If you are on 8.1p1 or above, you can install the Rapid Setup features, and make use of the “Mover” LCE that comes out-of-the-box. This LCE launches a Manager Certification when the Mover LCE is triggered. It lets you configure, per Application, if the Mover should include entitlements for that application into the Certification. You can also configure the conditions that will trigger the Mover, perhaps when the user’s manager, department or job title changes value.
If you are not using Rapid Setup, then you will have to create your own custom LifeCycle Event, IdentityTrigger Rule and Workflow or Certification Event