Issue Management Life cycle Clarification

[Maros Takac1]

Hello,

Can anyone please explain in detail each and every state of the Issue life-cycle? I am really struggling to find a piece of  documentation that would thoroughly walk-through every issue state ( New, Analyze, Response etc.. ) in order to describe what one is expected to do for every stage. Furthermore, when it comes to providing a response, is that used to indicate my intent to accept/remediate an issue or is it actually a confirmation that some action has been taken to remediate ? More importantly, who is/should be responsible for performing review ? There is no option to select/define a specific reviewer.. Going one step further with this, what exactly would be the subject of this review ? My intended remediation plan or my completed remediation ??

Any help with this would be very much appreciated.

[Jan Spurlin]

The process flow with issues is very fluid. ServiceNow has done that intentionally.

There is not a single issue management process that is followed by a majority of customers. Many organizations have very specific processes they follow to resolve an issue - everything from how to research the alternatives to how to approve an issue acceptance.  The idea is that the customer will customize the process flow to meet their organization's requirements.

All of your other questions depend on how the customer wants it done - then you can decide what rules you want to add to enforce that process (if any).

Jan

[SanjivMeher · Accepted solution]

It mainly depends on your organization. But i would try to give a basic definition of each step

New: Default state of issue. So as soon as issue is created, it will be in New state and assigned to the control owner.

Analyze: In this state, the owner needs to analyze the issue and identify the root cause.

Respond: In this state, owner decides if he/she can remediate the issue or needs to accept the issue and create an exception. If owner select response as Remediate, the owner/his team responds/fixes the issue in this state and move it to review. If they select response as Accept, we provide user to create an exception. And until the exception is closed, we keep the issue in respond state. Once closed, owner should remediate the issue.

Review: In this state, as per my understanding, the compliance/Risk/Audit Manager reviews the response from the owner and decides if issue is fixed.

Closed: Compliance/Audit/Risk manager closes the issue, if he/she thinks issue has been resolved.