The rubber stamp is the product: why access certification can't prove review happened

An identity governance vendor shipping a feature to detect rubber-stamping is telling you something important about its own category: the certification record, the artefact that underpins access assurance in most public companies, is regularly produced without the review it claims. That is not a user-behaviour problem. It is an evidentiary one, and it has a fix.

Part of Access governance and certification

The feature that gave the game away

Read the product documentation for a modern identity governance platform and you will eventually find a line about monitoring reviewers for rubber-stamp behaviour: flagging campaigns completed suspiciously fast, or reviewers who approve one hundred percent of items. It is presented as an advanced analytics capability.

Look at it from the other direction. A vendor only builds detection for a failure mode that is common, expected and structurally unavoidable within the existing design. The feature is an honest acknowledgement that the artefact the entire control produces — the certification record — does not, by itself, evidence that a review occurred.

That matters more than it sounds. In most public companies, periodic user access review is the control that underwrites the assertion that access to financial systems is appropriate. It is tested every year. It fails often enough that access-related findings are a perennial category in IT general controls. And its output is a row in a database.

What a certification record actually contains

Strip the workflow away and a certification decision is three fields: an entitlement identifier, a decision value, and the user id of whoever clicked, with a timestamp. Some platforms add a comment field that is almost always empty.

Three things are absent, and all three are necessary if the record is to function as evidence rather than as a log entry:

• What was rendered. The reviewer saw a screen. Nothing captures which entitlements were on it, in what order, with what descriptions, or whether the description said anything useful.
• Whether it was decidable. A line reading PRD-DB-RW-FIN-02 cannot be assessed by a line manager. The record does not distinguish an informed approval from an uninformed one.
• Who was present. The user id belongs to a session. Sessions are shared, delegated during leave, and occasionally driven by an assistant clearing a manager's queue.

The result is an artefact that is perfectly adequate as an operational record and structurally incapable of serving as evidence in an adversarial setting — which is exactly the setting an external auditor, a regulator or a post-breach investigation creates.

Why the system optimises for the behaviour that destroys the evidence

Campaign design makes rubber-stamping rational. A manager with fourteen direct reports may face several hundred entitlement lines, delivered on a deadline, in technical notation, alongside their actual job. The interface offers a bulk action because without one the campaign would never close.

Programmes are then measured on completion rate. Completion rate is a throughput metric. It rises fastest when reviewers stop reading. So the metric that governs the programme is in direct tension with the quality of the artefact the programme exists to produce, and the tension is resolved every quarter in favour of throughput.

A control whose success metric is completion will always converge on the fastest way to complete it.

Measure your own campaign before you argue about anyone else's

There is no published industry rate for rubber-stamping, because no organisation publishes its own. Rather than invent one, here is the method to compute yours. Every IGA platform records campaign item counts and reviewer activity timestamps. Both are exportable.

1. Export the last completed campaign: reviewer id, item id, decision, decision timestamp.
2. Group by reviewer and session. Treat gaps longer than fifteen minutes as session breaks.
3. For each session, compute elapsed seconds divided by items decided. That is your seconds-per-entitlement figure.
4. Plot the distribution, not the average. The average will be dragged upward by a handful of conscientious reviewers.
5. Compare the median against the interpretation table below.

Run this once and the conversation inside your organisation changes. It stops being a debate about whether managers care and becomes a number you can show a steering committee.

The Certification Evidence Standard

If the missing element is what the reviewer was shown, then the fix is to make what was shown part of what gets signed. Concretely, a certification decision becomes a canonical statement containing:

The statement is canonicalised — we use JSON Canonicalization Scheme, RFC 8785, so the same logical content always produces identical bytes — then signed by the reviewer's device credential, with user verification required, and countersigned by the issuer. The result verifies offline against a published key. An external auditor can check it without access to your identity platform and without trusting your administrators.

What changes for the reviewer

Almost nothing, and that is deliberate. The manager opens the same campaign, sees the same list — ideally with better descriptions, because the evidence now exposes their absence — and confirms with the same gesture that unlocks their laptop. The bulk action survives, but it now signs an explicit statement: I approved these 214 items as a set, having been shown this content, in this time.

That is the honest version of what already happens. Some organisations will not want it written down. That reaction is itself the finding.

What changes for the auditor

Today an auditor samples twenty certifications and receives twenty screenshots produced by the client's administrator. They are testing a control using evidence generated by the party the control governs, which every experienced auditor understands and accepts only because no alternative exists.

With signed certification receipts, sampling becomes verification. The auditor runs an open-source verifier against the receipts, checks the signatures against a published key, and reads the rendered content directly. The evidence is no longer something the client made; it is something the client cannot alter after the fact.

Where to start

1. Compute your seconds-per-entitlement distribution for the last campaign. Do not skip this; it is what makes the case internally.
2. Pick the smallest high-risk scope — privileged entitlements in financially significant systems — rather than the whole estate.
3. Fix descriptions for that scope first. Render binding exposes bad descriptions, so fix them before you expose them.
4. Run one campaign with signed receipts alongside the normal process, and hand the receipts to your external auditor as a pilot.
5. Compare the two evidence packages side by side at the next control walkthrough.

None of this requires replacing your identity governance platform, and nothing here is a reason to stop running certification campaigns. The campaign is not the problem. The problem is that its output cannot currently tell anyone whether it worked.

How to measure whether review is real

The fourth is the most diagnostic and the least computed. Reviewers genuinely applying judgement to different populations produce different revocation rates; identical rates across reviewers indicate the process rather than the population.

Objections and honest limits

“Low revocation means access is well managed.” It can. It can also mean nobody looked. The two are indistinguishable from the artefact, which is exactly the problem — and the reason to look at variance rather than the rate.

“Rubber-stamp detection solves it.” It flags the worst cases, which is worth having. It does not produce evidence that the unflagged decisions were informed.

Raising the evidence standard

1. Compute the four signals before your auditor does. Revocation rate, dwell, bulk share, reviewer variance.
2. Render what the reviewer is deciding about. Entitlement meaning, not an identifier.
3. Require a signature on high-risk entitlements only. A minority of items, where the answer matters.
4. Report exceptions, not completion. Completion rate is the metric that produced the problem.

Terms used here

Access certification

The periodic review in which managers confirm or revoke users' entitlements.

Rubber stamp

Approving without reviewing, producing an artefact indistinguishable from a considered decision.

Campaign

A scheduled round of certifications, typically covering hundreds or thousands of items per reviewer.

Frequently asked questions

Isn't rubber-stamping just a training problem? Training moves the number for a quarter or two and then it drifts back, because the underlying incentive — close the campaign — is unchanged. Making the reviewed content part of the signed record changes what the artefact proves regardless of reviewer diligence.

Does this mean our current certifications are worthless? No. They satisfy the operational requirement and document that a process ran. The narrower claim is that they cannot demonstrate, to a third party who assumes nothing, that a human examined the access they approved.

Will this slow down campaigns? The gesture adds a second or two per signed set, not per item. Bulk actions still work. The material cost is fixing entitlement descriptions, which is work most programmes have deferred anyway.

Can an auditor actually verify these receipts? Yes. Verification is an offline check of a signature against a published key using an open-source verifier. No access to your identity platform is required, and no callback to any vendor is involved.

Does a low revocation rate mean access is well managed? It might, or nobody looked. The artefact cannot distinguish them, which is why reviewer variance is the more diagnostic signal.

What does rubber-stamp detection achieve? It flags the worst cases. It does not evidence that unflagged decisions were informed.

Which metric should be reported? Exceptions and reviewer variance, not completion rate — completion is the metric that produced the behaviour.

Sources and further reading

• PCAOB AS 2201 — An Audit of Internal Control Over Financial Reporting
• FTC — business guidance on marketplaces and consumer protection
• Published research on access recertification, review fatigue and campaign scalability.
• RFC 8785 — JSON Canonicalization Scheme
• W3C Web Authentication Level 3
• ISACA — identity and access management resources
• NIST SP 800-53 Rev. 5 — access enforcement