The first step in reviewing a message is the triage process.
Triage is the process of prioritizing messages, depending on the complexity of the situation and the risk assessment for the company.
Triage is a decision-making system that provides a framework for business decision making, outcome goal prioritization, and resource allocation in many business environments. Business processes are categorized as essential/critical (red) important/urgent (yellow), or optional/supportive (green). (Wikipedia)
By analogy, for example, it is not appropriate for a company to take on reports where there is insufficient information and additional searches can take a lot of resources, thus diverting the response team from other current issues, or incidents that may or may have occurred.
A company representative (security or internal control) reviews the report in the system and organizes the initial response, assigns a team and investigation script, or asks additional questions of the informant (whistleblower).
When reviewing, review the report, make sure there is enough information for further steps, categorize and prioritize the report, and give it to the case team, led by the responsible case manager.
Assess whether the information in the informant's questionnaire is sufficient to understand what happened?
Ask the necessary questions of the informant.
Match the facts that the informant has given to the available information about the people, the processes, the place, to the question - could this have happened?
Prioritizing involves setting a response deadline based on the value chosen.
.
Reading the informant's report
Navigate to a case by clicking on it (full line anywhere) in the Case Table.
Find and click on the side menu - Messages.
Sending a message to an informant
Move to the Reporter's Feedback feed. Enter your message in the yellow text box. When finished, click the "Comment" button.
Pausing investigation due to lack of information
If there is insufficient information in the message to perform the following steps, the message should be suspended by changing its status to "Need details".
To do this press the "Ask for details" button.
Before doing so, however, it is necessary to write detailed questions to the informant, the answers to which would allow the case to move forward.
The recommended text of the message is as follows:
"We thank you for your message and, unfortunately, we are unable to continue our investigation and response without receiving additional clarifying information from you. Thus, the investigation of the issue is paused and the status of the message has been changed until we receive additional information.
We ask you to answer the question: (text of the question).
Thank you in advance, because our experience shows that the number of successfully considered cases due to the received additions is in several times higher than those where were a lack of information. "
Immediately after this, the informant will receive a notification with an invitation to go to the Feedback Center to read your questions and anonymously answer them.
Reopening of the case after receiving the proper information.
In the case when additional information from the informant appears, it is enough to take further steps.
Technical possibility of recovery is always available, regardless of information receipt.
The case manager, analyst and coordinator have the right to reopen, by default.
Turning to "Need details" and reopening can be done an unlimited number of times within the specified response time.
After restoring, the case gets the "Reopened" status. This is a temporary and intermediate status.
To restore the message, open the "Report" page of the case and click the "Reopen" button.
Warning. Simply "Reopen" is not enough. The responsible person must assign the appropriate status for the case to move forward:
Ignore - status "Closed without actions";
Ask for details - "Need details";
Submit for first closing - "Waiting first closing";
Remedy - "On remediation"
Investigate - "Open / Under review"
