Initiate Certification: Scheduled Reviews for Every Policy and Business Role
Last Updated date: October 13, 2026
On this page
See Tech Prescient in Action
Automate access, reduce risk, and stay audit-ready
Every policy and business role in your platform is a live ruleset actively deciding who gets access, under what conditions, and for how long. The problem is not that these rules are inaccurate when created. The problem is that organizations grow, teams restructure, and processes evolve, while the policies and roles governing access often do not. They run silently in the background, even though the reality they were built for has already shifted.
Initiate certification in Identity Confluence ensures every policy and business role is reviewed on a defined schedule, with the owner formally confirming its validity on time and every action logged and audit-ready.
TL;DR
- Initiate certification ensures every policy and business role is reviewed on a defined schedule
- A global certification interval is set once, and each policy and business role runs its own countdown from its creation date
- Every policy and business role requires at least one named owner before it can be created
- A Certify button appears as the deadline approaches and turns red when overdue
- Owners can trigger an early review anytime via the Initiate Certification option within that specific page
- Every completed policy certification and business role certification is logged with who certified it and when
What Happens When Policies and Business Roles Are Never Reviewed
Policies and business roles are created to reflect a specific reality: a team structure, a system, a job function. But that reality changes over time, while the policy or business role does not. It keeps running, keeps enforcing its original rules, and keeps granting access that nobody has revisited since the day it was created.
Without a formal review cycle, there is no internal trigger forcing anyone to check whether those rules still make sense. The only moment accountability surfaces is when an auditor asks who last reviewed a specific policy and when. At that point, an unclear answer is itself an audit finding: proof that your access governance certification program has no structured process for confirming whether the rules governing access are still valid, accurate, and necessary.
Regulators flag exactly this gap: not that the rules were wrong, but that nobody ever confirmed they were right. The scale of this is growing fast. In SailPoint's identity research, 91% of identity leaders said the volume of access reviews has increased since 2022, and 99% of organizations now run reviews primarily to satisfy regulatory frameworks. When review is treated as a scheduled, owned obligation rather than a scramble before an audit, that pressure becomes manageable instead of a quarterly fire drill.
What Is Initiate Certification
Initiate certification is a structured review cycle built directly into Tech Prescient's Identity Confluence. Every policy and business role gets a defined review date, and the certification record is logged automatically once the review is complete.
Think of it like a financial audit every public company must complete on a defined schedule. The books do not audit themselves. A designated person reviews, confirms accuracy, flags corrections, and signs off before the deadline. Missing that window draws immediate regulatory attention.
Initiate certification works the same way. The owner reviews the rules configured inside the policy or business role, confirms they are still accurate and in use, makes any necessary updates, and certifies. Every completed review is logged automatically, creating a clean, timestamped record with no manual effort.
Application Insight:
Certification doubles as a review and an update window. The owner does not just confirm. They inspect the configured rules, make any necessary changes on the spot, and certify once everything is accurate. No separate change request. No back and forth.
How Does Initiating Certification Work
Every part of the process is designed to keep IGA certification automation structured, visible, and owned from the moment the schedule is set to the moment the review is logged.
How Does the Certification Schedule Work?
A tenant admin sets the global certification interval. Two separate intervals are available, one for policies and one for business roles, so each can be adjusted to its own risk profile. Identity Confluence recommends 30 to 90 days for policies and 60 to 180 days for business roles.
What makes this model practical is that every policy and business role runs its own personal countdown from the day it was created. The global interval sets the rule. The creation date sets the starting point. A policy created on day 10 of a 30-day cycle has its first certification due on day 40, not day 30, alongside older records. Each one follows its own independent clock.
Governance Note:
Every policy and business role in Identity Confluence requires at least one named owner before it can be created, ensuring certification always has a responsible person attached, and accountability is never optional.
What Happens as the Deadline Approaches?
As the review date approaches, a Certify button appears directly on that specific policy or business role page as a direct prompt to act. If the deadline passes without action, the Certify button is highlighted in red, displaying details about the overdue item. It stays that way until the owner completes it. There is no automatic escalation and no silent approval. The responsibility sits with the owner until they act.
Why Does the Initiate Certification Button Exist?
A review cannot always wait for the scheduled date. When a policy rule changes mid-cycle, a compliance audit is approaching, or a team restructure demands an immediate review, the owner can select that specific record and click the Initiate Certification button to trigger the review on demand without waiting for the countdown to expire.
Both the Certify and Initiate Certification buttons are visible to everyone who can see that page, but only the owner can act on them. Administrator-level certification initiation is part of an ongoing feature enhancement currently in the pipeline.
What Initiate Certification Actually Changes
This feature changes more than the workflow. It changes the structure underneath it.
Policy and business role reviews depend entirely on someone remembering to do them. No schedule, no reminder, no visible deadline, and no record of whether it ever happened. The moment that informal responsibility was missed, there was no way to know until an audit surfaced.
With the Initiate certification in place, every policy and business role has a defined review date, a visible 'Certify' button tracking the deadline, and a logged record of every completed review.
- Policy and business role accessibility ensures that the owner certifying each record is the right person for that record, with scoped visibility and structured approval rights already in place before certification begins.
- Ownership succession ensures that if that owner leaves, accountability transfers automatically, so the certification chain never breaks. Check out what access certification is here.
How Does Initiate Certification Support Compliance
SOX, ISO 27001, HIPAA, GDPR, and the rest all share one common requirement: access controls must be reviewed periodically by a named, accountable person, and that review must be provable. Initiating certification satisfies this directly by putting a structured, scheduled review cycle on every policy and business role, with the owner formally confirming validity at defined intervals and every action logged automatically.
When an auditor asks for proof of review, every completed business role certification and policy certification in Identity Confluence is logged with who certified it and when, giving compliance teams a reliable, audit-ready record without manual effort.
Is your certification cadence keeping pace with 2026 threat exposure?
Benchmark your identity governance maturity in under 15 minutes.
What Comes Next
Initiate certification is where access governance certification becomes a continuous, structured discipline. Once every policy and business role has an active review cycle in place, governance stays complete through defined ownership, structured approvals, and automatic continuity when personnel change.
FAQs
It is a scheduled review cycle for every policy and business role in Identity Confluence. Each one gets a defined review date, the named owner confirms it is still accurate and in use, and the certification is logged automatically once complete.
A tenant admin sets a global interval, with separate intervals for policies and for business roles so each matches its own risk. Confirm the current in-product recommended ranges with your Identity Confluence contact, since they are set per tenant.
The scheduled cycle runs on each record's own countdown from its creation date. The Initiate Certification button lets the owner trigger a review early — for a mid-cycle rule change, an upcoming audit, or a team restructure — without waiting for the deadline.
Frameworks like SOX, ISO 27001, and HIPAA all require access controls to be reviewed periodically by a named, accountable person, with provable evidence. Every completed certification is logged with who certified it and when, so the evidence is ready when an auditor asks.
GET A PERSONALIZED DEMO
See Identity Confluence in Action
“One platform to govern identities, automate access decisions, and prove compliance; across every app, user, and system in your environment.”
Murli Ramsunder
Senior Architect, Vonage