Effective Escalation: What to Say, and to Whom

Chapter 4 previewed this: an escalation is, in large part, the same anatomy of a good ticket, aimed outward. This chapter finishes that thought — what changes when you're the one sending it, the two genuinely different audiences an escalation can have, and why a well-kept timeline (Chapter 5) makes writing a good one almost trivial.

Escalation Is a Ticket, Sent Outward

All of Chapter 4's core elements still apply — what was observed, steps to reproduce, scope, exact timestamps, correlation IDs. An escalation adds two more: what's already been checked and ruled out (so the person receiving it doesn't waste time repeating work already done), and a clear, specific ask — a decision, an investigation, an authorization, a concrete action. Without that ask, even a perfectly evidenced escalation leaves the recipient guessing what's actually being requested of them.

Two Genuinely Different Audiences

Conflating the two wastes the escalation either way — a deeply technical stack trace doesn't help a manager who needs a business-impact summary and a decision to make; a vague "this is bad" doesn't help an engineer who needs the actual evidence to act on.

Escalation Paths and On-Call Rotations

Most real organizations have a defined path — a primary on-call, a secondary if the primary doesn't respond within some window, then a lead or manager. Knowing this path before an incident happens, not scrambling to figure it out during one, is itself part of good incident response.

A Good Escalation, Built Directly From a Timeline

A well-kept live timeline makes this almost trivial to write — it's a summary of what's already been recorded, not a fresh writing exercise.

Same underlying incident, a completely different message — no query text, no pid numbers, because none of that helps a management decision-maker. What they need is business impact and a clear, specific decision to authorize.

Escalating Too Early vs. Too Late

Escalating before doing any basic first-pass diagnosis wastes the recipient's time and can look like skipped due diligence. Sitting on something well past the point where help would clearly be faster prolongs the incident unnecessarily. A rough heuristic: time-box against the ticket's own severity — a SEV1 gets minutes, not hours, before escalating; a SEV3 can reasonably take longer before that becomes the right call.

Hands-On Exercises