Escalation Handler

---
name: Escalation Handler
slug: escalation-handler
description: Handle escalated support issues with structured triage, communication, and resolution processes
category: customer-support
complexity: complex
version: "1.0.0"
author: "ID8Labs"
triggers:
  - "escalation"
  - "escalated ticket"
  - "customer escalation"
  - "support escalation"
  - "urgent issue"
  - "executive complaint"
tags:
  - escalation
  - support
  - crisis-management
  - customer-recovery
  - communication
---

# Escalation Handler

Expert escalation management system that transforms high-stakes support situations into opportunities for customer recovery and relationship strengthening. This skill provides structured workflows for triaging escalations, communicating with stakeholders, driving resolution, and preventing recurrence.

Escalations are defining moments in customer relationships. Handled poorly, they accelerate churn. Handled well, they build deeper loyalty than if the problem never happened. This skill helps you turn crisis into opportunity through systematic, empathetic, and effective escalation management.

Built on crisis management and customer recovery best practices, this skill combines triage protocols, communication frameworks, and resolution tracking to handle any escalation with confidence.

## Core Workflows

### Workflow 1: Escalation Triage
**Quickly assess severity and route appropriately**

1. **Severity Classification**
   | Level | Criteria | Response Time |
   |-------|----------|---------------|
   | SEV-1 | Production down, data loss, security breach | 15 minutes |
   | SEV-2 | Major feature broken, significant impact | 1 hour |
   | SEV-3 | Feature degraded, workaround exists | 4 hours |
   | SEV-4 | Minor issue, low impact | 24 hours |

2. **Impact Assessment**
   - Customer tier (Enterprise = higher priority)
   - Revenue at risk
   - Number of users affected
   - Business criticality to customer
   - Public exposure risk
   - Regulatory implications

3. **Escalation Type**
   - **Technical**: Product/service not working
   - **Service**: Support experience failure
   - **Business**: Commercial or relationship issue
   - **Security**: Data or access concerns
   - **Compliance**: Legal or regulatory

4. **Initial Triage Questions**
   - What exactly is happening?
   - When did it start?
   - Who is affected?
   - What's the business impact?
   - What has been tried?
   - Is there a workaround?

### Workflow 2: Stakeholder Communication
**Keep all parties informed throughout resolution**

1. **Internal Communication**
   - **Immediate**: Alert relevant teams (engineering, CSM, management)
   - **Ongoing**: Regular status updates (hourly for SEV-1/2)
   - **Resolution**: Post-incident summary
   - **Follow-up**: Root cause and prevention

2. **Customer Communication**
   - **Acknowledgment**: Within 15 minutes of escalation
   - **Update Cadence**: Per severity level
   - **Format**: Match customer preference (email, call, portal)
   - **Tone**: Empathetic, ownership, action-focused

3. **Update Frequency**
   | Severity | Update Frequency | Stakeholders |
   |----------|------------------|--------------|
   | SEV-1 | Every 30 minutes | Customer, Exec, All hands |
   | SEV-2 | Every 2 hours | Customer, Manager, CSM |
   | SEV-3 | Daily | Customer, CSM |
   | SEV-4 | On progress | Customer |

4. **Communication Principles**
   - Lead with what you know, not what you don't
   - Give specific next steps and timelines
   - Acknowledge impact and frustration
   - Avoid blame or excuses
   - Provide single point of contact

### Workflow 3: Resolution Management
**Drive systematic resolution**

1. **War Room Protocol** (SEV-1/2)
   - Designate incident commander
   - Assemble cross-functional team
   - Establish communication channel (Slack, Teams)
   - Set update cadence
   - Document all actions in real-time

2. **Resolution Tracking**
   ```
   Escalation Record:
   - ID: [Unique ID]
   - Customer: [Name]
   - Severity: [Level]
   - Start Time: [Timestamp]
   - Current Status: [Status]
   - Owner: [Name]
   - Next Action: [Action]
   - ETA: [Time]
   - Updates: [Log]
   ```

3. **Resolution Steps**
   - Confirm exact problem
   - Identify root cause (or best hypothesis)
   - Develop solution options
   - Implement fix (or workaround)
   - Verify resolution with customer
   - Confirm customer satisfaction
   - Document and close

4. **Workaround Protocol**
   - Always pursue workaround parallel to root fix
   - Communicate workaround clearly
   - Document workaround steps
   - Set expectations for permanent fix
   - Follow up when permanent fix available

### Workflow 4: Customer Recovery
**Rebuild relationship after resolution**

1. **Recovery Actions**
   | Impact Level | Recovery Actions |
   |--------------|------------------|
   | Minor | Apology + thank you |
   | Moderate | Apology + service credit |
   | Significant | Exec call + credit + roadmap |
   | Severe | In-person meeting + significant gesture |

2. **Recovery Conversation Structure**
   - Acknowledge what happened
   - Take responsibility (no excuses)
   - Explain what you've done to fix it
   - Explain what you're doing to prevent recurrence
   - Ask what else they need
   - Commit to follow-up

3. **Goodwill Gestures**
   - Service credits (1-3 months typical)
   - Premium support upgrade
   - Extended contract terms
   - Free training/consulting
   - Early access to new features
   - Executive relationship investment

4. **Relationship Rebuilding**
   - Increased check-in frequency
   - Proactive status updates
   - Invite to customer advisory board
   - Prioritize their feedback
   - Celebrate wins together

### Workflow 5: Post-Incident Review
**Learn and prevent recurrence**

1. **Root Cause Analysis**
   - What happened (factual timeline)
   - Why it happened (5 whys analysis)
   - Why we didn't prevent it
   - Why we didn't detect it earlier
   - What made resolution difficult

2. **Process Review**
   - Did triage work correctly?
   - Was communication effective?
   - Were the right people involved?
   - Did tools and processes help or hinder?
   - What would we do differently?

3. **Prevention Actions**
   - Technical fixes (monitoring, testing, architecture)
   - Process improvements (escalation path, playbooks)
   - Training needs (team skills, knowledge)
   - Documentation updates
   - Customer communication improvements

4. **Documentation**
   - Post-incident report
   - Knowledge base article
   - Playbook updates
   - Training materials
   - Customer-facing incident summary

## Quick Reference

| Action | Command/Trigger |
|--------|-----------------|
| Triage escalation | "Triage escalation from [Customer]" |
| Create war room | "Set up war room for [Issue]" |
| Draft update | "Write customer update for [Issue]" |
| Escalation summary | "Summarize escalation [ID]" |
| Recovery plan | "Create recovery plan for [Customer]" |
| Root cause analysis | "Run RCA for [Incident]" |
| Draft apology | "Write apology for [Situation]" |
| Status report | "Create escalation status report" |
| Escalation metrics | "Show escalation metrics" |
| Prevention plan | "Create prevention plan for [Issue type]" |

## Best Practices

### Triage
- Act fast - speed demonstrates care
- Don't underestimate severity
- Involve senior resources early
- Assign clear ownership
- Document from minute one

### Communication
- Acknowledge before you diagnose
- Give timelines even if estimates
- Update even when no update
- Match customer's urgency level
- Use their preferred channel

### Resolution
- Workaround first, root cause second
- Test fixes before declaring resolved
- Confirm with customer directly
- Document everything
- Don't close until customer confirms

### Recovery
- Take ownership, not blame
- Gesture proportional to impact
- Follow through on commitments
- Increase touch points post-recovery
- Measure relationship health

### Prevention
- Every escalation teaches something
- Share learnings across team
- Update playbooks regularly
- Celebrate prevented escalations
- Track pattern recurrence

## Communication Templates

### Initial Acknowledgment
```
Subject: [URGENT] We're on it - [Brief Issue Description]

Hi [Name],

I'm [Your Name], [Your Role], and I'm personally handling your escalation.

I understand you're experiencing [brief issue description] and I know how disruptive this is to your business.

Here's where we are:
- We've engaged our [engineering/support] team
- We're actively investigating the root cause
- I'll update you within [timeframe]

Your dedicated contact for this issue: [Name, email, phone]

We won't rest until this is resolved.

[Your Name]
```

### Progress Update
```
Subject: Update on [Issue] - [Status]

Hi [Name],

Here's your [X-hour] update:

**Current Status**: [Where we are]

**What We've Done**:
- [Action 1]
- [Action 2]

**Next Steps**:
- [What we're doing now]
- [Expected outcome/timeline]

**Next Update**: [When]

Questions? Call me directly at [number].

[Your Name]
```

### Resolution Notification
```
Subject: Resolved - [Issue Description]

Hi [Name],

I'm pleased to confirm that [issue] has been fully resolved.

**What Happened**: [Brief explanation]

**What We Did**: [Resolution actions]

**Preventing Recurrence**: [What we're doing so this doesn't happen again]

I know this caused significant disruption to your team, and I'm truly sorry. I'd like to discuss how we can make this right - would you have 15 minutes this week?

Thank you for your patience throughout this.

[Your Name]
```

### Executive Apology
```
Subject: Personal Apology from [Executive Name]

[Name],

I'm [Executive Name], [Title] at [Company], and I wanted to reach out personally regarding the issues you've experienced.

First, I'm sorry. [Brief acknowledgment of specific impact] is not acceptable, and I take full responsibility.

I've reviewed the situation with our team, and here's what we're doing:
1. [Immediate fix]
2. [Process change]
3. [Prevention measure]

I'd welcome the opportunity to discuss this with you directly. Would you be open to a call this week?

Your success is our priority, and we're committed to earning back your trust.

Sincerely,
[Executive Name]
[Direct contact info]
```

## Escalation Metrics

| Metric | What It Measures | Target |
|--------|------------------|--------|
| First Response Time | Time to acknowledgment | Per severity SLA |
| Time to Resolution | End-to-end resolution time | Per severity SLA |
| Customer Satisfaction | Post-escalation CSAT | 4.0/5.0+ |
| Escalation Rate | Escalations / Total tickets | < 5% |
| Repeat Escalation | Same issue escalated again | < 10% |
| SLA Compliance | % resolved within SLA | 95%+ |
| Recovery Success | Relationship maintained | 90%+ |
| Prevention Implementation | RCA actions completed | 100% |

## Severity Level SLAs

| Severity | First Response | Update Frequency | Resolution Target |
|----------|----------------|------------------|-------------------|
| SEV-1 | 15 min | 30 min | 4 hours |
| SEV-2 | 1 hour | 2 hours | 8 hours |
| SEV-3 | 4 hours | Daily | 48 hours |
| SEV-4 | 24 hours | On change | 1 week |

## Red Flags

- **Delayed acknowledgment**: Customer waiting without response
- **Under-severity**: Classifying lower to avoid effort
- **Communication gaps**: Long silences during active escalation
- **Blame language**: Pointing fingers at customer or other teams
- **Premature closure**: Marking resolved before customer confirms
- **No follow-through**: Recovery promises not kept
- **Missing RCA**: Closing without understanding cause
- **Pattern blindness**: Same issues escalating repeatedly

## Post-Incident Report Template

```markdown
# Post-Incident Report: [Incident ID]

## Summary
- **Customer**: [Name]
- **Issue**: [Brief description]
- **Severity**: [Level]
- **Duration**: [Start to Resolution]
- **Impact**: [Customer impact description]

## Timeline
| Time | Event |
|------|-------|
| [Time] | Issue first reported |
| [Time] | Escalation triggered |
| [Time] | Root cause identified |
| [Time] | Resolution implemented |
| [Time] | Customer confirmed resolution |

## Root Cause
[Detailed explanation of why this happened]

## Resolution
[What was done to fix the issue]

## Customer Impact
- [Specific business impact]
- [Duration of impact]
- [Users/systems affected]

## Prevention Actions
| Action | Owner | Due Date | Status |
|--------|-------|----------|--------|
| [Action 1] | [Name] | [Date] | [Status] |

## Lessons Learned
- [What we learned]
- [What we'll do differently]

## Recovery Actions Taken
- [Apology delivered]
- [Goodwill gesture]
- [Follow-up scheduled]
```