Suggestions to better manage semi-annual user re-certification exercise?

From my past experience it highly depends on who the request is coming from and the requirements given.  I worked for a publicly traded manufacturing company and the auditors wanted proof that the security information file came directly out of OneStream and then wanted the assistant controller to review each user's access and send back a certified/signed file with notes and a signature.  There's not much you can do if the requirements are strict, but keep fighting the good fight.