Triggers and escalation

What the system watches for, when it raises a risk, who owns it by default and where an overdue action goes. Everything on this page is configuration; nothing here is an approved company rule yet.

Risk register Alert recipients

Escalation ladder for overdue actions

LevelAfterGoes to

With this ladder on the reporting date

Action	Owner	Due	Days overdue	Escalation

Detected risk not assessed after (days)

Closure authority

Acceptance, deferral and closure are decisions. They are taken by the named authority, with a reason, and cannot be automated.

What automation may do

Step	Done by
Create a risk from a trigger, with evidence	Rule
Link a repeated detection to the open risk	Rule
Escalate an overdue action along the ladder	Rule
Explain the pattern, propose treatment and owners, draft a follow-up	AI drafts a person decides
Assess, assign, accept, defer, resolve, close	Named person

Each automatic step and each decision is written to the audit log. Rules that act without a person are listed under Automations. Simulated in the prototype: no job runs in the background.