Add Recertification Policy to Audit

After creating an audit, we need to add one or more recertification policies to the Audit. An audit is the actual review of access rights against the company policies and regulations, so it’s necessary to add a Recertification Policy that defines rules and procedures for reviewing access rights. The Instructions to create the recertification policies are provided in the doc Create Recertification Policies.

Key Information

Audits can be used to certify multiple items, such as external partners and high-risk management roles, by incorporating multiple recertification policies into a single audit. This can be beneficial as it allows organizations to efficiently assess multiple areas of concern at once, rather than having to conduct separate audits for each item.

In this article, we will learn how to add a recertification policy to an audit.

Add the Recertification Policy to the Audit

You will be automatically navigated to view one Audit page once you have created an Audit. Please skip step 1 and 2, which provides instructions to open view one page if you already have it open.

Navigate to Compliance → Recertification and select the Audits tab.
To find the Audit, you can type the name in the search textbox and click on the search button to search. Click on the name of the Audit to open the ViewOne page.
Locate the Recertification Policies tab. Click on the icon to add a recertification policy to the Audit.
Select the recertification policy from the recertification dropdown. Select the fall-back assignee and click on Save.

The 'Exclude any recertified within last X days' setting is a configuration that prevents the duplication of recertification business requests for the same resource within a specified timeframe. This configuration is designed to promote efficiency and avoid unnecessary repetition in the recertification process.

To elaborate, let's assume the 'X' in 'last X days' is set to 90. This means that once a resource, say a user account, undergoes a recertification process, a new recertification request won't be generated for the same resource until 90 days have passed from the creation date of the initial audit. Important to note here is that this interval is calculated from the audit's creation date, not from when any approval decisions are made on the recertification requests.

For instance, suppose an audit begins on September 1, 2023, and triggers a recertification request for a particular user account. Even if other audits or policies include this same user account within the next 90 days, no new recertification request will be generated for it until December 1, 2023 (90 days later).

This configuration applies universally across all audits and policies, ensuring a uniform recertification cycle for each resource.

Next Steps

Verify Business Requests are Generated