Investigate an Incident

The Incident Owner is responsible for opening investigations and assigning investigators. An incident under investigation in the My Tasks page.

To document an investigation on an incident: 

  1. Go to the My Tasks page. 

  2. Click an incident in the Under Investigation state to open the Incident Review form. Viewing an incident under investigation.
  3. Complete the following fields in the Incident General Details section as needed: 
    • Incident Start DateTime and Incident End DateTime: When the incident began and when it ended. 
    • Incident Flags: High-risk and important incident details, with a related symbol for easy reference. 
    • Description: Details of the investigation or incident.
  4. Complete the Investigation Start Date and Investigation Close Date, as needed.
  5. Complete the fields in the remaining Logs, Interviews, Evidence, Links, Outcomes & Root Cause, Attachments, and Incident Properties tabs. Note that your user group may not be permitted to complete all fields. 
  6. Click one of following buttons:
    • Return: Returns the incident back to the incident owner in the Open state.
    • Complete Investigation: Closes the incident because no further action is required. The incident can be viewed and reopened by the Incident Owner and the Incident Supervisor. See View and Reopen a Closed Incident for more information.