Issues Management Intro Guide (Free)
A free 12-page intro to issues management: issues vs. findings, risk ratings and remediation deadlines, minimum ratings for regulatory findings, and closure validation.
Cost
Free
Built for risk, compliance, and governance practitioners
◆ About this resource
What you're getting.
Learn the essentials of issues management at a US fintech in 12 pages. This free intro guide explains the difference between a risk, an issue and a finding; the five-stage lifecycle from identification to validated closure; how to rate an issue on a 4×4 impact × likelihood heat map; and the remediation deadlines that follow from the rating (Critical 30 days, High 60, Medium 90, Low 180).
It also covers the minimum ratings for regulatory findings — Matters Requiring Attention (MRAs), Matters Requiring Immediate Attention (MRIAs), the FDIC's Matters Requiring Board Attention (MRBAs) and consent orders — including the OCC/FDIC rule on issuing MRAs that takes effect November 2, 2026; the minimum fields to record for every issue; a ten-point closure validation check; and five common exam pitfalls. When you're ready to run the process, the paid Issues Management Tracker & Template adds the Excel tracker and the full 56-page framework guide.
◆ Free · Delivered to your inbox
Download Issues Management Intro Guide (Free).
Enter your details and we'll email you the download link.
◆ No spam, ever
◆ FAQ
Frequently asked questions.
What does a "defensible" issues management process actually look like?
Issues are logged with a rating, root cause, owner, due date and action plans; deadlines follow the risk rating; extensions are documented rather than silent; and every closure is independently validated with evidence. Someone reviewing your process should be able to trace any finding from identification through remediation with documentation at each step.
Does this guide cover MRAs and exam findings specifically?
Yes. It spells out Matters Requiring Attention (MRAs), Matters Requiring Immediate Attention (MRIAs) and the FDIC's Matters Requiring Board Attention (MRBAs), gives a minimum risk rating for each type of regulatory finding, notes the OCC/FDIC rule on issuing MRAs effective November 2, 2026, and lists the steps for bringing a regulatory finding into your register.
Is this guide useful if we use a GRC platform?
Yes. The rating method, deadlines, minimum fields and closure standard apply regardless of tooling, so you can use the guide to check what your GRC platform should capture and enforce.
What's the difference between this free guide and the paid Issues Management Tracker?
This 12-page guide gives you the essentials. The paid Issues Management Tracker & Template ($49) adds the Excel / Google Sheets tracker (issues register with automatic ratings and overdue flags, exam findings tab, 5-Whys root cause worksheet, closure validation checklist and dashboard) and the full 56-page framework guide with evidence standards, risk acceptance, third-party issues, governance, exam preparation and a worked example.
How fast should we fix an issue?
The guide ties deadlines to the risk rating: Critical issues within 30 days of identification, High within 60, Medium within 90 and Low within 180, with any extension approved and documented rather than slipped silently.
◆ Related templates
Pairs well with.
Issues Management Tracker & Template
End-to-end issues tracking and remediation management for risk and compliance teams.
KRI Library (152 Key Risk Indicators)
152 KRIs — including 20 emerging-risk KRIs for AI-enabled fraud, scams and AI governance — with thresholds, owners and a calculating dashboard.
◆ Ready when you are
Get the guide.
Download this free resource and start building your risk program today.
Download free →