The conflict is usually caused by connectors and timing, not by philosophy. Connect HR to Identity Governance on a frequent schedule, and have Identity Governance drive joiner, mover, and leaver events into PAM and other targets. PAM should consume identity attributes and correlate accounts to the governance identity; it should not create a parallel identity record. When a discrepancy appears, reconcile against HR first, then against the entitlement record.
Build a reconciliation report that shows unmatched accounts, terminated users with active access, and accounts with no owner. That report is the operational control that keeps the three systems aligned after the design is agreed.