.png)
An access review can be fully decided and completely stuck. The gap between the two is one click, and most progress tracking can't see it.
A reviewer works through every row, the progress bar fills, and the tab closes. Three weeks later the certification hasn't moved.
Every record was decided. None was confirmed. Nothing on screen told the reviewer those were different things, and nothing told the program owner either, until a deadline passed. This is one of the quietest failure modes in a user access review program, and it's a tracking problem before it's a people problem.
In this guide, we cover why a decision and a commitment are different events, why single-number progress tracking hides the gap, who gets hurt by it, what meaningful progress visibility looks like, and how to chase the right reviewer with the right message.
A Decision Is Not a Commitment
An access review has two distinct acts that most tracking treats as one.
Reviewing is the judgment: approve this access, modify it, or revoke it. It's recorded against a record, and it's usually still editable, because reviewers change their minds, spot patterns halfway through, or get a better answer from a colleague.
Signing off is the commitment: the reviewer confirms that every decision for their assigned records is final. Sign-off locks the decisions, and it's what hands the certification to the next stage, whether that's a second-level reviewer, remediation, or closure.
That second act is the one the outcome depends on. A certification can't progress, can't trigger remediation, and can't close on decisions alone. It moves on confirmed decisions only.
The prose summary of how a record moves, then the table. A record starts with no decision, becomes decided once the reviewer acts, becomes committed when the reviewer signs off, and only then becomes eligible to drive remediation and closure. The first two states are the reviewer's work. The third is what the program actually needs.
The middle row is the problem. It looks like finished work from the reviewer's side and like nothing at all from the certification's side.
A decision is the reviewer's work. A sign-off is the program's input. Tracking only the first tells you how hard people worked, not whether anything will happen.
Why a Single Progress Number Hides the Gap
Most review tooling, and nearly every spreadsheet process, reports one progress figure: records acted on out of records assigned. It's an intuitive number, and it measures the wrong thing for three reasons.
It counts the step the reviewer controls, not the step the outcome depends on. Remediation, level progression, and closure all key off sign-off. The number everyone watches isn't the number governing what happens next.
It makes the gap look like completion. A reviewer who decided everything and confirmed nothing sees a full bar and reasonably concludes they're done. There's no visual difference between "finished" and "finished except for the click that makes it count."
It hides the problem from the people who could fix it. Finding reviewers who had acted but not confirmed typically means opening a certification, then an application or group, then a per-reviewer breakdown. No one has time to do that across dozens of open certifications before a deadline, so stalled reviews surface as missed dates rather than as signals.
This compounds an existing problem. Deadline misses are already common in manual programs, with 41 percent of manual-review organizations reporting missed deadlines. A tracking model that can't distinguish "not started" from "done but unconfirmed" guarantees some of those misses are avoidable ones that no one saw coming.
Who the Gap Hurts
The sign-off gap isn't one problem. It lands differently on each role in the program.
The Reviewer Who Thought They Were Finished
A line manager pulled into a quarterly certification works through their records, watches the bar fill, and closes the tab. Reviewers who aren't security specialists are the most exposed here, because they have no mental model of a separate confirmation step. The distinction needs to be on screen at the moment the work ends, not in a chasing email weeks later.
The Certification Owner With Many Reviews Open
Scanning a list of open certifications, a program owner needs to separate two situations that look identical on a single-number bar: reviews no one has started, and reviews where the work is done and one click is missing. Those need completely different conversations.
The Admin Working to a Deadline
Two days before an audit window closes, the only useful question is which reviewers to chase and what to say to each. "You haven't started" and "you've finished but haven't confirmed" are different messages with different urgency. Without the distinction, every reminder is generic, and generic reminders are the ones that get ignored.
The Compliance Lead Evidencing a Completed Review
For audit purposes, the figure that matters is how many decisions were formally confirmed, not how many were entered. A historical record that preserves both numbers shows what was actually attested rather than what was merely typed. That's the difference between evidence and activity, and it's what auditors test for when they trace a review from decision to outcome.
The Recurring Review That Quietly Stalls
Recurring certifications are the easiest to stop watching. One that regenerates every quarter and stalls at the same point each time (decided, never confirmed) is invisible unless someone thinks to open the detailed view. Visible sign-off state at the list level turns a recurring blind spot into something you can see at a glance.
Decisions vs Sign-Off: Two Questions, Two Numbers
A common confusion arises once both numbers are visible. A certification can show every record approved and zero signed off, and the two readings look contradictory.
They aren't. They answer different questions:
- The decision summary (Approved, Modify, Revoke, Pending) answers: what did reviewers decide? Its "pending" means no decision has been recorded.
- The sign-off count answers: have those decisions been committed? Its "pending" means a decision may exist but hasn't been confirmed.
A certification reading 100 percent approved and 0 of 16 signed off is internally consistent: the reviewer decided everything and committed nothing. Neither number is wrong. Programs that track only one of them are missing half the picture.
What Meaningful Progress Visibility Looks Like
If you're evaluating how any tool or process reports review progress, six properties separate useful tracking from reassuring tracking:
- Lead with the state that governs the outcome. Sign-off count first, because it determines what happens next.
- Keep the work-done figure visible. The reviewed count still shows how much effort reviewers have put in. Hiding it replaces one incomplete picture with another.
- Show three states, not two. Not started, decided but unconfirmed, and confirmed are different situations. A single bar should distinguish them visually.
- Make the difference visible at the list level. If spotting a stalled review requires opening each certification, it won't be spotted.
- Preserve both figures after closure. The historical record should show what was attested, not just what was entered.
- Be explicit about scope. In multi-level reviews, progress should reflect the level currently in flight, and the tracking should say so.
Chasing the Right Reviewer With the Right Message
Once the states are distinguishable, follow-up gets sharper. The pending reviewers fall into two groups that need different handling:
The second group is the easiest win in any review cycle, and the most commonly missed. These reviewers don't need persuasion or workload relief. They need to know a step remains.
There's also a backstop for the stubborn cases. When a reviewer has completed every action but never confirms, a certification owner can force the sign-off so a stalled confirmation doesn't hold the entire review hostage. The condition matters: it applies only once every action is complete, because it exists to unblock confirmation, not to cover unfinished review work.
Reducing how often this happens at all is a design question, and routing is part of it: our guide to review delegation models covers who should review what. The same load, context, and routing choices behind low-fatigue reviews make reviewers more likely to finish the full sequence, including the last step.
How Zluri Shows the Difference
In Zluri's Access Reviews module, progress is reported as a pair of numbers on a single bar, wherever progress appears.
Two numbers. The signed-off count leads, in blue (for example, 0 / 16 signed off). The reviewed count sits beside it in grey (16 / 16 reviewed). Both are counts of records against the same total, and the signed-off figure is never higher than the reviewed figure.
One bar, three states. Solid blue marks records reviewed and signed off. Pale blue marks records reviewed with sign-off pending. Grey marks records with no decision yet. A certification where everything is decided and nothing confirmed shows a bar that's full width but visibly not solid blue, which is the entire point of the design.
A hover breakdown. Hovering over the bar opens the exact counts behind each segment: total records, reviewed and signed off, reviewed with sign-off pending, and review pending.
Four surfaces, consistent figures. The same pair appears on the Ongoing list, the Completed list, the certification detail for each application or group, and the record review screen beside the Sign Off button. The reviewer sees the distinction at the moment of finishing; the owner sees it from the list; the compliance lead sees it in the closed record.
Two scope notes are worth knowing. In multi-level certifications, the figures reflect the level currently in flight rather than cumulative progress across levels, which fits how multi-level reviews actually sequence. And the figures describe review and sign-off only: whether remediation has run is tracked separately, because that's a different stage of the lifecycle. For how decisions turn into executed changes, see our piece on closed-loop remediation.
If you want the full configuration flow, including how reviewers, defaults, and sign-off fit together, our walkthrough of how access reviews work in Zluri covers it end to end.
Making Sign-Off Visible Is a Program Decision
You don't need specific tooling to start closing the gap. Whatever you use today, three steps move you toward it:
- Define "done" as signed off, not decided, in your review policy and in your reviewer instructions.
- Track the two numbers separately in whatever reporting you run, even if that means a manual count.
- Send two different reminders: one for people who haven't started, one for people who are a single click away.
Expect the first cycle to surface a pattern: some "overdue" reviews were never undecided. They were unconfirmed.
Frequently Asked Questions
What is the difference between reviewed and signed off in an access review?
Reviewed means a reviewer has recorded a decision (approve, modify, or revoke) against a record, and that decision can usually still be edited. Signed off means the reviewer has confirmed all their decisions as final, locking them and allowing the certification to move to the next level, to remediation, or to closure.
Why can an access review look complete but not progress?
Because progress is often measured by decisions made, while progression depends on sign-off. If every record has a decision but nothing is signed off, the progress indicator looks full while the certification has nothing it can act on.
Can a certification close if reviewers decided everything but never signed off?
No. Level progression, remediation, and closure all depend on confirmed decisions. A certification owner can force sign-off in cases where a reviewer completed every action but never confirmed, but it can't be used to cover records that were never reviewed.
Why does the decision summary show 100 percent approved while sign-off shows zero?
The two figures answer different questions. The decision summary counts what reviewers decided, while the sign-off count shows whether those decisions have been committed. A reviewer who approved everything and confirmed nothing produces exactly that reading, and both numbers are correct.
What should auditors see as evidence of a completed review?
They should see confirmed decisions with timestamps, reviewer comments on modify and revoke actions, and evidence that the resulting access changes were executed. The signed-off count is the evidence of attestation, which is why preserving it in the closed record matters more than a count of entered decisions.
How do you reduce the number of reviews stuck at decided-but-unsigned?
Make the sign-off step visible to reviewers at the moment they finish, separate reminders for unstarted and unconfirmed reviewers, and reduce the load and friction that cause people to disengage before the final step.
