Risk Flag

---
name: risk-flag
description: >
  Structured risk memo for an at-risk account — signals present, severity
  assessment, escalation routing from your configured matrix, and recommended
  intervention. Use when a health alert fires, a churn signal is detected, or
  you need to communicate account risk to leadership. Produces a CSM brief and
  an escalation-ready summary separately.
argument-hint: "[account name] [--brief | --escalation-memo]"
version: "1.0.0"
deployment_target: plugin
---

# /risk-flag

[PROPOSED]

## Use When
- A health review has confirmed risk signals are present and you need a structured risk assessment, severity classification, and escalation routing
- Multiple signals are present and you need to assess aggregate risk before acting
- Renewal is approaching and you need a structured risk assessment before the commercial conversation
- An account has gone dark (no contact, usage drop, sponsor departure) and you need a framework for response

## Do NOT Use For
- Generating the full escalation memo — use /csm:escalation-memo once routing is confirmed
- Health score review — use /csm:health-score-review for the full health narrative
- Accounts with no risk signals present — no escalation routing needed
- Executive-facing risk reporting — this skill is CSM-facing
- Renewal-window risk assessment when the account is within 90 days of renewal — use the Renewals plugin's risk-assessment skill for structured triage in the renewal window (if the `renewals` plugin is installed, run `/renewals:risk-assessment`)

## Typical Activation
"/csm:risk-flag Acme Corp"
"Flag risk signals for [account]"
"What's the escalation path for [account]?"
"Two high signals on [customer] — what do I do?"
"Assess churn risk for [account]"

---

Document the risk clearly, name the routing, and give the CSM a specific path
forward — not just a flag.

---

## Pre-flight

Read `~/.claude/plugins/config/claude-for-customer-success/csm/CLAUDE.md` and
`~/.claude/plugins/config/claude-for-customer-success/company-profile.md`.

If either is missing or contains `[PLACEHOLDER]` markers, stop and prompt for
`/csm:cold-start-interview`.

Critical configuration to apply:
- Churn signal definitions — which signals are configured as high/medium/low weight
- Escalation matrix — routing for each risk scenario
- Health model thresholds — Red and Yellow classification
- CS motion — shapes the intervention approach

**G-code dependency:** All G-code guardrails referenced in this skill (G1–G9) are defined in the CLAUDE.md config loaded above. If Pre-flight halts or config is missing, G-codes are undefined — do not proceed with partial config.
---


## Reasoning Protocol

> Load `references/reasoning-blueprint.md` for full taxonomy, heuristics, and failure modes.

Before generating output, apply these primers:

1. **CLASSIFY**: What type of risk is this?
- **Sudden Signal Spike** — single high-weight signal appeared abruptly (sponsor exit, competitor eval, P1 escalation)
- **Gradual Decay Pattern** — multiple medium signals accumulating over weeks (usage drift, missed QBRs, NPS decline)
- **Renewal-Proximity Risk** — any risk signal present AND renewal within 90 days
- **Stakeholder Disruption** — champion departure, sponsor reorg, power structure shift
- **Escalation-in-Progress** — customer has already escalated; CSM is responding, not initiating

2. **CONSTRAINTS** — enforce before generating output:
- **G1**: Health scores are heuristics — never frame as churn predictions or state the account "will churn"
- **G2**: Risk signals require direct evidence — absence of engagement is "Unknown" or "Declining," not "Confirmed at risk"
- **G4**: No escalation recommendation without a named contact, channel, and SLA from the configured matrix
- **G5**: Root cause is a hypothesis — present as leading interpretation with evidence, not as verdict
- **G7**: Escalation memo omits health model internals, component weights, and internal stakeholder notes — those stay in the CSM brief

3. **EXPERT CHECK** — what a veteran CSM verifies first:
- Is the signal real or a data artifact? Cross-reference with CSM notes and recent calls before classifying severity
- Signal clustering: two medium signals in 30 days outweighs one isolated high signal
- Sponsor silence (2+ unanswered outreaches in 30 days) is a high-weight signal regardless of health score
- Usage drops must be normalized against the customer's own baseline and business cycle
- Does the intervention plan fit inside the time-to-renewal window? If not, escalate immediately

4. **ANTI-PATTERNS** — common mistakes to avoid:
- Writing a recovery plan with more runway than the renewal date allows
- Classifying severity optimistically because the CSM "has a good relationship" — apply the matrix mechanically first
- Leaking health model scoring methodology into the escalation memo
- Presenting a risk memo that documents signals accurately but fails to convey aggregate urgency
- Restating what the customer already told leadership without adding root cause hypothesis or specific ask

**After execution**, verify:
1. **Intent satisfaction** — does the memo give the CSM a specific Monday-morning action plan, not just a flag?
2. **Mode matching** — does the output mode (`--brief` vs `--escalation-memo`) match the actual need? A brief that should be an escalation memo delays intervention; an escalation memo for a low-severity signal wastes leadership attention.
3. **Failure mode scan** — check the classification type against its common failure modes in the blueprint
4. **Staleness check (G7)** — is every data source timestamped? Flag CRM data >7 days stale, CS platform data >3 days stale, call/meeting data >14 days stale. Stale signals get a `[stale: <source> as of <date>]` tag.
5. **Confidence calibration** — [High] if live data + CSM confirmation corroborate the classification / [Medium] if single-source or partially stale data / [Low] if working from CSM description alone with no corroborating system data — state which.

## Mode

`--brief`: CSM-facing risk summary. Internal use — full signal breakdown,
health context, and CSM action plan. Default.

`--escalation-memo`: Produce a clean, escalation-ready summary for the CSM's
manager, VP CS, or CRO. Concise. Designed for rapid review by someone who
doesn't know the account details. Includes: account, ARR, renewal date,
risk signals, recommended action, and routing.

Both modes can be run for the same account. Default is `--brief`.

---

## Data gathering


**Connector error categorization:** When a connector call fails, distinguish the error type before proceeding:
- **Rate-limited (transient):** Connector returns HTTP 429 or equivalent throttle signal. Note the rate limit explicitly in output ("CRM data temporarily rate-limited — retry in 60 seconds recommended") and offer to retry rather than proceeding with degraded output.
- **Unavailable (permanent for this session):** Connector is not configured, authentication has expired, or service is down. Fall back to the manual-input path below and label all affected sections as "connector unavailable — manual input used."
Do not conflate these — a rate-limited connector will return data shortly; an unavailable connector will not.

Pull from connected integrations (per configured profile):
- CS Platform: current health score, component breakdown, CTAs, lifecycle stage
- CRM: ARR, renewal date, contract terms, stakeholder contacts, account history
- Call recording: last 2-3 calls — tone, topics, any risk signals mentioned
- Document storage: last success plan or QBR — open items, committed actions

If account-research was run this session: use that context.

If nothing connected, prompt:
> "Tell me what's happening at [account]. What triggered this risk flag? What
> signals are you seeing? I'll build the memo from what you share."

Do not generate a risk memo without at least one concrete risk signal from the
CSM or from live data.

---

## Risk flag structure

---

### CSM Risk Brief — [Account Name]
*[Date] · INTERNAL · [CS motion] · [Segment]*

---

**Account snapshot**

| Field | Value |
|-------|-------|
| ARR | $[amount] |
| Renewal date | [date] — [N] days |
| Segment | [segment] |
| Health | [Red / Yellow] |
| CSM | [name] |
| AE / AM | [name] |
| Executive sponsor | [name] — [last contact: date] |

---

**Risk signals — what triggered this flag**

List each signal present with evidence. No inferred signals without evidence.

| Signal | Present | Evidence | Weight per config |
|--------|---------|----------|------------------|
| Executive sponsor departure or disengagement | [Yes/No/Unknown] | [specific evidence] | High |
| Product usage drop >[configured threshold]% | [Yes/No] | [% change over period] | High |
| Open escalation or unresolved P1 ticket | [Yes/No] | [ticket details] | High |
| NPS detractor + no recovery conversation | [Yes/No] | [score + date] | Medium |
| Missed QBR or no-show pattern | [Yes/No] | [dates] | Medium |
| Competitor evaluation | [Yes/No/Unknown] | [source of signal] | High |
| No CSM contact in >[threshold] days | [Yes/No] | [last contact date] | Medium |
| [Additional configured signal] | | | |

**Primary risk driver:** [The signal with the most direct path to churn]

---

**Risk severity**

Classify based on configured thresholds and signal weight:

> **Severity: [Critical / High / Medium]**
>
> Classification rationale: [1-3 sentences. Which signals drove this. Why this
> severity level vs. adjacent options.]

- **Critical:** Multiple high-weight signals present; renewal within 90 days; ARR
  above escalation threshold → immediate executive-level escalation required
- **High:** One high-weight signal or multiple medium signals; requires CSM
  intervention within 48h; monitor daily
- **Medium:** Medium-weight signals; proactive outreach warranted; monitor weekly

---

**Root cause hypothesis**

What is the most likely reason for the risk?

> "The most plausible explanation is [X] — based on [specific evidence]. Alternative
> explanations: [Y] (possible if [condition]) / [Z] (possible if [condition]).
> The champion should be asked directly whether [root cause question] is accurate
> before the CSM builds a recovery plan."

Do not present the hypothesis as fact. It is the leading interpretation based on
available data. The CSM confirms or refutes it in the next customer interaction.

---

**Escalation routing**

Apply the configured escalation matrix exactly.

| Condition | Route to | Via | SLA |
|-----------|----------|-----|-----|
| [Matching scenario from matrix] | [configured contact] | [configured channel] | [configured SLA] |

If multiple matrix rows apply, show all and note the primary route.

If this account's ARR meets the configured churn-risk threshold:
> "ARR ($[amount]) exceeds the configured escalation threshold ($[threshold]).
> Route to [configured contact] via [channel] within [SLA]. Include this memo."

If below the threshold:
> "ARR is below the configured escalation threshold. CSM-managed intervention.
> Notify [CS lead] if severity escalates to Critical."

---

**Recommended intervention plan**

Specific actions with owners and timelines. Not generic.

**Immediate (within 24-48h):**
1. [Specific action — e.g., "Request executive sponsor check-in call. Purpose: confirm
   sponsor status and surface any org changes. Do not lead with health score."]
2. [Specific action — e.g., "Review open tickets — contact support team to confirm
   P2 ticket [ID] has a resolution timeline and communicate it to the champion."]
3. [Escalation action — e.g., "Notify [CS lead] per escalation matrix via Slack.
   Share this memo as context."]

**This week:**
1. [Action — e.g., "Meet with champion to understand usage drop root cause.
   Prepare 3 questions: [specific questions based on signals]."]
2. [Action — e.g., "Update health assessment in CS Platform with current signals."]

**If [specific trigger] occurs:**
1. [Escalation path — e.g., "If sponsor confirms departure, escalate to Critical
   immediately. Route to [VP CS] within [SLA]. Loop in AE."]

---

**Success criteria for recovery**

What does "risk resolved" look like? Define 1-3 observable conditions:
- [Condition 1 — e.g., "Usage returns to >[threshold]% of baseline within 30 days"]
- [Condition 2 — e.g., "Executive sponsor re-engaged and confirmed for next QBR"]
- [Condition 3 — e.g., "Champion confirms competitor evaluation is not active"]

Review date: [recommend a specific date to reassess — typically 2-4 weeks out]

---

## Escalation memo (`--escalation-memo`)

One-page version for the CSM's manager, VP CS, or CRO. No internal health model
details — just the facts they need to act.

---

**Account Risk Memo — [Account Name]**
*[Date] · Prepared by: [CSM name]*

**For:** [Manager / VP CS / CRO — configured escalation contact]

---

| Field | Detail |
|-------|--------|
| Account | [Account name] |
| ARR | $[amount] |
| Renewal | [date] — [N days] |
| Segment | [segment] |
| Risk level | [Critical / High / Medium] |

**Risk signals:**
- [Signal 1]: [1-line evidence]
- [Signal 2]: [1-line evidence]
- [Signal 3 if present]: [1-line evidence]

**Most likely root cause:**
[2-3 sentences. Plain language. What is the risk and why.]

**Recommended action from CSM:**
[What the CSM is doing. What they need from leadership.]

**If no action is taken:**
[Likely outcome — e.g., "Renewal at risk of churn or significant contraction
based on signals present. Renewal is in [N] days."]

**Next step:**
[Specific ask — e.g., "Request 20 minutes with the customer's CFO to reinforce
the executive relationship. CSM to arrange. Your name on the invite increases
response rate significantly."]

---

## Reviewer note

> **⚠️ Reviewer note**
> - **Sources:** [CS Platform ✓ live | CS Platform [configured but unverified] | CRM ✓ live | CRM [configured but unverified] | call notes: [date] | user-provided context | not connected — conversation context only]
> - **Data as of:** [timestamp per source]
> - **Risk signals:** [Confirmed from data | CSM-reported — not independently verified]
> - **Escalation routing:** [Applied configured matrix — verify contact names are current]
> - **Flagged for your judgment:** [N items marked `[review]` inline | none]
> - **Before escalating:** Confirm ARR and renewal date with CRM before sharing escalation memo with leadership.

---

## Output

Risk flag report — format driven by `--standard` (default) or `--escalation-memo`
flag. Standard output produces a structured risk summary with signal inventory,
severity tier, and recommended response actions. Escalation memo mode produces a
full internal memo. See mode-specific sections for field-level structure.

## Guardrails

**Risk signals require evidence.** A signal is listed as Present only if there is
direct evidence. Absence of engagement is "Unknown" or "Declining," not "Confirmed
at risk."

**Root cause is a hypothesis, not a verdict.** The memo names the leading
explanation and the evidence behind it. It does not state the account will churn.

**No escalation without a path.** Every escalation recommendation names the
contact, channel, and SLA from the configured matrix. A risk flag without a
routing is not actionable.

**Escalation memo is not the full brief.** The escalation memo omits health model
component weights, internal stakeholder notes, and expansion context. Those stay
in the CSM brief.

**Expansion context.** If the account has expansion signals, do not include them
in the risk memo. Risk memos focus on risk mitigation, not opportunity. Expansion
context routes to the AE separately.

**Revenue accountability.** If the memo estimates ARR at risk or implies a renewal
probability, the CSM reviewer validates the figure before the memo reaches finance
or board reporting.

---

## After the memo

- "Want a full escalation memo to send to leadership? Run again with `--escalation-memo`."
- "Renewal within 90 days — run renewal readiness: `/csm:renewal-readiness [account]`"
- "Need to track intervention progress? Update the account in `/csm:account-research` after each action."
- "Want to map the stakeholder risk specifically? `/csm:stakeholder-map [account] --sponsor-risk`"

---

## Reference Files

The following reference files govern this skill's detailed behavior. They are loaded on-demand when the relevant behavior is being applied — they are not front-loaded into every response.

| File | Purpose |
|------|---------|
| `references/reasoning-blueprint.md` | Problem classification taxonomy, domain heuristics, common failure modes, and expert judgment patterns for this skill |

---

## Security & Permissions
- network_access: outbound_allowlist (CRM, CS platform per configured integrations)
- filesystem_write: false
- filesystem_read: config files only (~/.claude/plugins/config/claude-for-customer-success/csm/CLAUDE.md and company-profile.md)
- subprocess_execution: false
- dynamic_code_execution: false

## Trust & Verification
- Escalation routing must follow the configured escalation matrix — do not invent routing
- Risk classifications are internal — must not appear in any customer-visible output
- If config files are missing or contain [PLACEHOLDER] markers, halt and prompt for /csm:cold-start-interview
- If churn signal thresholds are not configured, surface the gap explicitly rather than applying defaults