Play 8 Workflow Diagram (Visual)

This diagram maps the parallel execution paths that activate the moment an emergency hits your firm. Three streams run simultaneously: acknowledgment tracking, SMS blast to responders, and a countdown timer that forces escalation if no one takes ownership.

The workflow assumes you've already defined what constitutes an emergency (client data breach, regulatory deadline miss, partner incapacitation, system outage blocking billable work). If you haven't, stop here and build that definition first.

The acknowledgment stream tracks who takes ownership and how fast.

Trigger Event Emergency detected via client email flagged "URGENT", monitoring alert from your practice management system, or manual escalation by any team member with emergency access.

Immediate Actions (0-2 minutes)

1. System logs the emergency timestamp in your incident tracking tool (ServiceNow, Jira Service Management, or a dedicated Slack channel with timestamp bot).
2. System assigns a unique incident ID (format: EMRG-YYYY-MM-DD-###).
3. System pulls the on-call roster and identifies the primary responder based on current rotation.

Acknowledgment Requirements The assigned responder must click "Acknowledge" within 5 minutes. This action:

• Stops the Level 1 escalation timer
• Logs their name as incident owner
• Triggers a status update requirement (15-minute deadline)

Information Capture The responder immediately records:

• Emergency category (client-facing, internal operations, regulatory, security)
• Affected client(s) or department(s)
• Estimated scope (single matter, multiple clients, firm-wide)
• Initial severity rating (P1-Critical, P2-High, P3-Medium)

No acknowledgment within 5 minutes? The workflow auto-escalates to the secondary responder and notifies the practice group leader.

SMS goes to all designated emergency responders simultaneously with acknowledgment tracking. Email is too slow. Slack messages get missed. SMS cuts through.

Recipient List Your SMS blast hits:

• Primary on-call responder
• Secondary backup responder
• Practice group leader or department head
• Operations director
• Managing partner (for P1 incidents only)

Message Template

EMERGENCY [INCIDENT-ID]
Category: [CLIENT/OPERATIONS/SECURITY/REGULATORY]
Reported: [TIME]
Affected: [CLIENT NAME or SYSTEM]
Severity: [P1/P2/P3]
Assigned: [RESPONDER NAME]
Acknowledge: [LINK]
Status Dashboard: [LINK]

SMS Tool Configuration Use Twilio or AWS SNS with these settings:

• Delivery confirmation required
• Retry failed sends after 30 seconds (max 3 attempts)
• Log all delivery timestamps
• Fallback to voice call if SMS fails twice

Cost Reality Budget $0.02 per SMS. A 10-person emergency roster costs $0.20 per incident. Run 50 emergencies per year = $10 annual SMS cost. This is not a budget constraint.

The timer prevents incidents from stalling because someone acknowledged but then disappeared.

Timer Stages

Stage 1: Initial Response (15 minutes) Clock starts when the primary responder clicks "Acknowledge". They must post an initial status update within 15 minutes containing:

• Confirmed scope of the emergency
• Immediate actions taken
• Resources needed
• Estimated time to resolution or next update

Miss this deadline? Auto-escalate to Stage 2.

Stage 2: Management Involvement (30 minutes) Practice group leader or operations director takes over. They have 30 minutes to:

• Review all actions taken
• Assign additional resources
• Notify affected clients (if applicable)
• Post updated status with resolution plan

No update within 30 minutes? Auto-escalate to Stage 3.

Stage 3: Executive Crisis Mode (60 minutes) Managing partner and executive team assume control. They have 60 minutes to:

• Convene crisis response team
• Engage external resources (legal counsel, PR firm, forensic consultants)
• Draft client communication plan
• Determine if business continuity plan activation is required

Timer Override Any responder can manually escalate to the next stage before the timer expires. Use this when the situation is deteriorating faster than the standard timeline allows.

Decision 1: Acknowledge or Escalate? If the primary responder is unavailable (in court, on a plane, unreachable), they should NOT acknowledge. Let the timer escalate to the secondary responder who can actually take action.

Decision 2: Contain or Communicate? At the 15-minute mark, decide: Can you contain this internally, or do clients need immediate notification? Default to over-communication with clients. They will forgive a false alarm. They will not forgive being blindsided.

Decision 3: Internal Resources or External Help? At the 30-minute mark, if you're not making progress, bring in external specialists. Waiting until Stage 3 to call your cyber insurance hotline or outside counsel wastes critical hours.

The diagram uses three parallel swimlanes:

Swimlane 1: Acknowledgment Track

[Emergency Detected] → [Assign Primary] → [5-Min Wait] → [Acknowledged?]
                                              ↓ No
                                         [Assign Secondary] → [Escalate to Leader]

Swimlane 2: SMS Notification Track

[Emergency Detected] → [Pull Roster] → [Send SMS Blast] → [Log Delivery] → [Monitor Acknowledgment Links]

Swimlane 3: Escalation Timer Track

[Acknowledgment Received] → [Start 15-Min Timer] → [Status Posted?]
                                                        ↓ No
                                                   [Start 30-Min Timer] → [Management Update?]
                                                                              ↓ No
                                                                         [Start 60-Min Timer] → [Executive Takeover]

Build this workflow in your automation platform (Zapier, Make, Power Automate, or custom code):

• [ ] Define emergency trigger sources (email keywords, monitoring alerts, manual button)
• [ ] Configure on-call rotation with primary and secondary responders
• [ ] Set up SMS provider account with delivery confirmation enabled
• [ ] Create incident tracking system with unique ID generation
• [ ] Build acknowledgment interface (web form or Slack button)
• [ ] Configure three-stage timer with auto-escalation logic
• [ ] Create status update templates for each escalation level
• [ ] Test the full workflow with a simulated emergency (quarterly minimum)
• [ ] Document override procedures for manual escalation
• [ ] Train all emergency responders on their specific roles

The Acknowledge-and-Forget Responder clicks acknowledge to stop the alarm, then gets pulled into another crisis. Solution: The 15-minute status update requirement catches this. No update = auto-escalate.

The SMS Black Hole Messages go to a phone number that's no longer active. Solution: Require quarterly verification of all emergency contact numbers. Send a test message and require reply confirmation.

The Timer Ignored Team treats escalation timers as suggestions, not deadlines. Solution: Make timer compliance a performance metric. Track and report escalation response times monthly.

The Scope Creep What started as a single-client issue expands to affect multiple clients, but the severity rating never gets updated. Solution: Require severity re-assessment at each escalation stage.

This workflow eliminates the "who's handling this?" confusion that kills emergency response speed. Every incident has a named owner within 5 minutes, a status update within 15 minutes, and automatic escalation if those deadlines slip.