Employee Self certification multiple level access review

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

8.4P2

Share all details about your problem, including any error messages you may have received.

We have a requirement for an event-based employee transfer certification.

The process should allow the employee to perform self-certification before manager.

If the employee rejects an access, it should be automatically removed without any manager review. If the employee approves the access, it should then be routed to the manager for a second-level review.

Currently, a pre-delegation rule is configured so that all access reviews are initially delegated to the employee. However, regardless of whether the employee approves or rejects the access, the items are being routed to the manager for review. I need to adjust this behavior so that manager review only occurs when the employee has approved the access.

Any guidance or best practices on how to configure this flow would be appreciated

Thanks in Advance!

Swetha.

2

Hi @Swetha_kaipa ,

This is the expected behaviour of pre delegation rule irrespective of decisions it is always forward to manager for final sign off

So I recommend to use signoff approval instead of pre delegation rule

sign off approval rule logic will

boolean hasApprovedItems = false;

for (CertificationItem item : certification.getItems()) {
if (item.isApproved()) {
hasApprovedItems = true;
break;
}
}

if (hasApprovedItems) {

return identity.getManager();

}

return null;

Thanks in advance

Avinash Mulpuru

3

Hi @Swetha_kaipa

you cb use multi-level sign-off instead:

Make the employee the actual reviewer (reassignment, not delegation

  • In your Pre-Delegation rule, set reassign = true and set the recipient to the certifiee (employee).
  • That makes the employee the owner of the review decisions.
  • Add a Sign-Off Approver Rule that routes to the manager only if anything was approved
  • If the employee revoked everything (or there are no approved items), return null → no manager step.
  • Then remediation runs based on the employee’s revoke decisions.

Sign-Off Approver Rule logic (simple):

  • if any item is Approved → return employee’s manager

  • else → return null

That gives you:

  • Employee rejects → goes straight to remediation (no manager review)

  • Employee approves → manager gets a second-level sign-off (review of the certification decisions)

If you also need the manager to re-review each approved line item (not just sign-off), that’s a different requirement and typically means two separate certifications (employee campaign first, then manager campaign filtered to approved items) or a custom workflow.

4

Thank you for your quick responses avinashmulpur and @amrdodani . I will try this sign-off approve rule approach.