---
title: "How to Create an Issue and Complete the Intake Process"
url: "https://help.decipherrisk.com/en/article/how-to-create-an-issue-and-complete-the-intake-process"
language: "en"
last_updated: "2025-07-22T14:56:54.219Z"
---

# How to Create an Issue and Complete the Intake Process

### **Summary**

This article explains how to create a new **Issue** and complete the **Intake process**. Intake is the initial step in documenting risk Issues so they can be prioritized, triaged, and addressed for risk and compliance purposes. This guide outlines the required and optional fields, and includes a sample completed Issue.

### **What is the Intake Process?**

The **Intake process** is used to enter individual risk Issues into the **Issue Register**.  Intake is typically used when:

-   An audit or assessment identifies Issues
-   A one-off or ad hoc Issue is discovered during daily operations

### **Steps to Create an Issue**

To create a new Issue and complete the Intake process:

1.  Navigate to the **Issue Register**.
2.  Click **Create New Issue**.
3.  Complete the **required fields** listed below.
4.  Optionally complete the **additional fields** for added context.
5.  Click **Save** to submit the Issue record.

* * *

#### **Required Fields**

These six fields must be completed during Intake:

| **Field** | **Description** |
| --- | --- |
| **Title** | A short, clear name for the Issue |
| **Description** | A detailed explanation of what the Issue is and why it matters |
| **Reported By** | The individual, group, or organization that reported the Issue |
| **Reported On** | The date the Issue was reported (MM/DD/YYYY format) |
| **Source** | The origin of the Issue (e.g., "2022 HIPAA Risk Assessment", "Phishing Test") |
| **Owner** | The person currently responsible for triaging or resolving the Issue\* |

\*Note: The Owner is typically the person responsible for shepherding the Issue through triage. This may change later in the process.

* * *

#### **Optional Fields**

These fields are not required, but can provide additional clarity:

| **Field** | **Use Case** |
| --- | --- |
| **Severity** | Initial severity assessment |
| **Resolution Criteria** | Requirements or recommendations needed to consider the Issue resolved |
| **Notes** | References to standards, regulations, or any other useful information |

### **Example: Issue record at INTAKE process.**

* * *

**Title:** Firewall Critical Vulnerabilities 

**Status:** CREATED

**Reported by:** HealthGuard

**Reported on:** 5/6/22

**Source:** 2022 HIPAA Risk Assessment

**Description:** Internet firewalls have multiple remotely exploitable vulnerabilities.

**Owner:** Jim Jones

**Notes:** 

Subcategory: ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders

**Informative References**

CIS CSC 4 

COBIT 5 APO10.01, APO10.04, APO12.04, APO12.05, APO13.02, BAI01.03, BAI02.03, BAI04.02 

ISA 62443-2-1:2009 4.3.4.2 

ISO/IEC 27001:2013 A.15.1.1, A.15.1.2, A.15.1.3, A.15.2.1, A.15.2.2 

NIST SP 800-53 Rev. 4 SA-9, SA-12, PM-9

* * *

### **Related Articles**

[How to Use the Severity Wizard During Risk Intake](https://help.decipherrisk.com/en/article/how-to-use-the-severity-wizard-during-risk-intake)

[Pro Tip: Core Workflow Intake Process](https://help.decipherrisk.com/en/article/pro-tip-core-workflow-intake-process)