General Issues Management FAQ

Issues Management is available for customers who are licensed to the following products: IT & Security Risk Management, Enterprise Policy Management, Compliance Automation, and Third-Party Risk Management.  Privacy customers who also have the products listed above will have visibility to issues created on shared inventories and can create issues from those inventories. 

The following roles will have access to issues:

• Compliance Manager

• Enterprise Policy Manager

• ERM Manager

• IT Risk Manager

• Policy Owners

• Project Owners

• Site Admins

• Tech Risk & Compliance Admin

• Vendor Manager

The Issue register appears in the side navigation for all users.

However, the issue data shown in the list view depends on access. You can view issue data if you have permission to view issues, or if you are assigned to the issue as the Owner, Approver, or Stage Approver.

An issue is a deviation, deficiency, or event that introduces risk to systems, data, operations, or compliance—often requiring documentation, remediation, and potential escalation. Example: A system did not meet requirements for a minimum password character count.

Risks are potential events with material impact on an organization in achieving its objectives. Example: loss of personal data.

An issue is an instance when there has not been appropriate action to mitigate risk to an acceptable level. This event has materialized a risk into existence or increases the likelihood of the risk occurring.

An incident is an unplanned event that disrupts operations or poses a threat to security and requires immediate action.  The nature of issues is often more proactive or preventative. While issues can affect the performance or compliance of IT systems, they may not require immediate action and can be monitored and addressed over time. Example: A data breach or system outage.

Issues represent problems that need resolution, while exceptions are formally reviewed and accepted deviations from policies and controls. Issues generally require corrective actions while exceptions involve documented justification for non-compliance.  Example: A system does not meet the requirements to have a minimum password character count, but an exception was granted because it's a legacy system.

Third-Party Risk Management Use Cases

Vendor Assessments

: Documenting and tracking findings from due diligence, security questionnaires, or periodic risk assessments.

Data Breach or Security Incident Involving a Vendor

: Responding to incidents where a vendor mishandles or leaks sensitive data.

SLA or Performance Breaches

: Monitoring and managing contractual non-compliance.

Regulatory or Legal Non-Compliance

: Identifying risks when a vendor is found non-compliant with regulatory obligations.

IT & Security Risk Management Use Cases:

• Control Self-Assessments: Configure assessment rules to flag issues based on responses and flag issues while reviewing assessments.

  • Internal Control Failures: Keep track of issues identified in internal or external audits and assessments

• Inventory Assessments

  • Technology Updates: Manage issues related to outdated software or hardware that may pose compliance risks, prioritizing updates based on risk assessments.

• Risk Assessments

  • Logging issues as part of a risk assessment to identify gaps and actions needed to mitigate the risk, from an assessment or the risk record directly.

• Use issues as part of an intake and triage process to identify risks.

Compliance Automation Use Cases:

• Regulatory Compliance Audits: Track issues against evidence tasks and controls when additional follow-ups are needed to achieve or maintain compliance as part of an internal readiness exercise or external audit.

Enterprise Policy Management Use Cases:

• Policy Violations: recording and addressing violations of internal policies, procedures, and standards.

• Training and Awareness Gaps: Track issues related to employee training on compliance policies.

Assessment templates remain unchanged, but you can create new templates to create issues instead of risks where appropriate.

Issues Creation

Create issues individually from the issues register, directly on an object, in bulk via import templates, automatically via assessment rules, or while reviewing an assessment.

Issues Remediation

Streamline and document the process of remediation review and approval with workflows. Dynamically change workflows based on issue attributes. Create tasks to track and assign remediation work.

Issues Relationships

Relate a single issue to multiple OneTrust inventories and objects to map impact. Available objects include:

• Assets

• Control Implementations

• Entities

• Evidence Tasks

• Policies

• Procedures

• Processing Activities

• Risks

• Standards

• Vendors

• Engagements

• Exceptions

Issue Reporting

Dashboards

• Gain insights into issues trends that need your attention.

• Automate issues status reporting.

Column Reports

• Automate issues status reporting.

Issues Impact on Risks

• Track the quantitative impact of issues on risks by including issue attributes in risk formulas.

• Get notified when an issue closes on a risk or control so you can manually adjust the risk score as needed.

For more information, see the Issues Management knowledge base.

Yes. You can use the Create Issues import template to bulk import new issues and the Update Issues import template to bulk update issues.

For more information, see Managing Issues in Bulk.

You can utilize the bulk import templates to add your historical issues into OneTrust.