when a user is reviewing a risk they can flag the risk to a risk manager to ad a new control or remove a control etc.

When a user is conducting an RBA they can flag specific items in the RBA for a separate review by a different user or automatically add the RBA item to a custom register