Tracker 4 Issues

From SymbiantWiki

Issues (or weaknesses) are core to the Tracker system. An issue is entered by an administrator or manager (with appropriate permissions) to record a weakness identified by the internal audit process. The issues currently stored in Tracker are displayed on a grid assessable via the [Issues] menu link.

The grid displays key information relating to the the issue including a brief summary its current rating and status and the date the first action is due by. The issues can be ordered by clicking the relevant column header and viewed/edited/actioned by clicking the row itself.

As more issues are entered into Tracker they will appear across multiple pages, the page viewed can be changed via the arrows at the bottom of the grid and the number of issues displayed per page changed via the drop-down.

To help quickly locate a specific issue or collection of issues the audit report they belong to can be displayed and/or a powerful filtering system can be employed.

To display issues within a certain audit report, click the top row of the grid to expand the audit report selector. Here it is possible to drill down into specific audit reports and display all issues within that report. To select a report click the name, category and reference in question. Initially only the top level audit report names will be displayed, to expand these to show all categories within that report click the [>] next to the name. Similarly to view references within the selected name and category, click the [>] next to the category. To show all the issues again (unless a filter is also specified) click [Show All] at the top.

To filter issues using the powerful filtering system employed by Tracker, click the filter row at the bottom of the grid. Defining a filter requires the column to filter, filter type and value to be selected. This is done via a simple matrix of dropdowns and entry fields. The column is simply the field that would be displayed should it be displayed in the above grid, separated into two parts, the section and the information. The section includes Audit Report, Issue, Recommendation, Action, Action Status etc. The information is the data stored in that section, i.e. under issue you would have Division, Rating, Status etc. The filter type is dependant on the column and can include IS, NOT, IS LIKE, =, >, < etc. Again the value to filter for is dependant on the column and could be selected from a drop-down or entered via a text box. If the entry is via a text box then by selecting either LIKE or NOT LIKE from the filter type a wild card character can be used by including an asterisk (*).

Having completed the filter additional filters can be added by repeating the process in the next row. An important additional element for all additional filters is whether the filter should be included as well as (AND) or instead of (OR). This option is selected before the column is defined. All filters where columns are the same and appear sequentially in the filter list are grouped as a single filter.

To apply the filter click the button. The filter will be retained throughout the Tracker session and automatically reapplied when returning from viewing an issue, else it can be reapplied by re-clicking the search button. To alter the filter the options can either simply be changed or the button clicked to clear the filter.

In addition to filtering the issues the filter matrix includes additional sorting parameters, these sort the associated column in either an Ascending or Descending order, the order the filter is applied in is defined by the preceding drop-down.

Contents 1 Creating issues 1.1 Assigning actions 2 Responding to actions 3 Implementing actions and changing an issues status

Creating issues

To create an issue, go to issues by clicking the [Issues] menu item and add a new issue by clicking the button at the top right of the issues grid. Complete the form ensuring that all fields marked in bold have a value and click the [Save and close] button.

New to Tracker 4, all issues must belong to a division, a dummy division can always be created to include all issues if this is not required.

If documentation has been enabled whilst configuring Tracker, documents can be attached to issues, recommendations and actions by clicking the button. All document information should be completed, the document should be browsed for on the computers local hard drives or network. Only certain types of files can be attached to Tracker, these are defined whilst configuring Tracker, the defaults are: Microsoft Word documents (doc), Microsoft Excel spreadsheets (xls), Adobe Acrobat documents (pdf) and plain text files (txt).

To help internal auditors identify key actions of a recommendation, actions can be marked as key by activating the icon. It is also possible to associate an action with a definable area by specifying what the action relates to in the adjoining drop-down.

Assigning actions will be described in the next section, the actions - action by date is the date by which the action must be implemented. Tracker will automatically send out warnings when this date is nearing to all assigned user accounts (depending on the email configurations in set-up).

A powerful new feature of Tracker 4 is the ability to add multiple recommendations and actions. This is done by clicking the [...] button next to the save and close button and then [Save and add new recommendation] or [Save and add new Action]. There is no limit imposed by Tracker to the number of recommendations or actions that can be associated with an issue, however if too many recommendations and actions are identified it may indicate the need to re-evaluate the resolution to the issue.

When editing an issue it is possible to add further recommendations by clicking the button below the last recommendation or delete a recommendation by clicking the below the recommendation to delete. Similarly to add further actions to a specific recommendation click the at the bottom left of the last action of the recommendation. Again it is possible to remove actions by clicking the next to the action to delete.

It is also possible to add a new issue to the current audit report by clicking the [...] button next to the save and close button and clicking [Save and add new Issue].

Finally an issues behaviour can be customised by editing its options. To do this, click the [Options] button at the bottom right of the issue page.

Options allow the issue to carbon copy certain alerts to defined email addresses. Alternatively alerts can be suppressed completely. To alert users to important details of the issue a notice can be entered that will pop-up whenever the issue is viewed, all users regardless of role will see this alert. Finally to prevent managers from constantly moving the action by date a limit on the number of changes they can make can be entered, by default this is 999 which is realistically pretty much unrestricted (managers require action by date change privileges in order to be able to change them at all). If a manager tries to change the audit report more times than they are allotted they will be notified to contact an administrator of the system.

Assigning actions

One of the many features of Tracker that makes it so useful is the ability to assign actions to users. It puts the onus on the person to whom the action is assigned to report on where they are at with the recommendation, i.e. it introduces ownership for resolving weaknesses and raises the profile of the issues.

Whilst editing an issue click the [...] button next to the assigned to box to select users to assign the recommendation action to. If not already editing an issue, go to the issue by clicking the [Issue] menu link, locate the issue in the issues grid and click it. This will display the issue in response mode, to edit the issue (managers require permission to do this), click the button at the top right of the issue page.

To assign users to the action, the users must have assignable permission defined on their account. All available assignable users are listed in the left column list. To assign a user and make them responsible for completing the steps required to action this part of the recommendation, select them in the list and click the ► button. To remove a user from the assigned list (on the right), select their name and click the ◄ button.

An alternative to assigning the action directly to the auditee to audit is to assign it to a manager who has re-assign privileges or to an administrator. Both administrators and managers require assignable permissions set on their account. This will allow managers to take responsibility for the issue's recommendation action within their division even if the issue isn't defined as part of their division. The manager (or administrator) can then re-assign it to someone in their division to action.

Even if a manager isn't directly assigned an action, if it is assigned to someone within their division they will still be able to re-assign responsibility for it (if they have permission) and review it as required.

Responding to actions

As a manager (or administrator) a key role is reviewing status updates entered by auditees for assigned actions. After a auditee updates the status of an action (or before if wished) managers (and administrators) can post comments that are displayed to users. This allows for a two way (or more if more than one auditee, manager or administrator is involved) conversation whereby users can keep each other posted of what is happening and what is required.

When a response is posted assigned auditees are notified via email (if configured) and the relevant issue is identified on the start page statistics and by coloured highlight in the issues grid.

To respond to an issues recommendation action, go to the issues by clicking the [Issue] menu item. Locate the issue to respond to and click on it. The issue will be displayed in full including all recommendations and actions (in associated divisions for managers where the issue is not part of one of their divisions) and the full conversation history for each action as well as a space to enter further comments. Comments can be added to one or more actions at a time and posted by clicking [OK].

It is also possible to use these response fields to record action status updates should a manager or administrator be directly responsible for an action.

In case a comment needs to be removed, either because an auditee wishes to withdraw it, or a administrator (or manager with permission) believes it to be false or inaccurate. The offending comment can be removed by clicking the in its header. Administrator and managerial comments are removed without trace, comments entered by auditee users are removed but marked, this allows the auditee to see their comment has been removed by an administrator or manager, who should leave an additional comment to explain this action although this is not enforced.

Implementing actions and changing an issues status

When an action is completed by a auditee and they have entered a comment informing administrators or managers (with permission) that the action is implemented, the action can be marked and a final comment entered.

To implement an action (or change its status) go to issues by clicking the [Issue] menu item, locate the issue and click on it. Locate the action that has been implemented and check the implemented check box, enter a final comment and click [OK].

Once an action has been implemented it can no longer be commented on. Implementing an action ensures that overdue reminders are not sent for completed actions.

When all actions have been implemented (or if an action cannot be implemented for whatever reason), the status of the issue needs to be updated. This is done by clicking the button at the top right of the issue page.

The issues status should be updated to identify its current state, by default the options are:

Open	Outstanding	The issue still requires attention.
	Partly Implemented	The issue has been mainly addressed but some areas still need to be looked at in the future.
Closed	Unverified	The issue has been implemented but not verified by an internal audit leader.
	Implemented	The issue has been fully addressed.
	Superseded	The issue is no longer relevant as it has been superseded by a new issue.
	Not Adopted	The issue is no longer relevant as its recommendations and not being pursued.

If either of the open statuses are selected then the issue is still considered active and notifications and warning will still be displayed to respective parties. The closed statuses mark the issue as inactive and no longer requiring attention. The type of status selected obviously depends on what has transpired but is also important for key reports within Tracker. Click [Save and close] to update the issue status (and any other fields changed), to return to the response screen without saving any changes, click the button at the top right of the page.