Design a risk management ticketing system

Design a ticketing system that a security and risk team uses to track risks: open a ticket, assign an owner, set severity and deadlines, escalate when it is overdue, and close it with evidence. Cover the data model, the workflow states, notifications, auditing and access control.