An access review is the examination of existing access, while access certification is the accountable decision that results from that review.
A manager, application owner or entitlement owner evaluates business need, role, policy, risk and usage. Certification records whether the reviewer approves, changes or revokes access, together with the reviewer, timestamp and rationale. In everyday IGA usage, the terms are often treated as synonyms.