Compliance Incident Intake and Triage Guide

Definitions

Practical workflow

1. Publish safe and accessible intake channels

   Offer at least one structured channel and one fallback channel that people can use without needing to know the correct legal or compliance label. Common options include a protected web form, monitored mailbox, telephone or speak-up line, manager or compliance officer, security desk, privacy contact, and an in-person route. State availability, language and accessibility support, emergency alternatives, what information helps, and how the organization protects the report. Keep channel ownership, monitoring, testing, and backup contacts current.

2. Protect the reporter and immediate participants

   Ask whether the reporter wants identity protection, restricted follow-up, a safe contact method, an interpreter, accessibility support, or a representative. Capture only what is needed, limit identity access, avoid promising absolute anonymity or a particular outcome, and explain that information may be shared on a need-to-know basis under approved policy. Record retaliation or interference concerns as triage facts and route them to the designated owner without requiring the reporter to confront the subject.

3. Open the standard incident record

   Create a stable incident ID and record received timestamp, channel, intake owner, reporter identity or protected-contact status, reporter preference, factual summary, event and detection times, source reliability or confidence, affected people and systems, entity, product, location, jurisdiction, duplicate candidates, immediate actions, preservation status, severity, decision owner, assignment, conflicts, confidentiality class, next review, status, and linked evidence. Use explicit values such as unknown, not applicable, pending review, and disputed rather than filling gaps with assumptions.

4. Capture the minimum facts without interrogating the reporter

   Ask what happened or was observed, when and where, how it was detected, who or what may be affected, which policy or control appears relevant, what evidence exists, whether the event is continuing, what action has already occurred, and how the reporter can be contacted safely. Separate firsthand facts, documents, system signals, hearsay, assumptions, and conclusions. Accept an incomplete report, document missing facts, and avoid requiring the reporter to prove a legal violation before intake.

5. Take immediate safety and security actions

   If there is an active threat to people, systems, data, evidence, or business continuity, route emergency safety assistance and approved security or continuity actions immediately. Examples include protecting a person from imminent harm, suspending a compromised account, isolating a device or integration, preserving volatile logs, stopping an unsafe transaction, restricting access, or engaging the security response lead. Record who authorized the action, what changed, what was not changed, and the risk of over-containment. Do not destroy, alter, or investigate evidence casually.

6. Search for duplicates and connected records

   Search by event time, entities, products, systems, people, indicators, policy, control, location, reporter channel, and distinctive facts. Link probable duplicates, related allegations, prior incidents, investigations, audit findings, remediation plans, vendor records, and security or privacy cases without merging records prematurely. Identify the primary record, preserve each reporter’s protected handling, record the duplicate confidence and rationale, and keep separate facts or conflicts visible.

7. Declare entity, product, jurisdiction, and time scope

   List the legal entities, business units, subsidiaries, clients, vendors, products, services, systems, locations, data types, people, and time period in scope or potentially in scope. Record unknown and disputed scope separately, identify cross-border or multi-entity connections, and name the owner for each scope decision. Do not assume that the reporting entity, product label, employee location, data location, contract party, or customer location determines every applicable rule.

8. Apply organization-designed severity criteria

   Assess potential harm, control failure, affected population, sensitive or restricted information, ongoing activity, operational disruption, repeat pattern, uncertainty, cross-entity spread, evidence risk, and decision urgency. Use qualitative Critical, High, Medium, and Low bands with documented anchors and confidence. A high severity indicates a need for attention and governance; it does not establish that a breach, violation, misconduct finding, or external reporting duty exists.

9. Preserve relevant records and system evidence

   Identify the records, logs, messages, files, access history, tickets, devices, images, configurations, transaction data, vendor records, and communications that may clarify the event. Assign a preservation owner, record the evidence source and time, protect chain of custody where applicable, and coordinate any hold or retention action through the authorized records, legal, privacy, security, or compliance process. Preserve the reporter’s original submission and material changes to the incident record. Do not label routine retention, a hold, or a preservation decision as a legal conclusion without qualified review.

10. Separate notification assessment from notification action

    Record whether notification or disclosure questions may arise, which entities, jurisdictions, contracts, policies, clients, insurers, regulators, law-enforcement interfaces, or other stakeholders may be relevant, and who owns the assessment. Route the issue to qualified legal, privacy, security, compliance, or business reviewers under the applicable facts. The intake team should not promise, refuse, or schedule external notice based on a generic rule, universal deadline, or unreviewed threshold. Preserve the decision, rationale, inputs, approver, communications owner, and review date.

11. Assign the incident and check conflicts

    Select an investigator, case owner, or response team based on subject matter, independence, language, jurisdiction, product, technical need, and workload. Before assignment or disclosure, check for personal, reporting-line, business, client, vendor, investigative, legal, or other conflicts. Record the check, recusals, alternate owner, access boundary, and approval. A person who is implicated, has a material interest, or cannot protect the reporter should not control the related decision without an approved independent arrangement.

12. Apply need-to-know confidentiality controls

    Classify the incident record and restrict access to the smallest approved group that needs the information for safety, triage, investigation, remediation, governance, or a qualified notification assessment. Separate reporter identity, sensitive evidence, legal advice, security indicators, personal information, and business communications when the process requires it. Use secure channels, controlled exports, audit logs, approved naming, and clear handling instructions. Do not treat a confidentiality label as a substitute for access control or a guarantee of privilege.

13. Prepare a structured handoff

    Give the receiving owner the incident ID, factual summary, known and unknown facts, source confidence, scope, severity and rationale, reporter-protection needs, immediate actions, duplicate links, preservation status, evidence index, conflicts, confidentiality class, decision questions, assigned roles, open risks, next review, and requested outcome. Confirm acceptance, communication route, access permissions, and a fallback owner. Keep the handoff auditable and avoid copying sensitive material into broad channels when a linked restricted record is sufficient.

14. Re-triage when facts or risk change

    Trigger re-triage when new evidence changes the facts, a duplicate reveals a broader pattern, containment fails, the affected population grows, a new entity or jurisdiction is identified, a reporter-protection issue appears, preservation becomes necessary, a conflict is discovered, or a qualified reviewer changes the decision question. Record the prior severity, new severity, changed facts, decision owner, reason, timestamp, and resulting assignment or escalation. Never silently overwrite the original triage rationale.

15. Close the intake stage and retain lessons

    Close intake only when the record has an accountable owner, declared scope, severity rationale, reporter-protection handling, preservation decision, conflict result, confidentiality controls, linked evidence, next action, and qualified review path for unresolved questions. Closure of intake is not closure of the investigation or a finding of no violation. Track recurring channels, missing facts, duplicate rates, re-triage causes, control failures, and reporter experience to improve forms, training, playbooks, and ownership.

Comparison

Limitations and exceptions

• This guide is an organization-designed intake and triage method, not a universal reporting rule, legal opinion, regulatory filing instruction, investigation finding, or guarantee that all incidents will be identified or resolved correctly.
• It does not decide whether conduct violates law, policy, contract, professional duties, client instructions, or a regulator’s requirements. Qualified legal, privacy, security, compliance, and business reviewers must assess the facts and applicable authority.
• A safe channel and protected handling process reduce reporting friction but cannot guarantee anonymity, prevent all retaliation, establish privilege, or remove every risk created by the reporter’s device, network, manager, subject, or external communication route.
• Severity bands are prioritization aids. They can be wrong when facts are incomplete, evidence is altered, impact is delayed, scope is unknown, or a connected incident is not yet found. Preserve confidence, assumptions, and re-triage history.
• Preservation requirements differ by record type, system, jurisdiction, contract, policy, and fact pattern. Coordinate holds, retention changes, forensic collection, and evidence access with the authorized professionals and owners rather than applying a generic rule.
• Notification and escalation decisions depend on the affected entity, data, product, contract, location, jurisdiction, timing, authority, and confirmed facts. This guide intentionally avoids universal reporting deadlines and does not replace a current fact-specific review.

Primary sources

Methodology

Use a versioned incident-intake record with these standard fields: incident ID; received timestamp; intake channel; intake owner; reporter identity, protected-contact status, safe-contact preference, and retaliation concern; event date or range; detection date; location; factual summary; firsthand or secondhand source; evidence references; confidence; affected people; legal entities; business units; clients or vendors; products and services; systems and data types; locations and jurisdictions; policy or control references; duplicate and related-record links; ongoing-event indicator; immediate safety or security actions; preservation owner and status; severity, severity rationale, impact dimensions, and confidence; decision owner; notification-assessment status; escalation path; investigator or response team; conflict check and recusal; confidentiality class; access group; handoff acceptance; next review; status; remediation; and closure authority. Use controlled vocabularies for channel, source type, status, severity, impact type, scope state, duplicate confidence, preservation state, conflict result, confidentiality class, and action owner, while preserving a free-text factual narrative and evidence citations. Treat unknown, not applicable, disputed, and pending review as different values. A practical organization-designed severity model can use Critical for an active or credible risk to people, materially restricted information, evidence integrity, essential operations, or multiple entities; High for probable material impact, significant control failure, repeated or cross-product exposure, or unresolved scope that requires coordinated response; Medium for a contained concern with limited declared scope, moderate control impact, or meaningful uncertainty; and Low for an isolated, low-impact concern with sufficient facts, a named owner, and no current indicator of material harm. Calibrate the bands locally with examples, approval authority, and re-triage triggers; they are prioritization thresholds, not legal classifications. Define organization-designed operating targets for acknowledgement, fact completion, preservation review, handoff acceptance, and re-triage, and label them as internal service targets rather than reporting deadlines. Measure channel availability, report completeness, time to safe containment action, duplicate-link rate, unresolved-scope rate, preservation-decision coverage, conflict-check coverage, handoff acceptance, re-triage frequency, age by severity, and closure-quality findings. For each metric, name the population, event timestamps, denominator, exclusions, source, owner, and review use. Review the model after material incidents, repeated reporter-protection concerns, new systems or products, entity changes, control changes, jurisdiction changes, or qualified reviewer feedback. Notification, escalation, preservation, and legal determinations remain fact-specific decisions for the authorized reviewers.

FAQs

Related CaseDocker capabilities

Related guides and resources

• Compliance management
• Notice management
• Regulatory obligation register design guide
• Compliance case management workflow