QULDEXResources · Glossary
What is an escalation path? Levels, triggers and examples
What is an escalation path for?
Most overdue actions are not refused; they are simply not prioritised. Escalation changes that by making the delay visible to the next level of management at a set point.
A path only works if it is automatic and if the final level has real authority to reassign work, release budget or accept the risk.
What does an escalation path define?
The condition that starts each step, such as days overdue or a severity level.
The named role at each step, from the owner's manager upwards.
What each level must do: reassign, extend with a reason, or accept the risk.
What does an escalation path look like?
An example path for a high-severity corrective action. Timings are illustrative.
| Point | Who is notified and what is expected |
|---|---|
| Due date minus 5 days | Owner: reminder |
| Due date passed | Owner and their manager: explain and give a new date |
| 7 days overdue | Head of function: reassign or approve an extension |
| 14 days overdue | Risk committee: decide to resource the fix or formally accept the risk |
This is an illustration written for this page, not a customer record.
Where do frameworks expect escalation?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Annex A 5.24 | Incident management is planned, with roles, responsibilities and procedures including escalation. |
| ISO 27001 | Clause 9.3 | Management review considers the status of actions and nonconformities. |
| SOC 2 | CC4.2 | Deficiencies are communicated to those responsible and to senior management and the board as appropriate. |
| NIST CSF 2.0 | RS.CO | Response activities are coordinated with internal and external stakeholders. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
Why does escalation fail?
Manual chasing
Escalation depends on someone noticing.
Instead: trigger it from due dates automatically.
Escalating to the wrong level
The next person cannot change priorities either.
Instead: end the path with someone who can decide.
No required response
Senior people are copied in and nothing is asked of them.
Instead: state the decision expected at each level.
How does QULDEX handle this?
Each finding becomes an action with an owner, a due date and escalation, closed only after a reviewer verifies the evidence.
Escalation Path: common questions
What is an escalation matrix?
A table that sets out the escalation path: the triggers down one side and, for each, who is notified and what they must do.
When should an item be escalated?
When it passes a point set in advance, usually a number of days overdue that depends on severity. Deciding the points beforehand removes the judgement call.
Is escalation a sign of failure?
No. It is a control working as designed: it moves a decision to the level that can make it.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO/IEC 27002:2022, Information security controls
- NIST Cybersecurity Framework (CSF) 2.0
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Overdue items reach someone who can act
Controls, evidence, findings and corrective actions in one audit workspace.