Escalating a safety signal to a decision: who decides, how fast, and what happens if they disagree

Signals get stuck for human reasons, not technical ones: a handler is unsure whether a report is serious enough to escalate, a decision maker is on holiday, a team disagrees about severity, or a signal arrives on a Friday and waits until Monday. Each delay is understandable in isolation, yet together they create a system where serious signals wait while a weekly meeting approaches, and where a handler who escalated once and was dismissed learns not to escalate again. Escalation design must therefore address uncertainty, absence and disagreement explicitly, rather than assuming goodwill and availability will carry every signal through.

Immediate escalation triggers should be written plainly and should include any report of injury, fire, smoke, melting, electric shock, swallowed parts or magnets, and any report that suggests a product could cause serious harm even if no injury occurred. They should also include repeated similar reports for one product or batch within a short period, a supplier notice about a component, and a regulatory alert mentioning a similar product. Handlers should be able to recognise those triggers without judgement calls: if a report mentions injury, fire or a swallowed part, it escalates, without the handler needing to decide whether the injury was serious enough.

Triggers should also cover volume: a sudden rise in complaints for one product, even when individual reports seem minor, may indicate a batch problem that individual handlers cannot see. A trigger based on volume, such as a set number of similar reports in a week for a small seller, should be calibrated to sales volume, so a busy product does not trigger constantly while a slow product never triggers. Calibrate triggers from past data where available, and review them periodically as sales change.

Escalation needs a named decision maker and a named deputy, so absence does not stall decisions. The decision maker should be someone who can authorise investigation, supplier contact, sales pause or customer communication, within agreed limits, without needing further approval for precautionary steps. The deputy should have the same authority when the decision maker is away, and handlers should know both names and how to reach them outside normal hours for serious triggers. A route that depends on one person, who may be on holiday when a serious signal arrives, is not a route; it is a single point of failure.

Decision authority limits should be clear: a decision maker may pause a batch or contact a supplier without further approval, while a full recall or a public notice may require a higher approval, with a timeframe for that approval that does not delay precautionary steps. Precautionary steps, such as pausing sales of an affected batch, should never wait for a higher approval, since their purpose is to prevent further exposure while a fuller decision is made. Write those limits down, so a decision maker under pressure does not need to guess their authority.

Disagreement about a signal is normal: one team member may see a pattern, another may see coincidence, and a supplier may dispute a cause. Disagreement should be handled by evidence and by a decision, not by delay: gather the grouped reports, the batch information and any test or supplier evidence, discuss the four decision factors, and let the named decision maker decide, recording dissenting views and the reasoning for the decision. A decision recorded with dissent is stronger than a decision reached by suppressing dissent, since it shows the disagreement was considered rather than ignored.

Illustration: a team selling heaters disagreed whether 40 reports of a smell indicated a batch fault or normal new heater odour. The decision maker grouped the reports by batch, found they concentrated in one batch, and decided to investigate that batch while watching others. The report count is illustrative, and the lesson is that grouping by batch often resolves disagreement that argument alone cannot, since concentration is evidence that opinions are not.

Test the escalation route with a simulated serious report: give a handler a mock report mentioning a burn, and time how long it takes to reach the decision maker, what information travels with it, and what decision is made. Note every delay, missing name, unclear trigger or authority doubt, and fix it before a real serious report arrives. A route tested in calm conditions will work under pressure; a route first tried during a real crisis will fail at the moment it matters most, when handlers are stressed and decision makers are busy.

As a business grows, escalation should gain structure without losing speed: add a triage step for volume, add a decision log, and add a weekly signal review, but keep immediate triggers immediate, keep a named decision maker and deputy, and keep precautionary authority with the decision maker. Growth that adds committees between a serious report and a decision maker slows protection, while growth that adds grouping, logging and review around a fast core strengthens it. Review the escalation route annually, and after any serious signal, to keep it fast as the business changes.