# Page: Case Review Actions

## Purpose

This page describes the typical actions an investigator or analyst takes after opening a case for review.

## Common review actions

When reviewing a case, users may:

- open the case details;
- read the supporting score or alert information;
- update the workflow status;
- add notes or diary entries;
- assign the case to another reviewer;
- close or defer the case after investigation.

## Example workflow

Example: an analyst opens a new high-risk case, reviews the score and supporting evidence, adds notes about the investigation, updates the case status to In Review, and then closes it once the decision is complete.

## Recommended approach

1. Review the case context first.
2. Confirm the relevant score, payload, or rule explanation.
3. Document the investigation outcome.
4. Move the case to the next appropriate state.

## Operational guidance

- keep notes clear and concise;
- make sure the status reflects the current investigation state;
- avoid leaving a case in an unclear state for long periods.

## Notes

Case review actions are the operational bridge between automated risk detection and human investigation. Good handling improves consistency and auditability.