Creating and managing issues

This article covers the issue record: registering one, choosing its type and priority, assigning it, setting a deadline, and linking it to what it affects. For resolving and closing issues, see Handling and closing issues.

Adding new issues

An issue needs a name, a type, and a priority; the type and priority are what route it and rank it later.

Creating an issue

1. Go to the Issues page via the main menu
2. Click "Add issue" in the top right of the overview
3. The creation form opens where you can fill in non-conformity information

Filling in issue information

Only the name is required; type and priority can be set now or corrected later.

Required fields:

• Name - Choose a clear, descriptive name for the non-conformity
• For example: "Employee forgets laptop on train" or "Backup missed on multiple dates"

Optional but recommended fields:

• Issue type - Select the correct category from 7 available types
• Priority - Set urgency (High, Medium, Low)
• Assign owner - Assign responsible person
• Description - Detailed context and background information

Selecting issue type

Choosing the right type helps with workflow, reporting and assignment:

Generic - For general organisational matters:

• Policy needs to be created or updated
• Procedures missing for new processes
• Organisational changes require adjustments
• Example: "Implement employee screening procedure"

Audit finding - For formal audit findings:

• External auditor identifies non-conformities
• Internal audit finds compliance shortcomings
• Certification body sets requirements
• Example: "ISO auditor missing management review documentation"

Control gap - For missing controls:

• GAP analysis shows required controls that are missing
• New risks require additional measures
• Compliance frameworks introduce new requirements
• Example: "Access control admin accounts insufficiently restricted"

Incident - For actual security incidents:

• Phishing attacks and malware infections
• Data breaches and unauthorised access
• Physical security breaches
• Example: "Phishing attack compromises employee account"

Action plan - For planned improvement projects:

• Rollout of new security measures
• Training and awareness programs
• Implementation of new systems
• Example: "Q2 rollout security awareness training program"

Control deficiency - For failing existing controls:

• Implemented controls not working correctly
• Technical problems with security tools
• Process not effectively executed
• Example: "Encryption fails leaving data unencrypted"

Opportunity for improvement - For optimisation:

• Efficiency improvements of working processes
• Cost saving opportunities
• User experience improvements
• Example: "Speed up onboarding for faster security training"

Determining priority

Priority routes and ranks the issue, so set it based on urgency and impact rather than the default.

Assign High Priority for:

• Compliance deadlines within 30 days
• Critical security risks that directly threaten
• Audit findings that endanger certification
• Active incidents with ongoing impact

Medium Priority for:

• Planned improvements with quarterly deadline
• Control gaps without direct threat
• Action plans with clear planning
• Normal audit findings without urgency

Low Priority for:

• Long-term optimisations (> 6 months)
• Nice-to-have improvements without compliance impact
• Opportunities depending on other projects
• Minor administrative adjustments

Saving the issue

1. Check all entered information
2. Click "Create" to create the issue
3. The new issue appears in your overview with "Open" status

Editing issue details

Open an issue from the overview to change its fields.

Opening issue details

1. Click on an issue name in the overview
2. The details panel opens on the right side
3. Select the "Details" tab for editable fields

Editable information

Once created, an issue's description, type, priority, due date, and period can all still be changed.

Adjusting basic data:

• Description - Detailed background and context
• Type - Change category if incorrectly assigned
• Priority - Adjust urgency based on new insights
• Due Date - Set deadline for solution
• Period - Time period in which issue is relevant

Automatic updates:

• Changes are saved immediately
• Feed tab shows historical changes
• Notifications to involved persons

Owners and responsibilities

An issue has one owner who is accountable for resolving it, plus contributors who do parts of the work.

Assigning owners

The owner is the person accountable for resolving the issue.

Primary ownership:

1. Click in "Owners" section on the right side
2. Type username and select from dropdown
3. Multiple owners possible for shared responsibility

Owner responsibilities:

• Prioritisation of issue resolution
• Resource allocation for execution
• Progress monitoring and escalation
• Final approval of issue closure

Adding contributors

Contributors are the people who actually implement the fix and get notified automatically.

Involving executors:

1. Click "Add contributor(s)" link
2. Select team members working on solution
3. Contributors receive automatic notifications

Contributor roles:

• Technical implementation of solutions
• Evidence collection and documentation
• Testing and validation of fixes
• Progress updates via comments

Deadlines and planning

The due date drives the overdue reporting on issues, and the optional period groups them into a reporting window.

Setting Due Date

The due date is what makes an issue overdue, so base it on how urgent the underlying type genuinely is.

Determining deadline:

1. Click "Due Date" field in Details tab
2. Select realistic date from calendar
3. Consider complexity and available resources

Deadline guidelines per type:

• Incidents: 1-7 days (depending on severity)
• Audit findings: Before next audit (usually 3-12 months)
• Control gaps: 30-90 days (depending on implementation)
• Action plans: Project timeline (weeks to months)
• Opportunities: Flexible (months to year)

Period management (optional)

The period groups an issue into a reporting window, useful for anything that spans more than one year.

Setting time period:

• Year 2025 - Default for ongoing issues
• Custom periods - For multi-year projects

Issue lifecycle management

An issue stays Open until it is genuinely resolved, and its links determine what it counts against.

Status monitoring

An issue stays Open while it's genuinely unresolved, and moves to Closed only once the work is actually done.

Keep Open status when:

• Active work is ongoing
• Waiting for external dependencies
• In review or test phase
• Not yet fully resolved

Move to Closed status when:

• Problem completely resolved
• Measures implemented and tested
• Evidence collected and approved
• Owner has validated closure

Managing issue links

Linking an issue to the assets and controls it affects is what rolls it into their status.

Linking assets:

• Which business assets are involved in this issue?
• Document impact on critical systems
• Determine recovery priorities

Linking controls:

• Which controls are related?
• New controls being implemented
• Existing controls being modified

Bulk operations

Selecting several issues at once lets you apply the same owner, priority, or status change to all of them.

Managing multiple issues simultaneously

Selecting several issues at once lets you reassign or delete them in a single action.

Available bulk operations:

• Change assignee - Assign new owner to group of issues
• Delete - Remove multiple issues from system at once

Bulk workflow:

1. Select issues with checkboxes on left in overview
2. Relevant buttons appear at top of table
3. Choose desired action and confirm

Not possible for bulk:

• Edit issue descriptions
• Set due dates individually
• Complex relationship management
• Closing
• Adjust Type or Priority

Issue templates and standardisation

Issues written to a consistent shape are easier to triage and hold up better in an audit.

Consistent issue creation

A template per issue type keeps the level of detail consistent across similar findings.

Template examples per type:

Incident template:

Name: [Incident type] - [Affected system/person]
Description:
- What happened: [Brief description]
- When discovered: [Time]
- Immediate actions: [First response]
- Impact: [Affected systems/users]
- Root cause analysis: [To be investigated]

Audit finding template:

Name: [Auditor finding] - [Affected control/process]  
Description:
- Audit details: [Internal/external auditor, date]
- Finding: [Specific non-conformity]
- Required action: [What needs to be resolved]
- Audit reference: [Finding number/section]

Quality control

Before assigning an issue, check it against this list.

Review checklist:

• ☐ Issue name is specific and actionable
• ☐ Correct type selected for category
• ☐ Priority fits urgency and impact
• ☐ Owner has capacity and expertise
• ☐ Deadline is realistic and justified
• ☐ Description contains sufficient context

Best practices for issue management

Issues work best when they are found deliberately rather than incidentally, communicated as they change, and measured over time.

Proactive issue monitoring

Issues surface fastest when you actively look for them, not only when someone reports a problem.

Regular sources:

• Monthly system reviews - Monitoring alerts and logs
• Quarterly assessments - Control effectiveness evaluations
• Annual audits - Formal compliance reviews
• Incident analysis - Lessons learned sessions

Effective communication

How often you update stakeholders should scale with the issue's priority.

Issue updates protocol:

• Weekly progress - Brief status update for high priority
• Monthly summary - Overview for medium priority
• Milestone reporting - For significant progress
• Escalation triggers - When deadline is threatened

Continuous improvement

Tracking resolution time and recurrence over time is what turns individual issues into process fixes.

Track metrics:

• Time to resolution - Average resolution time per type
• Recurrence rate - How often similar issues return
• Owner effectiveness - Which assignees resolve fastest
• Root cause patterns - Identify structural problems

Next steps

Now that you can create and manage issues:

• Systematically register all non-conformities you encounter
• Monitor deadlines and progress via dashboard
• Collaborate on solutions via comments and evidence
• Analyse trends for preventive improvements