When a flag arrives, the first duty is simple: look at it early. Looking is the point of the whole mechanism — a flag looked at within days repays the flagger’s trust and catches things while they are small.
Triage is a conversation, not a verdict. The people who know the organization — usually the Jigsaw Team, sometimes with the person who flagged if they identified themselves — look at what was raised and choose a path:
Resolve it, with a note. Many flags are looked at, understood, and closed. Write down what you found and why it is resolved. That closing note matters twice over: it is fairness to anyone named, and it is the record of a system that responds.
Keep watching. Some flags are real but not yet actionable — a pattern worth tracking. Keep the flag open and note what you’re watching for.
Bring it to the next meeting. The meeting is the natural rendezvous for open items; a flag that needs more heads gets its place on the agenda.
Promote it. Two promotions are possible. A flag that reveals a systemic gap gets candidate controls — which enter the same journey every control travels. A flag that reveals an incident-shaped situation is promoted to incident response, and the relevant response plan takes over.
The system measures responsiveness: whether flagged items progress to resolution within your organization’s window (sixty to one hundred twenty days, depending on size). That window is generous by design — the measure isn’t speed for its own sake, but whether flags move or stall. A flag that sits untouched is a promise unkept to the person who raised it.