Description

A focused course, tailored for you

Access Recertification Without the Quarterly Fire Drill

Build the role-lifecycle and entitlement-review process that passes an auditor's access control review on the first pass.

Every quarter the access recertification closes and looks clean in the IGA tool. Then the auditor pulls a sample and finds provisioning drift nobody caught. The problem is not the tool. It is the missing artefacts between the tool's view and what the application actually enforces.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

IAM engineers running access recertification programmes at SaaS-scale organisations face a specific structural problem: the IGA platform reports entitlements, but the ground truth lives in three other places simultaneously. The role definition in the directory may not match the permission set in the application. The SCIM provisioning log shows the push succeeded, but the app did its own override. The quarterly review campaign captures current state but not the drift that accumulated between campaigns. Auditors for SOC 2 Type II and ISO 27001 access controls know to pull out-of-band samples precisely because they have seen this pattern. The engineer who can present a role-lifecycle runbook, a provisioning-verification procedure, and a recertification scope document that accounts for all three sources passes the walkthrough. The engineer who cannot has another finding.

What you walk away with

Design a role-lifecycle runbook that documents the full provisioning-to-deprovisioning chain and satisfies access control evidence requests from SOC 2 and ISO 27001 auditors.
Build an out-of-band entitlement verification procedure that compares IGA-reported entitlements against application-enforced permissions and surfaces drift before the quarterly campaign closes.
Write a recertification scope document that defines what is in scope, what sampling methodology was used, and what the review outcome means, in language an auditor can accept without further clarification.
Implement a role explosion remediation process that reduces active role count without breaking existing access, using a role rationalisation framework tied to business function rather than historical provisioning.
Produce a SCIM provisioning hygiene checklist that catches common provisioning overrides and sync failures before they become audit findings.
Assemble the complete access control audit-evidence package that a SOC 2 Type II auditor expects for the logical access management and access review control families.

The 12 modules

Module 1. The Three-Source Access Model

Most access recertification failures come from treating one data source (the IGA tool) as the authoritative view. This module maps the three actual sources of truth: the directory role definition, the IGA entitlement report, and the application-enforced permission set. You will build a source-mapping worksheet that identifies which source governs which application tier and where drift is most likely to accumulate between quarterly campaigns.

Module 2. Role Explosion: Diagnosis and Root Cause

Role explosion is the most common prerequisite for a messy recertification. This module covers the two root causes: provisioning exceptions that got codified as roles, and role inheritance chains that were never rationalised after an acquisition or platform migration. You will run a role-count analysis against your directory using the diagnostic queries provided and produce a categorised inventory of roles that distinguishes business-function roles from historical provisioning artefacts.

Module 3. Role Rationalisation Without Breaking Access

Reducing role count while preserving business access requires a sequenced approach. This module provides a role rationalisation framework built on business function mapping rather than historical entitlement history. You will learn how to propose a target role set, validate it against active workloads before cutover, and document the rationalisation decision in a format that satisfies an auditor asking why roles were consolidated or removed during the review period.

Module 4. SCIM Provisioning Hygiene

SCIM provisioning successes do not guarantee application-side enforcement. This module covers the four most common failure modes: application-side permission overrides that survive a SCIM push, group membership sync delays that leave stale access active, soft-delete vs hard-delete handling differences between the IGA layer and the application, and attribute mapping gaps that provision a user without their required profile attributes. You will build a SCIM hygiene checklist that runs as a pre-campaign check.

Module 5. Out-of-Band Entitlement Verification

The out-of-band entitlement verification procedure is the artefact that closes the gap between what the IGA reports and what the application enforces. This module provides a step-by-step procedure for sampling a defined percentage of high-risk entitlements, pulling the application-side permission state directly, comparing it against the IGA record, and documenting the comparison result. You will produce a procedure document formatted for inclusion in the audit-evidence package.

Module 6. Recertification Scope Document

Auditors for SOC 2 Type II logical access controls ask three questions about a recertification campaign: what was in scope, what sampling methodology was applied, and what the review outcome certifies. This module shows you how to write a recertification scope document that answers all three clearly. You will produce a template covering scope definition, exclusion rationale, sampling approach (statistical vs risk-based), reviewer assignment, and outcome statement, then apply it to your most recent completed campaign.

Module 7. The Role-Lifecycle Runbook

The role-lifecycle runbook is the primary artefact an auditor reviews when assessing your access provisioning control. This module covers the six components that must be present: role creation authority, provisioning trigger definition, change approval workflow, periodic review cadence, deprovisioning trigger and verification step, and exception process. You will build a runbook template and populate it for at least one production role set, producing a document you can hand to an auditor without supplementary explanation.

Module 8. Access Review Campaign Design

A well-designed access review campaign produces evidence that is useful for more than one compliance programme simultaneously. This module covers campaign scoping for SOC 2 Type II CC6.2 and CC6.3, ISO 27001 A.9.2 and A.9.5, and application-level access controls that feed into a SOX IT general controls review. You will design a campaign structure that captures the evidence each programme needs without running three separate campaigns, and produce a campaign-to-control mapping table.

Module 9. Reviewer Enablement and Escalation

Access reviews fail when business reviewers do not understand what they are certifying. This module provides a reviewer enablement pack: a one-page explainer of what the certification decision means, a definition of the role and entitlement being reviewed, an escalation path for uncertain cases, and a documentation standard for deny decisions. You will also build an escalation-tracking log that provides evidence the review process handled edge cases consistently.

Module 10. Handling Provisioning Drift Findings

When out-of-band verification finds provisioning drift, the response procedure determines whether the finding becomes a control deficiency or a remediated exception. This module provides a drift-response workflow: triage severity, identify root cause (SCIM failure, manual override, sync lag, or role mapping gap), apply the appropriate remediation, document the finding and outcome, and decide whether the drift warrants a control observation in the audit report. You will produce a drift-response procedure and a finding log template.

Module 11. The SOC 2 Access Control Evidence Package

SOC 2 Type II auditors testing the logical access management and access review controls expect a specific set of artefacts. This module maps each expected artefact to the documents you built across the course, assembles them into a package, and walks through the auditor's typical testing procedure so you can anticipate questions and supplement the package where gaps exist. You will produce a completed evidence package index that maps each artefact to the control it satisfies.

Module 12. Maintaining the Programme Between Campaigns

Access recertification is not an annual event; drift accumulates continuously. This module builds the between-campaign maintenance schedule: monthly provisioning hygiene checks, triggered reviews on role changes and system migrations, a role-definition version control process, and a pre-campaign checklist that runs two weeks before the quarterly campaign opens. You will produce a maintenance calendar and a pre-campaign readiness checklist that keeps the next recertification from becoming a fire drill.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Modules 1-3 address the structural root cause: role explosion and the three-source access model that makes entitlement verification unreliable without an explicit framework.

Modules 4-6 build the three core artefacts: the SCIM hygiene checklist, the out-of-band verification procedure, and the recertification scope document.

Modules 7-10 build the governance layer: the role-lifecycle runbook, campaign design, reviewer enablement, and drift-response procedure.

Modules 11-12 close the loop: the SOC 2 evidence package and the between-campaign maintenance programme that prevents the quarterly fire drill from recurring.

What you get with this course

Twelve written modules with downloadable templates for every artefact: role-count diagnostic worksheet, SCIM hygiene checklist, out-of-band entitlement verification procedure, recertification scope document, role-lifecycle runbook, campaign-to-control mapping table, reviewer enablement pack, drift-response procedure, SOC 2 evidence package index, and pre-campaign readiness checklist.
The hand-built implementation playbook, delivered alongside course access, covering your specific IGA tool category and application mix.
Self-paced access through the Art of Service learning environment, no scheduled sessions.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Before and after

Before

Quarterly recertification closes in the IGA tool, shows clean, and then the auditor finds provisioning drift in out-of-band samples. Another finding. Another remediation. Same conversation next quarter.

After

The role-lifecycle runbook, out-of-band verification procedure, and recertification scope document are in place. The next auditor walkthrough uses those documents as the primary evidence set and the campaign produces no surprises.

What happens if you do not address this

Access recertification findings are among the most repeatable IT audit observations because the underlying structural problem, the gap between IGA-reported state and application-enforced state, does not self-correct. Each quarter without the artefacts in place is another cycle where drift accumulates and the auditor has standing to issue a repeat finding.

Who it is for

IAM engineers and identity platform engineers at organisations running IGA tools who are responsible for the quarterly access recertification campaign and the audit evidence package that follows. You understand SCIM, OAuth, RBAC, and directory synchronisation. What you need is the operational framework that connects those technical components to the audit artefacts the compliance team needs.

Who this is NOT for. Engineers who only need to learn the technical mechanics of a single IAM protocol. This course is for engineers who already understand the technology and need to build the governance layer on top of it.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Approximately 8-10 hours across the twelve modules, plus the time to apply each template to your environment. Most engineers complete the course and produce their first artefact set within two weeks.

Why $199 is the right number

IGA vendor training covers the tool mechanics, not the governance layer. Compliance frameworks describe the control objective, not the operational procedure. This course builds the artefacts that sit between the tool and the framework and that auditors actually check.

FAQ

Does this assume a specific IGA tool?

No. The artefact templates are tool-agnostic. The implementation playbook is tailored to your specific tool category and covers any tool-specific nuances relevant to your environment.

Is this relevant if we are not yet undergoing a SOC 2 audit?

Yes. The role-lifecycle runbook and out-of-band verification procedure are operationally useful regardless of audit programme. If a SOC 2 or ISO 27001 audit is on the horizon, the course produces the evidence set you will need.

How much of this is about the technical IAM layer versus the governance layer?

The course assumes you already understand the technical layer. Modules 1-4 connect technical components (SCIM, roles, directory sync) to their governance implications. Modules 5-12 build governance artefacts. The implementation playbook covers your specific technical environment.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.