Resolution captures the account, the corrective actions, and the risks and controls the incident affected.
Linking the incident to risks and controls is what lets their ratings and effectiveness be revisited.
The wizard has six steps and ends by moving the incident to Resolved.
The six steps
What Happened: the account of the event, confirmed and written up for the record.
Actions Taken: the corrective actions that were carried out in response.
Link Resources: attach related material, such as documents, statements, or other records.
Risk Assessment(s): connect the incident to the relevant risks on your register, so post-incident learnings can feed back into their ratings.
Controls: link the controls that were meant to mitigate the hazard, so their effectiveness can be re-rated through a Review.
Resolve: confirm and close out the resolution.
When you finish, the incident moves to Resolved, ready to be formally closed.
Why linking risks and controls matters
Steps 4 and 5 are what turn an incident from a one-off record into something that improves your safety programme. Linking the incident to a risk assessment surfaces it when that risk is next reviewed. Linking it to a control lets you re-rate whether that control is still effective, since an incident is direct evidence that a control may not be working as intended. See Assigning control owners and managing renewals for how control effectiveness is revisited.