# Creating and managing issues

> Register an issue, choose its type and priority, assign it, set a deadline, and link it to what it affects. Resolving and closing is covered in its own article.

Source: https://tidalcontrol.com/docs/issues/creating-and-managing-issues

This article covers the issue record: registering one, choosing its type and priority, assigning it, setting a deadline, and linking it to what it affects. For resolving and closing issues, see [Handling and closing issues](/docs/issues/handling-and-closing-issues).

## Adding new issues

An issue needs a name, a type, and a priority; the type and priority are what route it and rank it later.

### Creating an issue

1. **Go to the Issues page** via the main menu
2. **Click "Add issue"** in the top right of the overview
3. **The creation form opens** where you can fill in non-conformity information

![Creating new issue](/images/help/issues_add_issue.png)

### Filling in issue information

Only the name is required; type and priority can be set now or corrected later.

**Required fields:**
- **Name** - Choose a clear, descriptive name for the non-conformity
- For example: "Employee forgets laptop on train" or "Backup missed on multiple dates"

**Optional but recommended fields:**
- **Issue type** - Select the correct category from 7 available types
- **Priority** - Set urgency (High, Medium, Low)
- **Assign owner** - Assign responsible person
- **Description** - Detailed context and background information

> **tip:**

**Clear naming**: Use specific, action-oriented names. "MFA not active for administrators" is better than "Login problem".

### Selecting issue type

Choosing the right type helps with workflow, reporting and assignment:

**Generic - For general organisational matters:**
- Policy needs to be created or updated
- Procedures missing for new processes
- Organisational changes require adjustments
- **Example:** "Implement employee screening procedure"

**Audit finding - For formal audit findings:**
- External auditor identifies non-conformities
- Internal audit finds compliance shortcomings
- Certification body sets requirements
- **Example:** "ISO auditor missing management review documentation"

**Control gap - For missing controls:**
- GAP analysis shows required controls that are missing
- New risks require additional measures
- Compliance frameworks introduce new requirements
- **Example:** "Access control admin accounts insufficiently restricted"

**Incident - For actual security incidents:**
- Phishing attacks and malware infections
- Data breaches and unauthorised access
- Physical security breaches
- **Example:** "Phishing attack compromises employee account"

**Action plan - For planned improvement projects:**
- Rollout of new security measures
- Training and awareness programs
- Implementation of new systems
- **Example:** "Q2 rollout security awareness training program"

**Control deficiency - For failing existing controls:**
- Implemented controls not working correctly
- Technical problems with security tools
- Process not effectively executed
- **Example:** "Encryption fails leaving data unencrypted"

**Opportunity for improvement - For optimisation:**
- Efficiency improvements of working processes
- Cost saving opportunities
- User experience improvements
- **Example:** "Speed up onboarding for faster security training"

### Determining priority

Priority routes and ranks the issue, so set it based on urgency and impact rather than the default.

**Assign High Priority for:**
- **Compliance deadlines** within 30 days
- **Critical security risks** that directly threaten
- **Audit findings** that endanger certification
- **Active incidents** with ongoing impact

**Medium Priority for:**
- **Planned improvements** with quarterly deadline
- **Control gaps** without direct threat
- **Action plans** with clear planning
- **Normal audit findings** without urgency

**Low Priority for:**
- **Long-term optimisations** (> 6 months)
- **Nice-to-have improvements** without compliance impact
- **Opportunities** depending on other projects
- **Minor administrative** adjustments

### Saving the issue

1. **Check all entered information**
2. **Click "Create"** to create the issue
3. **The new issue appears** in your overview with "Open" status

## Editing issue details

Open an issue from the overview to change its fields.

### Opening issue details

1. **Click on an issue name** in the overview
2. **The details panel opens** on the right side
3. **Select the "Details" tab** for editable fields

![Editing issue details](/images/help/issues_details.png)

### Editable information

Once created, an issue's description, type, priority, due date, and period can all still be changed.

**Adjusting basic data:**
- **Description** - Detailed background and context
- **Type** - Change category if incorrectly assigned
- **Priority** - Adjust urgency based on new insights
- **Due Date** - Set deadline for solution
- **Period** - Time period in which issue is relevant

**Automatic updates:**
- Changes are saved immediately
- Feed tab shows historical changes
- Notifications to involved persons

## Owners and responsibilities

An issue has one owner who is accountable for resolving it, plus contributors who do parts of the work.

### Assigning owners

The owner is the person accountable for resolving the issue.

**Primary ownership:**
1. **Click in "Owners" section** on the right side
2. **Type username** and select from dropdown
3. **Multiple owners possible** for shared responsibility

**Owner responsibilities:**
- **Prioritisation** of issue resolution
- **Resource allocation** for execution
- **Progress monitoring** and escalation
- **Final approval** of issue closure

### Adding contributors

Contributors are the people who actually implement the fix and get notified automatically.

**Involving executors:**
1. **Click "Add contributor(s)" link**
2. **Select team members** working on solution
3. **Contributors receive** automatic notifications

**Contributor roles:**
- **Technical implementation** of solutions
- **Evidence collection** and documentation
- **Testing and validation** of fixes
- **Progress updates** via comments

> **warning:**

**Clear roles**: Ensure ownership and contributor roles are clear. Too many owners can lead to confusion about final responsibility.

## Deadlines and planning

The due date drives the overdue reporting on issues, and the optional period groups them into a reporting window.

### Setting Due Date

The due date is what makes an issue overdue, so base it on how urgent the underlying type genuinely is.

**Determining deadline:**
1. **Click "Due Date" field** in Details tab
2. **Select realistic date** from calendar
3. **Consider complexity** and available resources

**Deadline guidelines per type:**
- **Incidents:** 1-7 days (depending on severity)
- **Audit findings:** Before next audit (usually 3-12 months)
- **Control gaps:** 30-90 days (depending on implementation)
- **Action plans:** Project timeline (weeks to months)
- **Opportunities:** Flexible (months to year)

### Period management (optional)

The period groups an issue into a reporting window, useful for anything that spans more than one year.

**Setting time period:**
- **Year 2025** - Default for ongoing issues
- **Custom periods** - For multi-year projects

## Issue lifecycle management

An issue stays Open until it is genuinely resolved, and its links determine what it counts against.

### Status monitoring

An issue stays Open while it's genuinely unresolved, and moves to Closed only once the work is actually done.

**Keep Open status when:**
- Active work is ongoing
- Waiting for external dependencies
- In review or test phase
- Not yet fully resolved

**Move to Closed status when:**
- Problem completely resolved
- Measures implemented and tested
- Evidence collected and approved
- Owner has validated closure

### Managing issue links

Linking an issue to the assets and controls it affects is what rolls it into their status.

**Linking assets:**
- Which business assets are involved in this issue?
- Document impact on critical systems
- Determine recovery priorities

**Linking controls:**
- Which controls are related?
- New controls being implemented
- Existing controls being modified

## Bulk operations

Selecting several issues at once lets you apply the same owner, priority, or status change to all of them.

### Managing multiple issues simultaneously

Selecting several issues at once lets you reassign or delete them in a single action.

**Available bulk operations:**
- **Change assignee** - Assign new owner to group of issues
- **Delete** - Remove multiple issues from system at once

**Bulk workflow:**
1. **Select issues** with checkboxes on left in overview
2. **Relevant buttons appear** at top of table
3. **Choose desired action** and confirm

**Not possible for bulk:**
- Edit issue descriptions
- Set due dates individually
- Complex relationship management
- Closing
- Adjust Type or Priority

## Issue templates and standardisation

Issues written to a consistent shape are easier to triage and hold up better in an audit.

### Consistent issue creation

A template per issue type keeps the level of detail consistent across similar findings.

**Template examples per type:**

**Incident template:**
```
Name: [Incident type] - [Affected system/person]
Description:
- What happened: [Brief description]
- When discovered: [Time]
- Immediate actions: [First response]
- Impact: [Affected systems/users]
- Root cause analysis: [To be investigated]
```

**Audit finding template:**
```
Name: [Auditor finding] - [Affected control/process]  
Description:
- Audit details: [Internal/external auditor, date]
- Finding: [Specific non-conformity]
- Required action: [What needs to be resolved]
- Audit reference: [Finding number/section]
```

### Quality control

Before assigning an issue, check it against this list.

**Review checklist:**
- ☐ Issue name is specific and actionable
- ☐ Correct type selected for category
- ☐ Priority fits urgency and impact
- ☐ Owner has capacity and expertise
- ☐ Deadline is realistic and justified
- ☐ Description contains sufficient context

## Best practices for issue management

Issues work best when they are found deliberately rather than incidentally, communicated as they change, and measured over time.

### Proactive issue monitoring

Issues surface fastest when you actively look for them, not only when someone reports a problem.

**Regular sources:**
- **Monthly system reviews** - Monitoring alerts and logs
- **Quarterly assessments** - Control effectiveness evaluations
- **Annual audits** - Formal compliance reviews
- **Incident analysis** - Lessons learned sessions

### Effective communication

How often you update stakeholders should scale with the issue's priority.

**Issue updates protocol:**
- **Weekly progress** - Brief status update for high priority
- **Monthly summary** - Overview for medium priority
- **Milestone reporting** - For significant progress
- **Escalation triggers** - When deadline is threatened

### Continuous improvement

Tracking resolution time and recurrence over time is what turns individual issues into process fixes.

**Track metrics:**
- **Time to resolution** - Average resolution time per type
- **Recurrence rate** - How often similar issues return
- **Owner effectiveness** - Which assignees resolve fastest
- **Root cause patterns** - Identify structural problems

> **tip:**

**Preventive approach**: Use issue patterns to develop proactive measures. If many incidents of the same type occur, consider preventive controls.

## Next steps

Now that you can create and manage issues:
- **Systematically register** all non-conformities you encounter
- **Monitor deadlines** and progress via dashboard
- **Collaborate** on solutions via comments and evidence
- **Analyse trends** for preventive improvements