Periodic review of user access rights to ensure appropriateness. Managers certify or revoke access. Required by compliance frameworks like SOX and HIPAA.