Sla Breach Escalation

---
name: sla-breach-escalation
enabled: true
description: |
  Use when performing sla breach escalation — sLA breach detection and
  escalation procedure covering proactive SLA monitoring, breach notification
  workflows, escalation matrices, and remediation tracking. Ensures SLA breaches
  are identified early, stakeholders are notified promptly, and corrective
  actions are documented to prevent recurrence.
required_connections:
  - prefix: itsm
    label: "ITSM Tool (ServiceNow, Freshservice, etc.)"
config_fields:
  - key: ticket_id
    label: "Ticket / Incident ID"
    required: true
    placeholder: "e.g., INC-2026-0042, TICKET-5678"
  - key: sla_type
    label: "SLA Type"
    required: true
    placeholder: "e.g., First Response, Resolution, Update Frequency"
  - key: sla_target
    label: "SLA Target"
    required: true
    placeholder: "e.g., 1 hour, 4 hours, 24 hours"
  - key: current_elapsed
    label: "Current Elapsed Time"
    required: true
    placeholder: "e.g., 2 hours, 6 hours"
  - key: priority
    label: "Ticket Priority"
    required: false
    placeholder: "e.g., P1-Critical, P2-High, P3-Medium"
features:
  - HELPDESK
---

# SLA Breach Escalation Procedure

Ticket: **{{ ticket_id }}** | Priority: {{ priority }}
SLA Type: **{{ sla_type }}** | Target: {{ sla_target }} | Elapsed: {{ current_elapsed }}

## SLA Status Assessment

```
SLA STATUS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Ticket:       {{ ticket_id }}
Priority:     {{ priority }}
SLA Type:     {{ sla_type }}
SLA Target:   {{ sla_target }}
Time Elapsed: {{ current_elapsed }}
Status:       [ ] On Track / [ ] At Risk (>75%) / [ ] BREACHED
```

## Escalation Matrix

| Priority | SLA Target | Warning (75%) | Breach | Escalate To |
|----------|-----------|---------------|--------|-------------|
| P1-Critical | 1 hour | 45 min | 1 hour | Team Lead + Manager + Director |
| P2-High | 4 hours | 3 hours | 4 hours | Team Lead + Manager |
| P3-Medium | 8 hours | 6 hours | 8 hours | Team Lead |
| P4-Low | 24 hours | 18 hours | 24 hours | Team Lead (next business day) |

## Escalation Workflow

### Level 1 — Warning (SLA at 75%)
- [ ] Auto-alert assigned agent that SLA is at risk
- [ ] Agent reviews and updates ticket with current status
- [ ] If agent is unavailable: auto-reassign to available team member
- [ ] Notify team lead of at-risk ticket

### Level 2 — SLA Breached
- [ ] Immediate notification to:
  - Assigned agent
  - Team lead
  - Support manager (for P1/P2)
- [ ] Document breach in ticket:
  ```
  SLA BREACH NOTIFICATION
  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Ticket: {{ ticket_id }}
  SLA Breached: {{ sla_type }}
  Target: {{ sla_target }}
  Actual: {{ current_elapsed }}
  Reason: [document why breach occurred]
  Corrective Action: [immediate steps being taken]
  ```
- [ ] Reassign to senior agent or specialist if needed
- [ ] Prioritize above non-breached tickets

### Level 3 — Extended Breach (2x SLA target)
- [ ] Escalate to department manager
- [ ] Notify customer/requester with status update and new ETA
- [ ] Convene mini-incident review if P1/P2
- [ ] Assign dedicated resource to resolution

### Level 4 — Critical Breach (3x+ SLA target)
- [ ] Escalate to director/VP level
- [ ] Formal customer communication required
- [ ] Post-breach review mandatory
- [ ] Capture for SLA compliance reporting

## Root Cause Analysis for Breach

When documenting the breach, identify which factor contributed:

- [ ] **Staffing**: Insufficient agents available
- [ ] **Skills**: Required expertise not available in team
- [ ] **Assignment**: Ticket routed to wrong group/agent
- [ ] **Prioritization**: Ticket incorrectly prioritized
- [ ] **Complexity**: Issue more complex than SLA tier allows
- [ ] **External dependency**: Waiting on vendor, other team, or customer
- [ ] **Tool/Process**: ITSM workflow or automation failure

## Preventive Actions

- [ ] Review and adjust SLA targets if consistently breached
- [ ] Implement automated SLA warning alerts at 50% and 75%
- [ ] Review ticket routing rules for accuracy
- [ ] Cross-train agents on common escalation topics
- [ ] Schedule periodic SLA compliance reviews (weekly/monthly)

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format

Generate an escalation report with:
1. **Breach summary** (ticket, SLA type, target vs actual)
2. **Escalation actions taken** with timestamps
3. **Root cause** of breach
4. **Resolution** and time to resolve after escalation
5. **Preventive recommendations**