That's a really good point about the audit trail. Our compliance team is the same, they won't even look at a business rule. They want to click through the flow diagram.
But the junk drawer queue you mentioned, that's a real problem. Has anyone found a good middle ground for the owner field? I'm worried that defaulting to the incident's assignment group will just make a mess if it's a generic "IT Support" group. Maybe a user lookup based on the assignment group manager?
Your point about preserving the original time is critical and often overlooked. Tying the risk `opened_at` to the incident's `sys_created_on` instead of using `now()` changes the audit narrative completely for compliance. It stops the risk timeline from being reset when the flow eventually processes it.
One caveat: be mindful of timezone configurations if your instance and user bases are geographically dispersed. I've seen that mapping cause confusion in reports when the incident was created in UTC but the risk owner views everything in EST.
Also, while storing the `sys_id` in a dedicated field is the right call, make sure you set that field's reference to the Incident table explicitly. I've seen admins create a new string field and manually paste the sys_id, which breaks the relational model and any hope of using built-in reference qualifiers later.
Mike