Four levels
| Level | Criteria | Who escalates | To whom | Time |
|---|---|---|---|---|
| 1 Minor | Single team affected, service within tolerance, no external impact | Team lead | Department head | Same day |
| 2 Moderate | One critical service degraded, tolerance not breached | Department head | BCM manager, COO | Within 15 minutes |
| 3 Major | Critical service disrupted beyond tolerance, or several services degraded | BCM manager | Crisis team leader | Within 15 minutes |
| 4 Crisis | Threat to life, regulatory breach, media attention, licence or solvency at risk | Crisis team leader | Board chair; regulator per rules | Immediately; regulator within prescribed hours |
The criteria are written as observable facts tied to tolerances from the BIA, so that two people reading them at 3 a.m. reach the same level. Levels are reassessed every two hours during an incident, and downgrading needs the same authority as upgrading; otherwise incidents are quietly downgraded to avoid the paperwork.
Download the template
Download the template. Escalation sheet with four levels, criteria, response, escalation and notification times and the record to keep; a contact sheet with primary and deputy per role and a verification date. Xlsx.
Download xlsx (escalation-matrix-template.xlsx)
Regulator notification timelines for level 4 are placeholders; insert the ones from NCEMA, CBUAE or your sector rules. No registration, no forms. Need it adapted to your organisation or a full programme: see how we work.
Where the matrix sits
Between detection and the crisis plan. Monitoring and the service desk produce level 1 and 2 events every week; the matrix is what turns a level 2 into a level 3 call to the BCM manager before the tolerance is breached, not after. Level 3 activates the continuity plan; level 4 activates the crisis management plan. The quarterly call-tree test checks the contact sheet; the tabletop exercise checks whether people actually escalate.
Three errors to avoid
- Criteria by severity words. "Significant impact" is read differently by everyone; "tolerance breached" or "more than 20 % of staff unavailable" is read the same way.
- Escalating to a person, not a role. People are on leave; roles have deputies.
- No record. Without a log entry with time, the review cannot tell whether escalation took 15 minutes or 3 hours, and the regulator will assume the latter.
Frequently asked questions
What is an escalation matrix?
A table that defines, for each level of incident severity, the observable criteria, who escalates, to whom, within what time, and what is recorded. It removes judgement from the moment of escalation and makes the time to activation measurable.
How many escalation levels are needed?
Four is enough for most organisations: minor, moderate, major, crisis. More levels create argument about which one applies; fewer merge events that need different responses.
Who decides the escalation level?
The person who detects the event applies the criteria for levels 1 and 2; the BCM manager confirms level 3; the crisis team leader declares level 4. Downgrading requires the same authority as upgrading.
How is the escalation matrix tested?
Through quarterly call-tree tests that verify contacts and response times, and tabletop exercises in which the facilitator checks whether the team escalates at the moment the criteria are met.