A **case** is the record created when an [evaluation](https://help.socure.com/riskos/docs/understanding-riskos#evaluations) routes to manual review. Cases are created when certain risk rules are triggered within a [workflow](https://help.socure.com/riskos/docs/understanding-riskos#workflows) and the [decision](https://help.socure.com/riskos/docs/understanding-riskos#decisions) is `REVIEW`, or when a **Manual Review** step is reached. Not every evaluation creates a case — only those flagged for human review.

Each case contains the decision, [enrichment](https://help.socure.com/riskos/docs/understanding-riskos#enrichments) data, [signals](https://help.socure.com/riskos/docs/understanding-riskos#signals--attributes), tags, reason codes, and the full execution trace. Cases are routed to a **Case Queue** for human review.

## Case lifecycle

| Phase               | What happens                                                                                                                                                         |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Creation**        | An evaluation completes (or reaches Manual Review). RiskOS™ creates a case with the decision, enrichment data, and execution trace.                                  |
| **Queue assignment** | Cases with a `REVIEW` decision are placed in a Case Queue based on the workflow configuration.                                                                        |
| **Team assignment**  | A reviewer or team lead assigns the case to a specific reviewer.                                                                                                     |
| **Investigation**   | The reviewer examines enrichment data, signals, decision paths, and related cases in the Case View.                                                                   |
| **Status updates**  | The case moves through statuses (Open → On Hold → Closed) and customizable sub-statuses.                                                                              |
| **Final decision**  | The reviewer makes a decision: **Accept** or **Reject**.                                                                                                            |
| **Communication**   | The decision is communicated back to your system via webhook (`decision_update` event) or API.                                                                        |

## Case statuses

RiskOS™ defines three top-level case statuses:

| Status   | Description                                                         |
| -------- | ------------------------------------------------------------------- |
| **Open** | Newly created, awaiting assignment or review                        |
| **On Hold** | Paused pending additional information or action                   |
| **Closed** | Final decision made, case resolved                                |

Each status supports **sub-statuses** that are fully customizable per organization. For example, the default sub-status for an Open case is "In Review." Organizations can define additional sub-statuses such as "Escalated", "Pending Documents", or any label that fits their review workflow.

## Decision vs status

These are distinct concepts (see [Decisions](https://help.socure.com/riskos/docs/understanding-riskos#decisions)):

| Concept    | Question it answers                     | Set by          |
| ---------- | ---------------------------------------- | ---------------- |
| **Decision** | "What action should be taken?"        | Workflow or reviewer |
| **Status**   | "Where is this case in the review process?" | System or reviewer   |

A case can have a `REVIEW` decision and an Open status with an "In Review" sub-status simultaneously.

## Manual review: how it works

When a [workflow](https://help.socure.com/riskos/docs/understanding-riskos#workflows) can't reach an automated decision, it routes the evaluation to manual review:

1. **Trigger**: The workflow reaches a Manual Review step, or a Decision step returns `REVIEW`.
2. **Case Queue**: The case appears in the configured review queue.
3. **Assignment**: A reviewer claims the case or another user assigns it.
4. **Investigation**: The reviewer uses the Case View to examine:
   - Enrichment data and scores
   - Decision Path (step-by-step execution trace)
   - Related cases (linked by entity — email, phone, SSN)
   - Tags and reason codes
5. **Decision**: The reviewer selects Accept or Reject.
6. **Notification**: A `decision_update` webhook event is sent to your endpoint.

## Fraud feedback

During manual review, authorized reviewers can mark a case as **fraudulent** or **not fraudulent**:
- **Mark as Fraud**: Flags the case regardless of the current decision. Triggers a `fraud_confirming` webhook event.
- **Mark as non-fraud**: Reverses a fraud marking with a required note.

Fraud labels contribute to Socure's machine learning models (Sigma Identity Fraud, Sigma Synthetic Fraud) for improved detection.

## Related concepts
- [Evaluations](https://help.socure.com/riskos/docs/understanding-riskos#evaluations) — The process that creates a case
- [Decisions](https://help.socure.com/riskos/docs/understanding-riskos#decisions) — The outcome recorded on a case (distinct from case status)
- [Statuses & Lifecycle](https://help.socure.com/riskos/docs/statuses-and-lifecycle) — Case status lifecycle: Open → On Hold → Closed
- [Workflows](https://help.socure.com/riskos/docs/understanding-riskos#workflows) — The logic that routes evaluations to manual review
- [Signals & Attributes](https://help.socure.com/riskos/docs/understanding-riskos#signals--attributes) — The data visible in case detail views (signals, tags, reason codes)
- [Enrichments](https://help.socure.com/riskos/docs/understanding-riskos#enrichments) — Enrichment data displayed in case enrichment tiles
- [Terminology Governance](https://help.socure.com/riskos/docs/terminology) — "Case" not "ticket"; "status" for case lifecycle
- [Case Management Overview](https://help.socure.com/riskos/docs/case-management-overview) — Full Case Management feature guide
- [Case Queues](https://help.socure.com/riskos/docs/case-queues) — Queue configuration and management
- [Manual Evaluations](https://help.socure.com/riskos/docs/case-management-manual-evaluations) — Running evaluations from the dashboard
- [Webhook Events: decision_update](https://help.socure.com/riskos/docs/webhook-events) — Receiving manual review decisions

Updated about 1 month ago