But when the admin is accessing the email sent to reviewer (Shae Reed) and clicks the link to access certification, admin is able to access the certification and even review/sign off it. (please see below for steps)
What is the correct behavior?
No one else other than the assigned reviewer should be able to view/review/sign off certification unless its explicitly assigned to them not even admin.
This is happening in ISC demo tenant assigned to me.
What are the steps to reproduce the issue?
Admin logged into ISC tenant and admin doesnt have any campaign assigned to them.
The campaign sign off status report shows decision maker as admin, even when the certification was never assigned to admin
Do you have any other information about your environment that may help?
This could happen quite often. When reviewers face any issues they might forward the campaign emails to admin. Admin should not have any authority to make decision for the certification not assigned to them.
Hello Sanjay. This appears to be expected behavior rather than a bug. The Certification APIs authorize ORG_ADMIN and CERT_ADMIN users to view certifications, make decisions, reassign items, and sign off. Assigned reviewers can also perform these actions on their certifications.
So when an authenticated Org Admin opens the certification link, ISC authorizes the action through the administrator’s privileges even though the certification is assigned to another reviewer.
The Campaign Status Report also confirms that when a Cert Admin or Org Admin makes a decision, the administrator is recorded as the Decision Maker even when they are not the assigned reviewer.
If another person needs to complete the review, an administrator can formally reassign the certification. Restricting Org Admins from acting on unassigned certifications would be an enhancement request rather than a bug.
In real world, we choose reviewers (managers) based on authoritative data (like HR hierarchy) . we need audit trail in any other cases in case the reviewer is someone else other than the authoritative approver (either happening automatically through campaign generation because the original manager is terminated or happening manually because the original manager is on leave).
How do we explain to auditor why admin took action on a certification that was not assigned to them. Just because they had access to do it.
I understand that the admin need such access when they have to close the campaign and take action on undecided items but that situation is different and understood that admin needs to take action. This scenario is different.
That is a fair distinction. My earlier reply covered why ISC authorizes the action, but as you pointed out, permission alone does not explain the business reason to an auditor. I agree that administering a campaign and acting as its assigned reviewer are different responsibilities, and bypassing the reviewer should have a clear audit justification.
I could not find a documented control that requires an Org Admin to provide a reason or formally reassign the certification before acting. Since the action is permitted under the current model, requiring that additional audit control would be a valid enhancement request rather than a bug.
