| Course | WMBA 6623 Enterprise and Project Risk Management |
|---|---|
| Week | Week 10 |
| Paper type | Escalation protocol |
| Length | About 880 words, 6 pages |
| Format | APA 7 student paper |
| School | Walden University |
| Program | Master of Business Administration (MBA) |
| Updated | October 2026 |
Free sample paper for WMBA 6623 Week 10
Escalation Protocol: Four Tiers, Measurable Triggers, Who Raises and Who Receives, Maximum Minutes to Notify and the Decision Each Level Owns, Traced Through a Friday-Evening Card Authorization Outage
Student Name
Walden University
WMBA 6623: Enterprise and Project Risk Management
Instructor Name
Month Day, Year
Escalation Protocol: Four Tiers, Measurable Triggers, Who Raises and Who Receives, Maximum Minutes to Notify and the Decision Each Level Owns, Traced Through a Friday-Evening Card Authorization Outage
Tier Definitions
This protocol sets out who hears about operational and technology events at Lakeshore Community Bank, a composite Michigan lender, and how fast. It applies to events that affect customers, operations or the bank's obligations to regulators.
Tier 1 is an operational event handled within a department: a limited disruption that the department's own manager can resolve without affecting customers beyond normal service levels.
Tier 2 is a significant event: one that affects customers noticeably, crosses departments or may approach a risk tolerance. The Chief Operating Officer or Chief Information Officer takes ownership.
Tier 3 is a major event: one that threatens a risk tolerance, affects many customers or may require notice to a regulator. The Chief Executive Officer and the Chief Risk Officer take ownership, and the incident team convenes.
Tier 4 is a crisis: a breach of tolerance with material financial, legal or reputational consequences. The board's risk committee chair is informed, and the full crisis plan applies.
Routing Table
Table 1
Escalation Routing
| Tier | Triggering condition | Raised by | Received by | Maximum time to notify | Decision the receiver owns | |
|---|---|---|---|---|---|
| 1 | Any customer-facing system degraded under 30 minutes, or a servicing error affecting under 100 accounts | Shift supervisor or system administrator | Department manager | 15 minutes | Fix, workaround and customer messaging at branch level | |
| 2 | Customer-facing system down 30 to 90 minutes, card declines above 2% of attempts, or an error affecting 100 to 500 accounts | Department manager | Chief Operating Officer or Chief Information Officer | 30 minutes after trigger | Cross-department response, vendor escalation, website and phone messages | |
| 3 | Outage over 90 minutes, card declines above 10%, an error affecting over 500 accounts, or any incident that may require regulator notice | Chief Operating Officer or Chief Information Officer | Chief Executive Officer and Chief Risk Officer | 30 minutes after trigger | Incident team activation, customer remediation, regulatory notice decision | |
| 4 | Tolerance breached with material harm, confirmed data breach or a regulatory notice filed | Chief Executive Officer | Risk committee chair and general counsel | 2 hours | Board communication, public statement, crisis plan activation | |
Times run from the moment a condition is met, not from when it is noticed; the bank and roles are composite.
Regulatory Overlay
Federal banking rules require a bank to notify its primary federal regulator no later than 36 hours after it determines that a computer-security incident has risen to the level of a notification incident, one that has materially disrupted or is reasonably likely to materially disrupt its operations or customers (12 C.F.R. § 304.23). The same rules require a bank service provider to notify the bank as soon as possible when an incident has disrupted or is reasonably likely to disrupt covered services for four or more hours (12 C.F.R. § 304.24). Tier 3 owns the decision whether an event is a notification incident, which is why any event that may require notice is escalated there. The NIST framework likewise treats coordinated incident communication with internal and external stakeholders as part of responding to an incident (National Institute of Standards and Technology, 2024).
Trace: Card Authorization Outage
6:40 p.m., Friday. The bank's debit card processor begins declining authorizations after a failed software update. The card operations analyst on duty sees declines rise to 6 percent of attempts on the monitoring screen.
6:46 p.m. Declines exceed 2 percent for five minutes, meeting the Tier 2 trigger. The analyst calls the card operations manager, who confirms and pages the Chief Information Officer at 6:58 p.m., within the 30-minute limit. The processor's help desk reports a "partial outage" with no estimated fix time.
7:20 p.m. Declines reach 14 percent, meeting the Tier 3 trigger. The Chief Information Officer notifies the Chief Executive Officer and Chief Risk Officer at 7:31 p.m. The incident team convenes by phone at 7:45 p.m. It posts a website banner, records a phone message and asks branches opening Saturday to stock cash for customers.
8:10 p.m. The Chief Risk Officer asks whether the event is a notification incident. The team decides it is not yet: the cause is an operational failure, not a security incident, and no data appears compromised. The decision and its basis are logged, with a review at 10 p.m.
9:30 p.m. The processor restores service after 2 hours and 50 minutes. Because the disruption lasted under four hours, the processor's notice duty under § 304.24 is not triggered, but the bank requests a written root cause report anyway.
Saturday morning. The incident team counts about 14,200 declined transactions and approves reimbursement of any overdraft or merchant fees customers can document. The event stays at Tier 3; no tolerance was breached.
What the Trace Showed
The protocol worked on timing: each notice went out within its limit. One gap appeared. The analyst who first saw the declines waited six minutes to be sure, then called a manager who was at dinner. The protocol will be amended so the first notice goes to an on-call manager list, not a single person. ISO 31000 treats communication and consultation as part of every stage of risk management (International Organization for Standardization, 2018), and the amendment closes the gap the trace exposed.
References
Computer-security incident notification, 12 C.F.R. §§ 304.21-304.24 (2024).
International Organization for Standardization. (2018). Risk management: Guidelines (ISO Standard No. 31000:2018).
National Institute of Standards and Technology. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29
WMBA 6623 Week 10 instructions, in plain terms
The escalation protocol assignment asks students to design how risk events move up an organization. Instructors expect a routing table with tiers down the side and columns for the triggering condition stated in measurable terms, the role that raises it, the role that receives it, the maximum time before notification and the decision the receiving level owns. Short tier definitions sit above the table. Below it, a trace follows a single event through the protocol with times, showing whether it works. Regulatory notification requirements, where they apply, should be built into the tiers. The trace should record times so a reader can check every notice against its limit. Any gap the trace exposes should be fixed in the protocol itself. Backup recipients prevent delays.
How this WMBA 6623 Week 10 example is built
Four short paragraphs define the tiers. A routing table sets triggers, roles, time limits and decisions for each tier. A regulatory section explains the federal incident notification rules for banks and their service providers and why Tier 3 owns the notification decision, citing the NIST framework on incident communication. A trace follows a card authorization outage from the first declines through Tier 2 and Tier 3 escalation, customer messaging, the regulatory decision, restoration and remediation. A closing section reports that time limits held and fixes one gap, citing ISO 31000 on communication. Margin comments flag the tier definitions and the trace. Times in the trace are checked against each tier's notification limit.
Reading the WMBA 6623 Week 10 rubric
Graders reward triggers that are measurable and time limits that are specific. Assigning a clear decision to each receiving level shows governance. Incorporating regulatory notification requirements accurately demonstrates awareness. A realistic trace with times, showing the protocol in use, carries significant weight. Identifying and fixing a gap the trace reveals shows learning. Thresholds stated as numbers or times, so nobody has to judge whether to escalate, are the mark of a usable protocol. Protocols that show how a regulatory decision is made, and logged, during an incident show the strongest command of the topic. A protocol that names a backup recipient for each tier avoids delays when one person is unavailable.
WMBA 6623 Week 10 help from the desk
Define your tiers by seriousness, then write a measurable condition that moves an event into each. Name who raises it, who receives it, how fast and what that person decides. Check whether any regulator or contract requires notice within a set time, and build it in. Then test the protocol on one realistic event, minute by minute. Students often lose marks by using vague triggers such as major outage, by omitting time limits or by skipping the trace. Another frequent gap is ignoring regulatory deadlines. If you would like a custom sample escalation protocol for your organization, send us its main systems and roles.
Get a WMBA 6623 Week 10 example written to your instructions
Send over the Week 10 prompt with the rubric and, if your section set one, the organization the protocol covers. The routing table arrives with tiers defined by consequence, clocks that start at detection, and one incident traced through every level. Free the first time, back in 24-48 hours.
More WMBA 6623 papers and MBA samples
- WMBA 6623 Week 1: Named Risk Discussion Post
- WMBA 6623 Week 2: Project Risk Identification Table
- WMBA 6623 Week 3: Project Risk Register
- WMBA 6623 Week 4: Qualitative Risk Scoring Matrix
- WMBA 6623 Week 5: Risk Score Challenge Replies
- WMBA 6623 Week 6: Quantitative Risk Analysis
- WMBA 6623 Week 7: Risk Response Plan
- WMBA 6623 Week 8: Risk Contingency Reserve Brief
- WMBA 6623 Week 9: Risk Appetite Governance Memo
- WMBA 6623 Week 11: Quarterly Enterprise Risk Report
- WMBA 6627 Week 10: Executive Stakeholder Briefing Note
- WMBA 6620 Week 10: Earned Value Status Report
- WMBA 6615 Week 10: Culture Investment Brief
- WMBA 6608 Week 1: Third-Party Payment Post
WMBA 6623 Week 10 questions, answered
Where can I find a free WMBA 6623 Week 10 sample paper?
The risk escalation protocol with a card outage trace is published in full here.
How many tiers are there?
Four, from departmental events to crises reported to the board's risk committee chair.
What triggers Tier 3?
An outage over 90 minutes, card declines above 10 percent, an error affecting over 500 accounts or a possible regulatory notice.
What regulatory deadline applies?
Notice to the primary federal regulator within 36 hours of determining a notification incident.
What gap did the trace reveal?
First notices went to a single manager, so they will now go to an on-call list.