# SLA breach escalation SOP

Version: 1.0  
Owner: Support service owner  
Review cadence: Monthly and after any SLA, calendar, scheduler, or escalation change

## Purpose

Turn an at-risk SLA cycle into an owned recovery action and retain evidence through breach review. The help desk is the deadline authority; this procedure never creates a parallel clock.

## Trigger and completion

- Start: source SLA event or bounded poll returns a running cycle inside a warning band.
- Complete: the cycle stops without breach, or a breach review has cause, recovery owner and follow-up.
- Alert key: `{ticket_id}:{sla_cycle_id}:{threshold_id}:{target_revision}`.

## Required inputs

- Ticket and SLA cycle IDs, target name, source deadline and target revision
- Running/paused/stopped/breached state
- Calendar/timezone plus start, pause and stop policy
- Acknowledged ticket owner, duty lead and service owner
- Threshold, notification and fallback configuration

## Procedure

1. Read the active cycle from the service desk.
2. Exit if resolved, paused, stopped, replaced, or already processed at this threshold/revision.
3. At the recoverable-risk threshold, notify the acknowledged owner with exact source deadline, remaining time, required response and ticket link.
4. Require one response: `on_track`, `needs_capacity`, `dependency_blocked`, or `clock_question`, with next checkpoint.
5. At the management-risk threshold, revalidate state. Notify the duty lead with the recorded recovery response or missing-acknowledgement reason.
6. Duty lead changes capacity, dependency ownership or clock configuration in the authoritative system.
7. If the source marks breach, write one breach event and create a review task.
8. Service owner records cause, customer recovery owner, control change and follow-up date.
9. Resolution stops operational alerts but does not automatically close the breach review.

## Guard conditions

- Never calculate business-hour deadlines locally.
- Never alert from cached state without re-reading the cycle.
- One event per cycle, threshold and target revision.
- Owner change redirects an unfulfilled action; it does not duplicate a fulfilled warning.
- Provider retries reuse the notification idempotency key.
- Missing owner escalates directly to the duty queue.

## Measurement

Track acknowledgement rate, time to recovery plan, recovered-before-breach rate, false alerts on paused/completed cycles, duplicates, delivery failures, breaches without warning, and breach causes by policy/calendar.

## Audit record

Keep source deadline, calendar and policy versions, cycle state, target revision, threshold, alert key, recipients, provider receipts, acknowledgement, recovery state, escalation actions and breach review.

## Rollback

Disable automatic notifications while retaining the read-only at-risk view. Assign a duty lead to review that view at a frequency supported by the shortest target. Do not replace the source clock with a spreadsheet.