Manage risk issues and remediation

---
title: Manage risk issues and remediation
description: Issues can be created manually to document audit observations or remediations, or to accept any problems. They are automatically generated from indicator results, attestation results, or control test effectiveness.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/governance-risk-compliance/grc-risk-management-workspace/issues-risk.html
release: brazil
product: GRC: Risk Management Workspace
classification: grc-risk-management-workspace
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Explore, Risk Management, Governance, Risk, and Compliance]
---

# Manage risk issues and remediation

Issues can be created manually to document audit observations or remediations, or to accept any problems. They are automatically generated from indicator results, attestation results, or control test effectiveness.

Various types of issues are created under the following conditions:

-   **Issue**

    Created when an indicator fails

-   **Control issue**

    Created when a control attestation is completed indicating that the control is **Not implemented**

-   **Control test issue**

    Created when a control test is closed complete with the control effectiveness set to **Ineffective**

-   **Other issue**

    Created by the user manually


Remediating an issue marks an intention to fix the underlying issue causing the control failure or risk exposure. Accepting an issue marks an intention to create an exception for a known control failure or risk. Controls that are **Accepted** remain in a non-compliant state until the control is reassessed. In this way, the issue can be used to document observations during audits.