What security do I need to give an end user for them to set the Certification status from Certified to rejected?

12/13/2017

What security do I need to give an end user for them to set the Certification status from Certified to rejected? The user can unlock the WF, but can't reset the certified status once it is completed.