Certification reporting
There are three types of certification reports presented in OpenIAM.
Scope report
The purpose of this report is to show the initial state of the certification. It lists the users whose access will be reviewed, what access will be reviewed, and who will do the review.
This report is generated by the system in the background when the administrator initiates a new campaign. The report can be downloaded in the webconsole, on the Report tab of the certification screen.
Also, the campaign managers of the campaign can find this report in self-service, in the Report tab.
The admin can perform an EXECUTE_ACCESS_CERTIFICATION command to see if there are any warning messages about scope report generation.
Current state report
The purpose of this report is to represent the current status of an access certification. The administrator can generate it, and it will be delivered to their mailbox. The report contains information about the certification status at the time of generation. This function is equivalent to getting a report from the Report menu > ACCESS_CERTIFICATION_REPORT.
Results report
The purpose of this report is to represent the results of a completed access certification campaign. This report is generated by the system: the batch task Access Certification reporting runs every night (and can be reconfigured to run on a custom schedule) and checks if there is a completed certification campaign without a results report. If the campaign lacks the results report, then the report is generated and sent to each campaign manager's email.
This process is captured in the audit system, and you can run it with the ACCESS_CERTIFICATION_AUTO_REPORTING action.
The BULK_APPROVAL_RISK column
The Results report includes a BULK_APPROVAL_RISK column that flags how each item's decision was made. This lets auditors identify access that was certified in bulk rather than reviewed one item at a time.
| Column value | Meaning |
|---|---|
| YES - reviewed via bulk approval (RISKY: items not reviewed individually) | The item's decision was submitted through the bulk approval action. The item was not reviewed individually. |
| No | The item was reviewed individually. |
This column is populated regardless of whether bulk approval was enabled for the campaign; when the setting is disabled, every item shows No. For details on the optional setting that makes bulk decisions possible, see Allow bulk approval.