---
title: "Pro Tip:  Core Workflow Act Process"
url: "https://help.decipherrisk.com/en/article/pro-tip-core-workflow-act-process"
language: "en"
last_updated: "2025-10-20T12:16:30.083Z"
---

# Pro Tip:  Core Workflow Act Process

## **Introduction**

This DecipherRisk™️ Pro Tip article provides expert guidance, with examples, on how to take action (Act) on risk issues in the system. 

**DecipherRisk™️ Core Workflow**

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcGwLGNljD1FcDF4Q10ybUHiiPnh2-wQgIH8Ntdi-gAVB9AqpIwjw36zQc3gl4Ir-BoxE9DpapuNSwdP2sjgSmDphLissO1d4VqkLWjlaE0gZ1GlJzEwcnIojks3mAokcn8X66fnE4-YvNgznPJWlNUiEs?key=itNWFJkPuDonqvwNGBw2pQ)

## **ACT Process** 

The primary purpose of the [ACT Process](https://help.decipherrisk.com/en/article/core-modules-and-workflow-user-guide), is to decide on what action to take based on the issue Priority assigned.   
The Priority Level determines if the issue

-   needs immediate action (e.g., risk analysis or development of an action plan)
-   will be deferred to a future date or
-   will not have a material negative impact and can be closed.

**ACT Process Tasks**

The ACT process involves one or more of the following tasks:

**Establish Resolution Criteria** - The conditions that must be met to consider the issue resolved (i.e., closed). All high and critical priority Issues should have defined Resolution Criteria.  
**Develop Action Plan(s) with Tasks** - Action Plans are the work that needs to be done to address the Issue.  Tasks are the activities needed to complete the work.  
**Conduct Risk Analysis** - Additional analysis of an Issue may be necessary to estimate the risk associated with an Issue.  
**Defer Issues** - When the organization has Critical or High Issues, less pressing Issues (i.e., Low and Medium priority) can be deferred to a future date.  
**Review Deferred Issues (as necessary)** - A deferred Issue should be reviewed at the NEXT REVIEW date to verify the issue conditions/assumptions used to set the Priority (impact and urgency) have not changed. 

**Pro Tip:** When conducting an Issue Review, document the following: 1) who conducted the review, 2) the review date, and 3) the outcome/conclusion from the review in the Issue NOTES field.

### **Example: Action Plan record** 

* * *

**Title:** InfoSec Policy Update

**Estimated Effort:** 8 hours

**Description:** 

Resolution Criteria

1.  Update Policy
2.  Policy reviewed by CISO or appointee.
3.  Policy changes approved by InfoSec steering committee
4.  Employees are notified about policy changes and acknowledge reading.

**Resources:** 

| Responsible | Jim Smith, Sr. Security Analyst |
| --- | --- |
| Accountable | Jane Stewart, CISO |
| Supporting | Jack Johnson, HR Specialist |
| Consulted | IT Security Steering Committee |
| Informed | John Seymour, CIO |

**Notes:** 

**Owner:**  Jack Moss

**Priority:**  Medium

**Start Date:**  9/26/2023

**Due Date:**  10/21/2023

**Review Date:**  10/10/2023