Updated recently
Last updated:
Quick Answer: a SailPoint access certification campaign is a periodic access review: IIQ generates review items (identities, entitlements, roles) for the right reviewers, who certify or revoke each item, with every decision logged as audit evidence. Campaign types — manager, application owner, role ownership and entitlement-focused — answer different governance questions. Design quality decides everything: a well-scoped campaign finishes at 95%+ on time; a bloated one trains reviewers to click “approve all”.
The Four Campaign Types and What Each Answers
| Campaign type | Governance question | Reviewer | Typical cadence |
|---|---|---|---|
| Manager certification | “Does my report still need this access?” | Line managers | Quarterly |
| Application owner certification | “Who has access to my application, and should they?” | App owners | Quarterly/semi-annual |
| Role composition certification | “Does this business role contain the right entitlements?” | Role owners | Semi-annual |
| Entitlement/ focused (high-risk) | “Who holds this specific dangerous privilege?” | Entitlement owners | Monthly/quarterly for critical items |
Campaign Anatomy: The Terms Interviews Expect
- Campaign: the container — type, scope, schedule, phases.
- Certification entities and items: what gets reviewed (an identity and its entitlements, or role definitions).
- Phases: typically review → remediation → end; some add a second-tier sign-off phase.
- Delegation and reassignment: reviewers push items to someone who actually knows the access.
- Bulk decisions and sign-offs: allowed, with the reviewer attesting — the audit trail captures who attested to what, when.
- Remediation: revoked items flow into provisioning changes (or task queues) at the end of the review phase.
Campaign Design That Reviewers Actually Complete
The difference between a campaign people finish and one they rubber-stamp is reviewer load and relevance — every rule below exists because a campaign without it failed:
- Scope to changes where possible: reviewing only since-last-time changes (new grants, modified entitlements) keeps volumes survivable; full-population reviews stay reserved for high-risk applications.
- Sample smartly for big populations: statistical sampling plus 100% review of privileged items is a defensible, honest strategy — say so explicitly in policy.
- Fix reviewer data before launch: campaigns inherit identity data; stale manager mappings route items to people who left. Campaign generation is where bad HR data becomes visible (and embarrassing).
- Set reminder and escalation rhythms: day 5 reminders, day 10 manager escalations, day 14 auto-sign-off with flagging — the exact rhythm is less important than having one.
- Pre-commit the remediation path: decide who executes revocations and by when, before the campaign starts, not after 300 revocations pile up.
What Auditors Ask For (Keep These Ready)
- Completion evidence: who reviewed, decisions, timestamps, sign-offs — IIQ reports this; make sure the export is part of the runbook.
- Remediation closure: revocations executed, with dates, mapped back to campaign items.
- Exception handling: mitigating controls and their owners for access kept despite concerns.
- Campaign-to-policy linkage: how this campaign satisfies which control requirement — the mapping auditors ask about first — build the mapping when you design the campaign, not when they ask.
A regional bank’s audit found their previous year’s campaign had a 99% “approve-all” rate with no sampling — the auditors treated the campaign as evidence of absence of governance, which is the worst outcome a campaign can produce. The rebuild used change-based scoping plus privileged-item full review; the next audit read it as a real control. Same tool, different design, opposite conclusions. The design, not the tool, is the control — the sentence to remember whenever a platform demo promises governance out of the box.
The Campaign Calendar: Designing the Year, Not the Event
Mature governance teams run campaigns as a calendar, not as events. The annual shape most Indian BFSI estates converge on: one broad manager campaign in a quiet quarter, application-owner campaigns aligned to the application risk register (high-risk apps twice yearly, the rest annually), role campaigns after each significant role-model change, and quarterly focus reviews on privileged entitlements. Sequence them so reviewer populations never collide — the same forty managers should not receive three campaigns in one month, or “approve-all” becomes a survival behaviour. The calendar also has an audit face: control frameworks expect review frequencies per risk level, so the calendar IS the control — document it, get it approved, and let the IGA fundamentals guide show how each campaign answers a specific framework clause. When an auditor asks how often a high-risk application is reviewed, the answer should be a calendar citation, not a scramble — and the calendar document itself goes in the audit pack.
Reviewer Fatigue: Countermeasures That Work
Campaign quality decays with reviewer load, and the decay is predictable: past roughly 150 items per reviewer, decision time per item collapses and rubber-stamping begins. Countermeasures that survive contact with reality: cap item counts by design (scope and sampling, per the checklist above); train reviewers in a 20-minute session before their first campaign — what “certify” legally means, how to delegate, where revoke consequences land; measure decision quality, not just completion — revocation rates below 1% across a whole campaign are a warning sign auditors have learned to read; and close the loop visibly, because reviewers who see revoked access actually disappear (lifecycle events are what execute it) take the next campaign seriously. The deeper fix is cultural: campaigns are the organisation saying access is borrowed, not owned — and that message only lands when revocations happen, never when the same campaign runs at 99% approval every quarter like a metronome. Reviewers, like audiences, eventually meet the behaviour you train into them.
Training Resources
The SailPoint IdentityIQ Certification Training includes a full campaign lifecycle lab — design, generate, review, remediate, report. Campaign enforcement connects to the IIQ policy model, and the wider governance context lives in the IGA fundamentals guide and the IAM training track; the IIQ roadmap sequences where campaign skills sit in the admin and developer tracks.
FAQ
What is a certification campaign in SailPoint IIQ?
A structured access review where designated reviewers certify or revoke identities’ access, with decisions logged for audit. Types include manager, application-owner, role and entitlement-focused campaigns, each answering a different governance question, and misnaming the question is how campaigns get scoped wrong from birth. Name the question in the campaign description itself.
How is access certification different from an SoD policy?
SoD policies enforce defined rules automatically; campaigns put judgement questions to humans. They complement: policies stop known-toxic combinations, campaigns catch what no rule anticipated — the access that is individually harmless and collectively questionable — which is why neither can replace the other in a control framework. Together they cover the known and the unknown; alone, each leaves half the risk surface open.
How long should a certification campaign run?
Two to three weeks is the realistic norm for manager campaigns at large organisations, with reminders and escalation built in. Shorter deadlines with poor reviewer data produce rubber-stamping, which auditors now detect and penalise — completion rates without decision-quality data satisfy nobody anymore.
What happens after a reviewer revokes access?
At the remediation phase, revoked items generate provisioning actions — disable or remove operations via the target connectors — tracked to completion. Unexecuted revocations are a common audit finding, so closure tracking matters as much as the decisions — auditors trace revocations to completion, not to intention. Set a closure SLA and report it with the completion number.
Can reviewers delegate campaign items?
Yes, delegation and reassignment are standard features, and good campaign design encourages them: reviewers should push items they cannot judge to someone who can, rather than approving blind. The audit trail records the delegation chain, and auditor sampling of delegated decisions is routine — so delegate deliberately, and record why the delegate is the right judge for the item.
