EAP post auth reject and access-challenge

Hi, Just wondered if someone could explain the reason why, on rejection of EAP authentication, an access challenge request is sent out to the NAS, and whether it's something we can control or not? Thanks Andy