This lesson covers closing out an investigation and walking the incident through to resolved. By the end you'll know how to write findings, complete the investigation with an outcome, and see the incident move all the way to Closed.
What you'll cover:
The incident lifecycle. A reminder of the six steps (Reported, Triage, Investigation, Response, Resolved, Closed) and how resolution is the back half: findings come together, the investigation completes, then the incident moves through Response, Resolved, and finally Closed.
The Findings tab. Where the investigator writes up, across Findings Summary, Root Cause Analysis, Contributing Factors, Systemic Issues, and Policy Breaches, all filled in before completing the investigation.
Completing the investigation. The Complete Investigation dialog and its four outcomes: Substantiated, Unsubstantiated, Inconclusive, and Withdrawn.
Rationale and recommendations. The Outcome Rationale tied to the evidence, and Recommendations setting out concrete actions that seed the Response stage.
Response and Resolved. How completing the investigation pushes the incident into Response (actioning recommendations), then Resolved when the work is done, then Closed as the locked, archived record.
Key takeaways:
Fill in the Findings tab before completing the investigation, since the outcome dialog references it.
Pick the outcome that matches the evidence, not the one that's easiest, and tie the rationale to specific evidence so it holds up later.
Recommendations aren't just a write-up. They seed the Response stage, where controls go on the register and tasks get assigned, before the incident reaches Resolved and then the locked, immutable Closed state.
IN THIS COURSE
3
.
O13. Incident reporting and triage
3
min
1
.
O14. Shareable reporting links, QR codes, and multi-channel deployment
1
min
4
.
O15. Incident handler groups, SLAs, and escalation rules
4
min
4
.
O16. Opening and managing investigations
4
min
4
.
O17. Collecting statements, managing people involved, and the investigation record
4
min
2
.
O18. Incident resolution
2
min
3
.
O19. Notifiable incidents and regulatory deadlines
3
min
3
.
O20. Worker self-service incident reporting and the portal experience
3
min
