Ethical Frameworks Framework: When to Escalate, Who Decides

An ethical framework for workplace requests is only as good as its thresholds. They decide whether a request that does not look right ever reaches a person with the standing to act on it, on a Thursday afternoon when the person asking outranks everyone in the room.

Three parts are quietly defeated more often than the rest: when a case goes up, who decides at each level, and what gets written down.

What to take away

Thresholds are where frameworks are quietly defeated. Set them by consequence, not by amount.
Decision rights follow incentive. Nobody should decide a case whose outcome affects their pay, or one where the requester is above them in the reporting line.
Records are short and written before the outcome is known. Test the path a case takes, not the document.

The five parts a threshold sits inside

A threshold is useless alone. It needs four companions, and missing any one of the five makes the rest ornamental.

Five Required Framework Elements

Triggerrequest departing documented process
First action costing individual nothing
Threshold for going upnumber or category
Named destinationa person, not department
Rule for what gets recorded

A trigger. How does a person know this applies? "Use good judgment" is not a trigger. Something like: a request to depart from a documented process, an approval where you have a personal interest, a claim going to a customer that you cannot evidence, a payment to a party whose role you cannot describe.

A first action that costs the individual nothing. The framework has to work for the most junior person in the building. The first step is asking a clarifying question, moving the request into writing, or checking with a named colleague, not a formal declaration.

A threshold for going up. With a number or a category attached. Vague escalation guidance means nothing escalates until it is too large to contain.

A named destination. Not a department. If the framework says "escalate to Compliance" and nobody can name a person, it terminates in a mailbox.

A rule about what gets recorded. By whom, where, and how long it is kept.

Setting thresholds that work

Thresholds fail in two directions. Both defeat the framework, and neither shows up in the document itself, only in what happens when a real case arrives.

Threshold Failure Patterns

Set too high

Effect: Nothing reaches authority
Consequence: Wrong people decide
Outcome: Difficult decisions unowned
Frequency: Less common

Set too low

Effect: Escalation route floods
Consequence: Response times collapse
Outcome: Channel loses credibility
Frequency: More common than it looks

Set too high, so that almost nothing reaches the level with authority to act, and the organization's difficult decisions are all made by people who lack the standing to make them.

Set too low, so the escalation route floods, response times collapse, and people learn that using it produces nothing. This failure is more common than it looks and it is terminal, because the channel loses credibility and does not get it back.

Some practical guidance:

Set the threshold by consequence, not by amount. A small payment to an intermediary can matter more than a large ordinary invoice.
Include a personal-interest trigger with no monetary floor. Interest compromises judgment at any size.
Add a "the requester is my manager" trigger with a different route attached. This is the most common situation for which frameworks have no answer.
Review the volume after a quarter. Nothing arriving means the trigger is not recognizable. Everything arriving means it is not discriminating.

For a usable rule, define escalation categories in advance: any personal interest, any suspected legal violation, any request to bypass a documented control, and any matter beyond delegated authority. Set any monetary trigger against the company's own approval limits; there is no universal dollar cutoff that fits every organization.

The US DOJ Criminal Division's Evaluation of Corporate Compliance Programs describes evidence an outside reviewer may look for when evaluating a program. A record of how cases were routed is part of that evidence.

Routing the legal questions

Some triggers are not the framework's to decide. Employment, competition, anti-corruption, personal data, product safety, financial reporting and sanctions are legally governed, and requirements vary by jurisdiction and sector.

Examples include the Foreign Corrupt Practices Act (FCPA), the Sherman Act, Title VII of the Civil Rights Act, the General Data Protection Regulation (GDPR) where it applies, the Consumer Product Safety Act, the Sarbanes-Oxley Act and sanctions administered by the Office of Foreign Assets Control (OFAC).

The framework's job is not to determine what these rules permit, but to route the question to counsel before a decision is made.

Two questions to ask at every level

Ask whether the decision can be undone. If one option can be undone and the other cannot, prefer the recoverable one when the facts are still thin.

Then ask whether it is yours to decide, judged by consequence and by incentive: does it exceed my authority, and would a reasonable observer think my interests compromise my judgment? A yes to either sends the case up.

A third question belongs in the record rather than the meeting: what would change my mind? Answering it while still uncertain is the difference between a record and a justification.

Deciding who decides

Decision rights follow two things, consequence and incentive. The table gives a default home for each kind of decision, and the last row is a blunt instrument and the most reliable one in it.

Feature of the decision	Where it should sit
Reversible, effects contained within one team	The team, recorded
Affects a customer or a third party who cannot object	One level up, with the affected party identified
The decision-maker's pay depends on the outcome	Someone whose does not
The person asking is in the reporting line above the decider	A route that bypasses that line
Legal or regulatory exposure	Counsel first, then the level that can carry the consequence
Would be a problem if reported accurately in public	The level that would have to answer for it

If the procedure has an owner, it should be someone whose standing does not depend on the answers it produces. If the owner reports to the person who wants a particular outcome, the procedure records decisions rather than shaping them.

What to write down

Keep the record short, and write it before the outcome is known. Six lines:

The request, stated precisely, including relevant names and amounts.
The affected parties and obligations identified.
The options considered and whether they can be reversed.
The relevant policy or legal concern, and whether counsel was consulted.
The escalation route and the named decision owner.
The decision, its reasoning, and what would change the answer.

Six Lines to Record

What was asked, precisely
What we knew and did not
Obligations on each side, who bore cost
What we decided
What we accepted as cost
What would have changed it

Name the ethics or compliance record location and its owner. Set a retention period in the company's records-retention schedule, with counsel reviewing applicable legal and regulatory requirements. A record written afterwards is worth very little; a record written under uncertainty is the only artifact that makes the next case easier, and it protects the person who decided.

Testing whether the thresholds work

Do not audit the document. Test the path a case takes:

Run a recent, anonymized case through the procedure and check whether the trigger is recognizable.
Ask a junior employee to identify the first action they can take without personal cost.
Follow the route and note any point where the decision-maker lacks information or authority.
Test a case involving a personal interest and one involving a manager's request; confirm each has a clear escalation destination.
Check that the resulting record can be found, has a named owner, and follows the company's retention rule.

Testing the Path

Walk a real situation step by step
Ask five people at different levels
Time an escalation through the route
Count decisions against commercial recommendation
Ask what happened to last three users

What thresholds cannot do

A threshold cannot beat an incentive. If a target can only be hit by doing the thing the framework prohibits, the framework loses, every time, and the people who follow it are penalized for it.

It cannot substitute for a control. Where a process allows one person to authorize, execute, and verify the same transaction, fix the process rather than asking people to be careful.

It cannot make an unsafe channel safe. If raising something has visibly damaged someone recently, no procedure written this year outweighs that.

And it cannot decide a genuine conflict of obligations for you. What it can do is make sure the conflict is seen clearly, by the right person, in time, with the reasoning on the record. For that conflict, the procedure can use the four ethical lenses in the Markkula Center's decision-making resource: utility, rights, justice and common good.

Common questions

How long should running this take?

For most decisions, under an hour, and the written output should fit on a page. A procedure that takes a workshop will be skipped at exactly the moment it is needed.

Who should own the procedure?

A Chief Ethics and Compliance Officer or designated compliance lead can own the procedure, with the General Counsel as the destination for legal and regulatory questions. Name the responsible individual and a backup in the written procedure.

What if people disagree after running it?

That is the procedure working. Record the disagreement, decide, and note what would have changed the answer. A group that always converges is not reasoning together, it is deferring to someone.