09 — Escalation Matrix
When in doubt, escalate. Escalation is information, not failure.
Trigger → Escalate to → Within
| Trigger | First responder | Escalate to | SLA |
|---|---|---|---|
| Participant discloses risk of harm to self/others | Coach | DSL | Immediate (same call) |
| Coach unsure if a topic crosses FCA boundary | Coach | HoC | Same day |
| Cohort goes AMBER for 2 consecutive weeks | HoD | COO | Next MBR or sooner |
| Cohort goes RED | HoD | COO + CEO | Within 24h |
| Client signals dissatisfaction (CSAT drop, churn signal) | CL | COO | Within 48h |
| Discount > 10% requested | AE | CL | Same day |
| Discount > 20% requested | CL | COO → CEO | Same day |
| New sub-processor proposed | Function lead | DPO | Before signing |
| Personal data breach suspected | Anyone | DPO + COO | Within 1h |
| Media enquiry | Anyone | Comms → CEO | Within 2h |
| Regulator contact | Anyone | CEO + Legal | Within 1h |
| Safeguarding flag open > 7 days | DSL | COO | Day 8 |
| Cash runway < 9 months | Finance | COO + CEO | At MBR |
| Cash runway < 6 months | Finance | CEO + Board chair | Within 5 working days |
| Cash runway < 4 months | Finance | Full board | Same day |
| Any Sev 1 incident | On-call | CEO + DSL + DPO + Board chair | Within 15 min |
| Any whistleblowing concern | Anyone | Independent NED (named in handbook) | As soon as possible |
How to escalate well
- State the trigger. "I am escalating because [trigger from the table]."
- State what you have already done. Containment, comms, who is informed.
- State what you need. A decision, more hands, sign-off, or just awareness.
- State the clock. "I need a response by [time]."
How not to escalate
- "Quick question…" in a DM with no context
- Escalating only the symptom, not the trigger
- Skipping a level without telling your direct lead
- Escalating then disappearing — escalation is a hand-off, not an abandonment
Reverse path: de-escalation
When the trigger no longer applies, the person who escalated owns telling the escalation chain that it is resolved, and updates the Incident Doc or relevant ticket to Closed. Silence is not closure.