Incident Workflow

Status Overview

Every incident in Steward has a status that indicates where it is in the review process. Statuses flow in a logical sequence, though some transitions are possible in both directions.

Status Definitions

Draft

The incident is being written but hasn't been submitted yet. Only the reporter can see draft incidents. Drafts can be freely edited or deleted.

Who can see: Only the reporter

Next step: Reporter submits the incident

Submitted

The incident has been submitted and is waiting for a reviewer to pick it up. The original report is now locked—no edits to the initial submission are possible.

Who can see: Reporter (their own), Reviewers and above

Next step: Reviewer begins review or assigns to someone

Under Review

A reviewer is actively working on this incident. They may be investigating, gathering information, or coordinating a response.

Who can see: Reporter (their own), Reviewers and above

Actions available:

• Request additional information from the reporter (transitions to Awaiting Response)
• Add internal comments (not visible to reporter)
• Add amendments to correct or clarify details
• Escalate to Escalated status
• Close the incident if resolved

Awaiting Response

The reviewer has requested additional information from the reporter. The incident is blocked until the reporter responds. This status is automatically set when a reviewer sends an information request, and automatically returns to the previous status when the reporter responds.

Who can see: Reporter (their own), Reviewers and above

Triggered by: Reviewer sends an information request

Next step: Reporter provides the requested information, incident returns to Under Review or Escalated

Note: Multiple information requests can be sent. The incident stays in Awaiting Response until the reporter responds.

Escalated

The incident requires escalation or additional action beyond standard review. This might indicate:

• Leadership involvement required
• External reporting needed (insurance, legal, authorities)
• Follow-up actions pending
• Waiting on external information

Who can see: Reporter (their own), Reviewers and above

Next step: Complete required actions, then close

Closed

The incident has been resolved. When closing an incident, the reviewer must provide a resolution outcome — selecting an outcome type (Resolved, Referred, No Action Required, Inconclusive, or Ongoing Monitoring) and writing a resolution summary describing how the incident was addressed.

Who can see: Reporter (their own), Reviewers and above

Resolution info displayed: Outcome type badge, resolution summary, and who closed the incident

Note: Closed incidents can be reopened if new information emerges

Locked

The incident is permanently archived. No further changes are possible except by the Owner (with a required reason). Locking is typically done when:

• The retention period has passed and the record needs preservation
• Legal proceedings have concluded
• The incident has been exported for official records

Who can lock: Privileged Reviewers, Administrators, Owners

Who can unlock: Only Owners (with reason required)

Working with Incidents

Assigning a Reviewer

Incidents can be assigned to a specific reviewer. Only Reviewers and above can assign a reviewer to an incident. This helps distribute workload and ensures accountability. To assign an incident:

1. Open the incident detail view
2. Find the Reviewer field in the sidebar
3. Select a team member from the dropdown

The assigned reviewer will receive a notification about their new assignment.

Setting Due Dates

You can set a due date to track when an incident should be resolved. Due dates appear in the sidebar and overdue incidents are highlighted in the list view.

Requesting Information

If a reviewer needs more details from the reporter, they can send an information request. The reporter will be notified and can respond with additional information.

Adding Amendments

Since the original incident cannot be edited, reviewers use amendments to correct or clarify details. Amendments:

• Require a reason explaining what changed and why
• Are always included in legal/insurance exports
• Preserve the audit trail while allowing factual corrections

Internal Comments

Reviewers can add internal comments that are only visible to other reviewers. Use these for:

• Investigation notes
• Coordination between team members
• Recording decisions and rationale

Internal comments are never shown to reporters but are included in exports.

Legal Hold

When an incident may be involved in legal proceedings, a Privileged Reviewer can apply a legal hold. This:

• Prevents the incident from being deleted by retention policies
• Marks the incident with a visible legal hold indicator
• Requires a reason when applied or removed

Legal holds should be used when instructed by legal counsel or when litigation is anticipated.

Managing Attachments

The Attachments tab supports both list and gallery views for managing incident files. You can toggle between views and sort attachments by name, size, or date.

Attachment removal follows a controlled workflow:

• Draft incidents: The uploader can delete their own attachments directly
• After submission: Non-admin users must request removal, which goes to an admin review queue
• Administrators: Can directly remove attachments (with a required reason)
• Legal hold or locked incidents: Attachments cannot be removed

Removed attachments appear as grayed-out tombstone rows on the incident, preserving the record that a file was once attached.

Audit Trail

Every action on an incident is recorded in the audit trail:

• Status changes
• Reviewer assignments
• Comments and amendments
• Attachments added and removed
• Attachment removal requests, approvals, and rejections
• Exports generated
• Legal hold changes
• Lock/unlock actions

The audit trail is append-only—nothing can be removed. This provides a complete history for legal and insurance purposes.

Notifications

Steward keeps everyone informed with automatic notifications:

• Reporters are notified of status changes and information requests on their incidents
• Assigned reviewers are notified of new assignments
• Reviewers are notified of new incidents in their areas

Learn more about notifications →