Can a certifier alter their decision after signing off on a certification?

• A. Yes, always
• B. No, never
• C. Only if the decision is logged
• D. Only if it is prior to sign-off

Answer: (D)

The reasoning behind selecting "Only if it is prior to sign-off" as the correct answer is rooted in the process of identity certification within SailPoint. Certification is a formal process where certifiers review and approve access rights for users. Once a certifier has signed off on the certification, that decision is typically final because it reflects their assessment of the user's access privileges at that moment.

If a certifier wishes to alter their decision, it needs to happen before they officially complete the sign-off process. Alterations post-sign-off would undermine the integrity of the certification process and could lead to accountability issues, as it would be unclear what the certifier had originally authorized.

In contrast, the notion of being able to always change a decision after sign-off or doing so only if the decision is logged does not align with the principles of effective access governance, where finality and clear tracking of decisions are crucial. Allowing changes to happen at any time or based solely on documentation could lead to confusion and potential security risks, as it would become unclear what access was truly approved at any given time.